View: Comprehensive CWE Dictionary
Draft
Type: Implicit
Objective
This view (slice) covers all the elements in CWE.
Membership
| ID | Name | Description |
|---|---|---|
| CWE-1004 | Sensitive Cookie Without 'HttpOnly' Flag | This vulnerability occurs when an application stores sensitive data in a cookie but fails to set the 'HttpOnly' flag, leaving the cookie accessible to client-side scripts. |
| CWE-1007 | Insufficient Visual Distinction of Homoglyphs Presented to User | This vulnerability occurs when an application shows text or symbols to users without clearly distinguishing between characters that look identical or very similar (called homoglyphs). Because users can't easily tell these characters apart, they might misinterpret information and accidentally perform unsafe actions, like clicking a malicious link. |
| CWE-102 | Struts: Duplicate Validation Forms | This vulnerability occurs when an application defines multiple Struts validation forms with identical names. The framework then unpredictably selects only one form for validation, potentially bypassing intended security checks. |
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | This vulnerability occurs when a web application fails to properly control whether its pages can be embedded within frames or UI layers from other websites, potentially misleading users about which site they are interacting with. |
| CWE-1022 | Use of Web Link to Untrusted Target with window.opener Access | This vulnerability occurs when a web application links to an external, untrusted site without protecting its own window from being manipulated by that site. Specifically, it fails to prevent the external page from altering security-sensitive properties of the `window.opener` object, such as the page's location. |
| CWE-1023 | Incomplete Comparison with Missing Factors | This weakness occurs when a program compares two items but fails to check all the necessary attributes that define their true relationship. The incomplete check can cause the software to treat different items as identical or make incorrect security decisions. |
| CWE-1024 | Comparison of Incompatible Types | This vulnerability occurs when code directly compares two values of fundamentally different data types, which can lead to unreliable or incorrect results because the comparison logic doesn't handle the type mismatch properly. |
| CWE-1025 | Comparison Using Wrong Factors | This weakness occurs when a program compares two items but checks the wrong properties or attributes. This flawed comparison leads to incorrect decisions, creating security and logic errors. |
| CWE-103 | Struts: Incomplete validate() Method Definition | This vulnerability occurs in a Struts application when a validator form either completely omits a validate() method or includes one but fails to call super.validate() within it. |
| CWE-1037 | Processor Optimization Removal or Modification of Security-critical Code | This vulnerability occurs when a processor's performance optimization unintentionally strips out or alters security-critical code that a developer intentionally placed in the software. |
| CWE-1038 | Insecure Automated Optimizations | This vulnerability occurs when software uses automated tools to optimize code for performance or efficiency, but those optimizations accidentally weaken or bypass critical security protections that the original code relied upon. |
| CWE-1039 | Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism | This vulnerability occurs when a system uses automated AI or machine learning to classify complex inputs like images, audio, or text, but fails to correctly identify or process inputs that have been deliberately altered. Attackers can exploit this by crafting subtle modifications that cause the system to misclassify the input, leading to incorrect and potentially harmful decisions. |
| CWE-104 | Struts: Form Bean Does Not Extend Validation Class | This vulnerability occurs in Apache Struts applications when a form bean class does not properly extend the framework's validation class. This bypasses the built-in Validator framework, leaving the application without structured input validation and open to various injection and data manipulation attacks. |
| CWE-1041 | Use of Redundant Code | This weakness occurs when a codebase contains identical or nearly identical logic duplicated across multiple functions, methods, or modules. This redundancy creates unnecessary complexity and maintenance overhead. |
| CWE-1042 | Static Member Data Element outside of a Singleton Class Element | This weakness occurs when a class that isn't designed as a singleton (a class meant to have only one instance) contains a non-final static member variable. This creates a shared, mutable state across all instances of that class, which can lead to unexpected behavior and data corruption. |
| CWE-1043 | Data Element Aggregating an Excessively Large Number of Non-Primitive Elements | This weakness occurs when a data structure, like a class or object, contains too many complex sub-elements (e.g., other objects or structs) instead of simple primitive types. |
| CWE-1044 | Architecture with Number of Horizontal Layers Outside of Expected Range | This occurs when a software system is built with either too many or too few distinct architectural layers, falling outside a recommended range that supports maintainability and security. |
| CWE-1045 | Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor | This occurs when a base class defines a virtual destructor, but a derived class inherits from it without declaring its own virtual destructor. |
| CWE-1046 | Creation of Immutable Text Using String Concatenation | This weakness occurs when code builds a string within a loop using simple concatenation (like +=), which unintentionally creates new string objects every time instead of efficiently appending to a buffer. |
| CWE-1047 | Modules with Circular Dependencies | This weakness occurs when software modules have circular references, meaning Module A depends on Module B, which in turn depends back on Module A, creating a closed loop. |
| CWE-1048 | Invokable Control Element with Large Number of Outward Calls | This weakness occurs when a single function, method, or callable code block makes an excessively high number of calls to other objects or components outside its immediate scope. This creates a complex, tightly-coupled web of dependencies that is difficult to manage. |
| CWE-1049 | Excessive Data Query Operations in a Large Data Table | This weakness occurs when an application runs a database query that uses numerous joins and sub-queries on a very large table, leading to severe performance degradation. |
| CWE-105 | Struts: Form Field Without Validator | This vulnerability occurs when a Struts application form contains an input field that lacks a corresponding validator, leaving it open to unverified user input. |
| CWE-1050 | Excessive Platform Resource Consumption within a Loop | This vulnerability occurs when a loop contains code that repeatedly consumes critical system resources like file handles, database connections, memory, or session locks. Each iteration of the loop drains these finite platform assets without proper release. |
| CWE-1051 | Initialization with Hard-Coded Network Resource Configuration Data | This vulnerability occurs when software uses fixed, hard-coded values—like IP addresses, domain names, or URLs—to identify network resources during its startup or configuration phase. |
| CWE-1052 | Excessive Use of Hard-Coded Literals in Initialization | This weakness occurs when software initializes variables or data structures using hard-coded values (like strings, file paths, or network addresses) instead of configurable constants or parameters. While simple numbers or true constants are acceptable, embedding non-trivial literals directly in code creates maintenance and security risks. |
| CWE-1053 | Missing Documentation for Design | This weakness occurs when software lacks clear design documentation, making it difficult to understand how the system is structured and intended to work. |
| CWE-1054 | Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer | This weakness occurs when code in one architectural layer directly calls functions or methods in a much deeper layer, skipping over the intermediate layers that should normally handle the request. It bypasses the intended layered structure, similar to a manager going directly to an intern instead of working through the team lead. |
| CWE-1055 | Multiple Inheritance from Concrete Classes | This weakness occurs when a single class inherits functionality and state from more than one concrete (fully implemented) parent class. |
| CWE-1056 | Invokable Control Element with Variadic Parameters | This weakness occurs when a callable function or method is defined to accept a variable number of arguments (variadic parameters). |
| CWE-1057 | Data Access Operations Outside of Expected Data Manager Component | This weakness occurs when an application bypasses its dedicated, central data manager component and performs data access operations through other code paths. |
| CWE-1058 | Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element | This happens when a method or function, designed to run in a multi-threaded environment, accesses or modifies a non-final static variable or class member. Because the static element is not final, its state can be changed unexpectedly by concurrent threads, leading to race conditions and unpredictable behavior. |
| CWE-1059 | Insufficient Technical Documentation | This weakness occurs when a software or hardware product lacks comprehensive technical documentation. Missing or incomplete details about the system's architecture, interfaces, design, configuration, or operation make it difficult to understand, maintain, and secure the product effectively. |
| CWE-106 | Struts: Plug-in Framework not in Use | This weakness occurs when a Java application, particularly one using the Struts framework, does not implement a structured input validation plugin like the Struts Validator. Skipping this framework forces developers to write custom validation logic, which is often error-prone and increases the risk of security flaws from improperly handled user input. |
| CWE-1060 | Excessive Number of Inefficient Server-Side Data Accesses | This weakness occurs when an application makes an excessive number of individual data queries to a server or database, instead of using more efficient methods like stored procedures or batch operations. |
| CWE-1061 | Insufficient Encapsulation | This weakness occurs when a software component exposes too much of its internal workings, such as data structures or implementation logic. This lack of proper boundaries allows other parts of the system to interact with it in unintended ways, potentially leading to corrupted data, unexpected behavior, or hidden dependencies. |
| CWE-1062 | Parent Class with References to Child Class | This weakness occurs when a parent class directly references its child classes, their methods, or their member variables, creating a problematic and tightly coupled dependency. |
| CWE-1063 | Creation of Class Instance within a Static Code Block | This weakness occurs when a class instance is created inside a static initializer block, causing premature and potentially expensive object creation. |
| CWE-1064 | Invokable Control Element with Signature Containing an Excessive Number of Parameters | This weakness occurs when a function, method, or subroutine is defined with an unnecessarily high number of parameters in its signature. |
| CWE-1065 | Runtime Resource Management Control Element in a Component Built to Run on Application Servers | This weakness occurs when an application built to run on a managed application server bypasses the server's high-level APIs and instead uses low-level operating system calls to directly control resources like memory, files, or threads. |
| CWE-1066 | Missing Serialization Control Element | This weakness occurs when a class or data structure is marked as serializable but lacks the required control methods to properly handle the serialization and deserialization process. |
| CWE-1067 | Excessive Execution of Sequential Searches of Data Resource | This weakness occurs when a database query is structured in a way that forces the system to scan entire tables row-by-row, instead of using an available index for efficient lookups. |
| CWE-1068 | Inconsistency Between Implementation and Documented Design | This weakness occurs when the actual code implementation deviates from the intended design described in its official documentation, creating a mismatch between how the system is supposed to work and how it actually does. |
| CWE-1069 | Empty Exception Block | This weakness occurs when a try-catch or try-finally block is present but contains no code to handle the caught exception or perform cleanup. |
| CWE-107 | Struts: Unused Validation Form | This vulnerability occurs when a Struts application contains validation form definitions that are no longer linked to any active form or action, leaving outdated security rules in the codebase. |
| CWE-1070 | Serializable Data Element Containing non-Serializable Item Elements | This weakness occurs when a class or data structure is marked as serializable, but it contains one or more member elements that cannot be serialized. This mismatch prevents the entire object from being properly saved or transmitted. |
| CWE-1071 | Empty Code Block | An empty code block occurs when a section of source code, such as a conditional statement or function body, contains no executable statements. |
| CWE-1072 | Data Resource Access without Use of Connection Pooling | This weakness occurs when an application creates a new database connection for every request instead of using a managed connection pool. This inefficient pattern forces the system to repeatedly endure the full overhead of establishing and tearing down connections. |
| CWE-1073 | Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses | This weakness occurs when a client-side function or method makes an excessive number of individual data requests through a non-SQL data manager, instead of using more efficient bulk operations or database-native capabilities. |
| CWE-1074 | Class with Excessively Deep Inheritance | This weakness occurs when a class inherits from an excessive number of parent classes, creating a deep and complex inheritance hierarchy. |
| CWE-1075 | Unconditional Control Flow Transfer outside of Switch Block | This weakness occurs when code uses an unconditional jump, like a 'goto' statement, outside of a structured control flow block like a switch statement. This bypasses the intended logic and makes the program's execution path unpredictable and difficult to follow. |
| CWE-1076 | Insufficient Adherence to Expected Conventions | This weakness occurs when software code, design, documentation, or other components fail to follow established industry or project-specific standards and conventions. |
| CWE-1077 | Floating Point Comparison with Incorrect Operator | This vulnerability occurs when code compares two floating-point numbers using direct equality operators (like == or !=) without accounting for inherent precision limitations. These operators fail to consider tiny rounding differences that are common in floating-point arithmetic, leading to incorrect or unexpected comparison results. |
| CWE-1078 | Inappropriate Source Code Style or Formatting | This weakness occurs when source code violates established style guidelines for formatting, indentation, whitespace, or commenting, making it difficult to read and maintain. |
| CWE-1079 | Parent Class without Virtual Destructor Method | This occurs when a base class, designed to be inherited from, does not declare its destructor as virtual. This oversight prevents proper cleanup when objects are deleted through a pointer to the parent class. |
| CWE-108 | Struts: Unvalidated Action Form | In Apache Struts, every Action Form that processes user input must have a corresponding validation form configured. Missing this validation exposes the application to unvalidated data. |
| CWE-1080 | Source Code File with Excessive Number of Lines of Code | This weakness occurs when a single source code file grows excessively large, containing too many lines of code. |
| CWE-1082 | Class Instance Self Destruction Control Element | This vulnerability occurs when an object's code contains logic that triggers its own deletion or destruction during runtime. |
| CWE-1083 | Data Access from Outside Expected Data Manager Component | This weakness occurs when an application is designed to handle all data operations through a dedicated manager component (like a database layer), but code elsewhere bypasses it and accesses data directly. |
| CWE-1084 | Invokable Control Element with Excessive File or Data Access Operations | This weakness occurs when a single function or method performs an excessive number of file or database operations, such as repeated reads, writes, or queries. It over-relies on a single data manager or file resource, creating a tightly coupled and fragile code structure. |
| CWE-1085 | Invokable Control Element with Excessive Volume of Commented-out Code | This weakness occurs when a callable function, method, or procedure contains a large amount of inactive, commented-out code within its implementation body. |
| CWE-1086 | Class with Excessive Number of Child Classes | This weakness occurs when a parent class has an excessive number of child classes that inherit from it, creating a deep and overly complex inheritance tree. |
| CWE-1087 | Class with Virtual Method without a Virtual Destructor | This occurs when a class defines a virtual method but does not also provide a virtual destructor. |
| CWE-1088 | Synchronous Access of Remote Resource without Timeout | This vulnerability occurs when an application makes a synchronous call to a remote service or resource but does not set a timeout, or sets an infinite one. This leaves the application waiting indefinitely for a response. |
| CWE-1089 | Large Data Table with Excessive Number of Indices | This weakness occurs when an application uses a database table with a very large number of rows and creates too many indexes on it, degrading overall system performance. |
| CWE-109 | Struts: Validator Turned Off | This vulnerability occurs when an application built with Apache Struts intentionally disables its built-in validation framework. By turning off the Struts Validator bean, developers remove critical automatic input filtering and custom validation rules, leaving the application unprotected against malicious or malformed data. |
| CWE-1090 | Method Containing Access of a Member Element from Another Class | This weakness occurs when a method in one class directly accesses a private or internal member (like a field or property) of a different class, bypassing proper interfaces. |
| CWE-1091 | Use of Object without Invoking Destructor Method | This weakness occurs when a program accesses an object but fails to properly call its destructor or finalizer method. This leaves the cleanup of the object's resources to the system's automatic garbage collection, which may not happen immediately or predictably. |
| CWE-1092 | Use of Same Invokable Control Element in Multiple Architectural Layers | This weakness occurs when the same piece of code or control logic is duplicated across different architectural layers of an application, such as the presentation, business, and data layers. |
| CWE-1093 | Excessively Complex Data Representation | This weakness occurs when software uses an overly complicated internal model to represent its data or the relationships between data elements. |
| CWE-1094 | Excessive Index Range Scan for a Data Resource | This weakness occurs when a database query performs an index range scan that can access an unnecessarily large number of rows from a substantial data table, leading to severe performance degradation. |
| CWE-1095 | Loop Condition Value Update within the Loop | This vulnerability occurs when a loop's exit condition depends on a variable that is also modified inside the loop body. This creates a complex and often unpredictable control flow that is difficult to analyze. |
| CWE-1096 | Singleton Class Instance Creation without Proper Locking or Synchronization | This flaw occurs when a Singleton class is implemented without proper thread-safe controls, allowing multiple instances to be created in concurrent environments. |
| CWE-1097 | Persistent Storable Data Element without Associated Comparison Control Element | This weakness occurs when a persistent data object lacks the necessary methods to be properly compared, which can lead to inconsistent or incorrect behavior when the system checks for equality or manages collections. |
| CWE-1098 | Data Element containing Pointer Item without Proper Copy Control Element | This weakness occurs when a data structure contains a pointer, but the code lacks proper methods to copy or initialize that pointer safely. |
| CWE-1099 | Inconsistent Naming Conventions for Identifiers | This weakness occurs when a codebase uses mixed naming styles for elements like variables, functions, data types, or files, creating an inconsistent and confusing structure. |
| CWE-11 | ASP.NET Misconfiguration: Creating Debug Binary | Deploying an ASP.NET application with debug binaries enabled exposes detailed system information, which attackers can use to map your infrastructure and plan targeted exploits. |
| CWE-110 | Struts: Validator Without Form Field | This vulnerability occurs when a Struts application's validation configuration file references form fields that no longer exist in the corresponding ActionForm class. This mismatch indicates outdated validation logic that can fail to properly check user input. |
| CWE-1100 | Insufficient Isolation of System-Dependent Functions | This weakness occurs when an application fails to separate its core logic from functions that depend on a specific operating system, hardware, or external platform. Instead of being contained in dedicated modules, these system-dependent calls are scattered throughout the codebase. |
| CWE-1101 | Reliance on Runtime Component in Generated Code | This vulnerability occurs when software depends on automatically generated code that requires a specific, often external, runtime component to function. Without this component, the code cannot execute, creating a fragile and non-portable foundation. |
| CWE-1102 | Reliance on Machine-Dependent Data Representation | This weakness occurs when software directly depends on how a specific machine, processor, or operating system represents data in memory. Code that makes assumptions about byte order, data type sizes, or memory alignment becomes fragile and non-portable. |
| CWE-1103 | Use of Platform-Dependent Third Party Components | This weakness occurs when software depends on third-party libraries or components that behave differently or lack support across various target platforms or operating systems. |
| CWE-1104 | Use of Unmaintained Third Party Components | This weakness occurs when software depends on third-party libraries, frameworks, or modules that are no longer actively updated or supported by their creators or a trusted maintainer. |
| CWE-1105 | Insufficient Encapsulation of Machine-Dependent Functionality | This weakness occurs when an application relies on hardware-specific or platform-dependent features but fails to isolate that code from the rest of the system. This poor separation creates tight coupling between the core logic and low-level machine details. |
| CWE-1106 | Insufficient Use of Symbolic Constants | This weakness occurs when developers embed raw numbers or text strings directly in code instead of using named symbolic constants, making future updates and maintenance more difficult. |
| CWE-1107 | Insufficient Isolation of Symbolic Constant Definitions | This weakness occurs when a codebase uses symbolic constants (like named values for numbers or strings) but scatters their definitions across many files instead of centralizing them in one isolated location, such as a dedicated configuration file or module. |
| CWE-1108 | Excessive Reliance on Global Variables | This weakness occurs when a codebase depends too heavily on global variables to store and manage state, rather than keeping data within appropriate local scopes like functions or classes. |
| CWE-1109 | Use of Same Variable for Multiple Purposes | This weakness occurs when a single variable is reused to handle multiple, unrelated tasks or to store different pieces of data throughout the code. This practice muddies the variable's purpose and makes the logic harder to follow. |
| CWE-111 | Direct Use of Unsafe JNI | This weakness occurs when a Java application directly calls native code through the Java Native Interface (JNI), exposing the entire application to security risks present in that external code, even if Java itself is safe from those specific flaws. |
| CWE-1110 | Incomplete Design Documentation | This vulnerability occurs when a system's design documentation is missing critical details about how the software actually works. Key omissions include unclear control flow, undefined data movement, missing system startup procedures, vague component relationships, or unexplained design decisions. |
| CWE-1111 | Incomplete I/O Documentation | This weakness occurs when a product's documentation fails to clearly and completely define its inputs, outputs, or how it interacts with other systems or software components. |
| CWE-1112 | Incomplete Documentation of Program Execution | This weakness occurs when a system's documentation fails to completely list all the ways its behavior can be controlled or changed during execution. |
| CWE-1113 | Inappropriate Comment Style | This weakness occurs when source code comments are written in a style or format that doesn't match the project's established standards or common conventions for the language. |
| CWE-1114 | Inappropriate Whitespace Style | This weakness occurs when source code uses inconsistent or non-standard whitespace formatting, such as irregular indentation, spacing, or line breaks. |
| CWE-1115 | Source Code Element without Standard Prologue | This weakness occurs when source code files or modules lack a consistent, standardized header or prologue that the development team has agreed upon. |
| CWE-1116 | Inaccurate Comments | This weakness occurs when code comments do not correctly describe or explain the actual behavior of the associated code. Misleading comments create a disconnect between what the documentation says and what the program actually does. |
| CWE-1117 | Callable with Insufficient Behavioral Summary | This weakness occurs when a function, method, or API lacks clear documentation about its behavior. The signature or comments fail to properly explain what inputs it expects, what outputs it returns, what side effects it causes, or what assumptions it makes. |
| CWE-1118 | Insufficient Documentation of Error Handling Techniques | This weakness occurs when software documentation fails to clearly explain how the system manages errors, exceptions, or unexpected conditions. Developers are left guessing about the proper handling mechanisms. |
| CWE-1119 | Excessive Use of Unconditional Branching | This weakness occurs when code relies heavily on unconditional jumps like 'goto' statements, making the program flow difficult to follow. |
| CWE-112 | Missing XML Validation | This vulnerability occurs when an application processes XML data from an untrusted source without first validating its structure and content against a defined schema. |
| CWE-1120 | Excessive Code Complexity | This weakness occurs when software contains sections of code that are unnecessarily intricate, as measured by established complexity metrics like cyclomatic complexity or cognitive load scores. |
| CWE-1121 | Excessive McCabe Cyclomatic Complexity | This weakness occurs when a function or method has an overly complex control flow, measured by a high McCabe Cyclomatic Complexity score. This makes the code difficult to read, test, and maintain. |
| CWE-1122 | Excessive Halstead Complexity | This weakness occurs when code has an excessively high Halstead complexity score, indicating it is overly intricate and difficult to analyze. |
| CWE-1123 | Excessive Use of Self-Modifying Code | The software relies heavily on code that rewrites itself during execution, making it difficult to analyze and maintain. |
| CWE-1124 | Excessively Deep Nesting | This weakness occurs when a function, method, or code block contains too many levels of nested loops, conditionals, or other control structures, making the logic path difficult to follow. |
| CWE-1125 | Excessive Attack Surface | This weakness occurs when a software product has an unnecessarily large number of entry and exit points that an attacker can target, exceeding a reasonable and secure threshold. |
| CWE-1126 | Declaration of Variable with Unnecessarily Wide Scope | This weakness occurs when a variable is declared with a broader scope than it actually needs, such as declaring a variable at a global or function level when it's only used inside a loop or conditional block. |
| CWE-1127 | Compilation with Insufficient Warnings or Errors | This weakness occurs when source code is compiled without enabling a comprehensive set of warning flags from the compiler. This practice allows subtle bugs, insecure coding patterns, and quality issues to go undetected during the build process. |
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | This vulnerability occurs when an application accepts user-supplied data and includes it directly in HTTP headers without properly filtering out carriage return (CR) and line feed (LF) characters. This allows an attacker to inject new headers or split a single HTTP response into two separate responses, corrupting the intended communication flow. |
| CWE-114 | Process Control | Process Control vulnerabilities occur when an application executes commands or loads libraries from an untrusted source or environment, allowing an attacker to run malicious code. |
| CWE-115 | Misinterpretation of Input | This vulnerability occurs when software incorrectly interprets or processes input data, leading to unintended and potentially harmful security consequences. The flawed interpretation can come from user-provided data, external systems, or other components. |
| CWE-116 | Improper Encoding or Escaping of Output | This vulnerability occurs when an application builds a structured message—like a query, command, or request—for another component but fails to properly encode or escape user-supplied data. Because the output's structure isn't preserved, an attacker can inject malicious instructions that the receiving component will execute. |
| CWE-1164 | Irrelevant Code | Irrelevant code refers to sections of a program that have no impact on its execution, data, or logic. Removing this code would not change the software's behavior or correctness, as it performs no meaningful operations. |
| CWE-117 | Improper Output Neutralization for Logs | This vulnerability occurs when an application creates log entries using unvalidated external data, allowing attackers to inject malicious characters or commands that can corrupt log files, trigger parsing errors, or enable log injection attacks. |
| CWE-1173 | Improper Use of Validation Framework | This vulnerability occurs when a software application either fails to use or incorrectly implements a built-in or library-provided input validation framework. |
| CWE-1174 | ASP.NET Misconfiguration: Improper Model Validation | This vulnerability occurs when an ASP.NET application either completely bypasses the built-in model validation system or implements it incorrectly, allowing untrusted data to flow into the application without proper checks. |
| CWE-1176 | Inefficient CPU Computation | This weakness occurs when software uses inefficient algorithms or suboptimal CPU operations, performing unnecessary or overly complex calculations that waste processing power and slow down performance. |
| CWE-1177 | Use of Prohibited Code | This vulnerability occurs when software incorporates a function, library, or third-party component that has been explicitly banned by the development team or the customer. |
| CWE-118 | Incorrect Access of Indexable Resource ('Range Error') | This vulnerability occurs when software fails to properly check the boundaries of an indexed resource, like an array, buffer, or file, before accessing it. This allows reading from or writing to memory locations outside the intended range. |
| CWE-1187 | DEPRECATED: Use of Uninitialized Resource | This entry has been consolidated into CWE-908: Use of Uninitialized Resource. All relevant information has been migrated to that primary weakness entry. |
| CWE-1188 | Initialization of a Resource with an Insecure Default | This vulnerability occurs when software uses an insecure default setting or value for a resource, assuming an administrator will change it later. |
| CWE-1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC) | This vulnerability occurs when a System-on-a-Chip (SoC) fails to properly separate shared hardware resources between secure (trusted) and non-secure (untrusted) components. |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | This vulnerability occurs when software accesses a memory buffer but reads from or writes to a location outside its allocated boundary. This can corrupt adjacent data, crash the program, or allow attackers to execute arbitrary code. |
| CWE-1190 | DMA Device Enabled Too Early in Boot Phase | This vulnerability occurs when a device with Direct Memory Access (DMA) capability is activated before the system's security settings are fully locked in during the boot process. This oversight can let an attacker bypass normal protections to read sensitive data from memory or escalate their privileges on the system. |
| CWE-1191 | On-Chip Debug and Test Interface With Improper Access Control | This vulnerability occurs when a hardware chip's debug or test interface (like JTAG) lacks proper access controls. Without correct authorization checks, unauthorized users can read or modify sensitive internal registers and bypass the chip's built-in security protections. |
| CWE-1192 | Improper Identifier for IP Block used in System-On-Chip (SOC) | This weakness occurs when a System-on-Chip (SoC) lacks a secure, unique, and permanent identifier for its internal hardware components (IP blocks). Without this, the system cannot reliably distinguish between different parts of the chip, leading to security and reliability failures. |
| CWE-1193 | Power-On of Untrusted Execution Core Before Enabling Fabric Access Control | This vulnerability occurs when a system powers up hardware components containing untrusted firmware before establishing critical security controls for the system's internal communication pathways and memory. |
| CWE-12 | ASP.NET Misconfiguration: Missing Custom Error Page | This vulnerability occurs when an ASP.NET application fails to configure custom error pages, allowing attackers to extract sensitive information from the framework's default error messages. |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | This vulnerability occurs when a program copies data from one memory location to another without first verifying that the source data will fit within the destination buffer's allocated space. |
| CWE-1204 | Generation of Weak Initialization Vector (IV) | This vulnerability occurs when software uses a weak or predictable Initialization Vector (IV) for cryptographic operations. Many encryption algorithms require IVs to be both unique and unpredictable to ensure security, and failing to meet these requirements can compromise the entire encryption process. |
| CWE-1209 | Failure to Disable Reserved Bits | This vulnerability occurs when reserved bits in a hardware design are left active in production. Designers sometimes use these bits for debugging or future features, but if not disabled, attackers can manipulate them to compromise the hardware's state. |
| CWE-121 | Stack-based Buffer Overflow | A stack-based buffer overflow occurs when a program writes more data to a buffer located on the call stack than it can hold, corrupting adjacent memory and potentially hijacking the program's execution flow. |
| CWE-122 | Heap-based Buffer Overflow | A heap-based buffer overflow occurs when a program writes more data to a memory buffer allocated in the heap than it can hold, corrupting adjacent memory structures. This typically involves buffers created with functions like malloc(), calloc(), or realloc(). |
| CWE-1220 | Insufficient Granularity of Access Control | This vulnerability occurs when a system's access controls are too broad, allowing unauthorized users or processes to read or modify sensitive resources. Instead of implementing precise, fine-grained permissions, the security policy uses overly permissive rules that fail to properly restrict access to critical assets like configuration data, keys, or system registers. |
| CWE-1221 | Incorrect Register Defaults or Module Parameters | This vulnerability occurs when hardware description language (HDL) code sets insecure default values for hardware registers or configurable module parameters. These hardcoded values leave the hardware in an unsafe state after a reset, creating a permanent security weakness that software cannot patch. |
| CWE-1222 | Insufficient Granularity of Address Regions Protected by Register Locks | This vulnerability occurs when a hardware design uses a single lock bit to protect a large, coarse block of memory addresses. This lack of granularity creates a conflict: the system needs to lock critical configuration settings early for security, but software also needs to write to other parts of that same address region during normal operation, which the lock incorrectly prevents. |
| CWE-1223 | Race Condition for Write-Once Attributes | This vulnerability occurs when an untrusted software component wins a race condition and writes to a hardware register before the trusted component can, permanently locking in an insecure value because the register is designed to be written only once. |
| CWE-1224 | Improper Restriction of Write-Once Bit Fields | This vulnerability occurs when hardware write-once protection mechanisms, often called 'sticky bits,' are incorrectly implemented, allowing software to reprogram them multiple times. |
| CWE-1229 | Creation of Emergent Resource | This vulnerability occurs when a system's normal operations unintentionally create new, exploitable resources that attackers can use to bypass security controls. |
| CWE-123 | Write-what-where Condition | A write-what-where condition occurs when an attacker can control both the data written and the exact memory location where it's written, often due to a severe memory corruption flaw like a buffer overflow. |
| CWE-1230 | Exposure of Sensitive Information Through Metadata | This vulnerability occurs when an application protects the primary source of sensitive data but fails to secure the metadata derived from it. Attackers can then access this secondary information, which may leak critical details about the original content. |
| CWE-1231 | Improper Prevention of Lock Bit Modification | This vulnerability occurs when hardware or firmware uses a lock bit to protect critical system registers or memory regions, but fails to properly prevent that lock bit from being changed after it has been enabled. This design flaw allows attackers to bypass hardware-enforced security restrictions. |
| CWE-1232 | Improper Lock Behavior After Power State Transition | This vulnerability occurs when a hardware lock bit, designed to protect critical system configuration registers, is improperly reset or becomes programmable after a device transitions between power states, such as entering or waking from a low-power sleep mode. This allows the protected configuration to be altered after it should be permanently locked. |
| CWE-1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection | This vulnerability occurs when a hardware device uses a lock bit to protect critical configuration registers, but the lock fails to prevent writes to all registers that can alter the protected system settings. Essentially, the security mechanism is incomplete, allowing software to bypass it and modify sensitive hardware configurations. |
| CWE-1234 | Hardware Internal or Debug Modes Allow Override of Locks | Hardware debug modes or internal states can bypass critical system lock protections, allowing unauthorized changes to device configuration. |
| CWE-1235 | Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations | This weakness occurs when a program relies on automatic boxing and unboxing of primitive types within performance-sensitive code sections, causing unnecessary computational overhead and potential resource strain. |
| CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | This vulnerability occurs when an application writes user-supplied data into a CSV file without properly sanitizing special characters. Spreadsheet programs like Excel or Google Sheets interpret entries starting with '=' as executable formulas, which can lead to malicious command execution when the file is opened. |
| CWE-1239 | Improper Zeroization of Hardware Register | This vulnerability occurs when a hardware component fails to properly erase sensitive data from its internal registers before a new user or process gains access to the hardware block. |
| CWE-124 | Buffer Underwrite ('Buffer Underflow') | A buffer underwrite, also known as buffer underflow, happens when a program writes data to a memory location before the official start of a buffer. |
| CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation | This weakness occurs when a product uses a custom, unverified, or non-compliant implementation of a cryptographic algorithm instead of a trusted, standard solution. |
| CWE-1241 | Use of Predictable Algorithm in Random Number Generator | This vulnerability occurs when a device or application relies on a predictable algorithm to generate pseudo-random numbers, making the output sequence foreseeable. |
| CWE-1242 | Inclusion of Undocumented Features or Chicken Bits | This vulnerability occurs when a hardware device or chip includes undocumented configuration bits (often called 'chicken bits') or hidden features that can disable security controls or enable privileged functions. |
| CWE-1243 | Sensitive Non-Volatile Information Not Protected During Debug | This vulnerability occurs when security-critical data stored in hardware fuses is left unprotected and accessible during debug modes. |
| CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State | This vulnerability occurs when a system's debug or test interface supports multiple access levels, but an internal asset is incorrectly assigned a permissive debug access level. This mistake allows untrusted debug agents to access sensitive internal assets they should not be able to reach. |
| CWE-1245 | Improper Finite State Machines (FSMs) in Hardware Logic | This vulnerability occurs when hardware logic contains flawed Finite State Machines (FSMs). Attackers can exploit these design errors to force the system into an undefined or unstable condition, potentially leading to a denial of service (DoS) or allowing privilege escalation. |
| CWE-1246 | Improper Write Handling in Limited-write Non-Volatile Memories | This vulnerability occurs when a system fails to properly manage write operations on memory hardware that has a limited lifespan, such as Flash or EEPROM. Without correct wear leveling, specific memory cells wear out faster than intended, leading to premature device failure. |
| CWE-1247 | Improper Protection Against Voltage and Clock Glitches | This vulnerability occurs when a hardware device lacks proper physical safeguards against deliberate electrical manipulation. Without dedicated protection circuits or sensors, attackers can use voltage spikes or irregular clock signals to bypass security features, potentially exposing sensitive data or taking control of the system. |
| CWE-1248 | Semiconductor Defects in Hardware Logic with Security-Sensitive Implications | A security-critical hardware component contains physical flaws in its semiconductor material, which can cause it to malfunction and undermine its security features. |
| CWE-1249 | Application-Level Admin Tool with Inconsistent View of Underlying Operating System | This vulnerability occurs when an administrative tool (like a web interface or API) fails to accurately display the true state of the underlying operating system it manages. The tool's view becomes inconsistent with reality, hiding critical resources like user accounts, processes, or files from the administrator. |
| CWE-125 | Out-of-bounds Read | An out-of-bounds read occurs when software accesses memory outside the boundaries of a buffer, array, or similar data structure, reading data it wasn't intended to see. |
| CWE-1250 | Improper Preservation of Consistency Between Independent Representations of Shared State | This vulnerability occurs when a system with multiple independent components (like distributed services or separate hardware units) each maintain their own copy of shared data—such as user state, cache, or configuration—but the system fails to keep all these local copies synchronized and consistent with each other. |
| CWE-1251 | Mirrored Regions with Different Values | This vulnerability occurs when a system maintains duplicate copies of data or resources (like cached memory or shadow registers) but fails to keep them synchronized. When mirrored regions hold different values, it can lead to incorrect system behavior, data corruption, or security breaches. |
| CWE-1252 | CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations | This vulnerability occurs when a CPU's hardware is not set up to enforce a strict separation between writing data to memory and executing instructions from it. Without this hardware-level protection, attackers can potentially write malicious code into memory and then run it. |
| CWE-1253 | Incorrect Selection of Fuse Values | This vulnerability occurs when a hardware security fuse is incorrectly programmed to represent a 'secure' state as logic 0 (unblown). An attacker can permanently force the system into an insecure mode simply by blowing the fuse, which flips its value to logic 1. |
| CWE-1254 | Incorrect Comparison Logic Granularity | This vulnerability occurs when a system compares sensitive data, like passwords or authentication tokens, piece-by-piece instead of as a complete unit. If the comparison stops at the first mismatch, attackers can measure tiny timing differences to gradually guess the correct value. |
| CWE-1255 | Comparison Logic is Vulnerable to Power Side-Channel Attacks | This vulnerability occurs when a device's power consumption is monitored during security checks, allowing attackers to deduce secret reference values by analyzing subtle differences in energy usage during comparison operations. |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features | This vulnerability occurs when a system's software interfaces to hardware features—like power, clock, or performance management—are not properly locked down. This allows attackers to misuse these interfaces from software to tamper with hardware memory or registers, or to gather sensitive data by observing physical side effects, without needing physical access to the device. |
| CWE-1257 | Improper Access Control Applied to Mirrored or Aliased Memory Regions | This vulnerability occurs when a hardware design maps the same physical memory to multiple addresses (aliasing or mirroring) but fails to apply consistent read/write permissions across all these addresses. An attacker blocked from accessing a protected memory region might still reach the same data through its unprotected aliased address, bypassing security controls. |
| CWE-1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information | This vulnerability occurs when hardware fails to erase sensitive data like cryptographic keys and intermediate values before entering debug mode, leaving them exposed. |
| CWE-1259 | Improper Restriction of Security Token Assignment | This vulnerability occurs when a System-on-a-Chip (SoC) fails to properly secure its Security Token mechanism. These tokens control which actions different system components are allowed to perform, but inadequate protection allows them to be manipulated. |
| CWE-126 | Buffer Over-read | This vulnerability occurs when a program reads data from a memory buffer using an index or pointer that points beyond the buffer's allocated boundary, accessing unintended memory locations. |
| CWE-1260 | Improper Handling of Overlap Between Protected Memory Ranges | This vulnerability occurs when a system incorrectly allows different memory protection ranges to overlap. This flaw can let attackers bypass security controls and access restricted memory areas. |
| CWE-1261 | Improper Handling of Single Event Upsets | This vulnerability occurs when hardware logic fails to properly manage single-event upsets (SEUs), which are temporary bit flips caused by environmental factors. |
| CWE-1262 | Improper Access Control for Register Interface | This vulnerability occurs when a system's hardware registers, which act as a software-to-hardware control panel, lack proper access restrictions. Malicious or flawed software can directly manipulate these registers, leading to unauthorized changes in hardware behavior. |
| CWE-1263 | Improper Physical Access Control | This vulnerability occurs when a device or system has areas meant to be physically secure, but the safeguards in place are too weak to stop someone with direct physical access from reaching restricted components or data. |
| CWE-1264 | Hardware Logic with Insecure De-Synchronization between Control and Data Channels | This vulnerability occurs when a hardware design incorrectly forwards data before its security or permission checks have finished processing. It's a timing flaw where the data channel gets ahead of the control channel, potentially leaking information. |
| CWE-1265 | Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls | This vulnerability occurs when a non-reentrant function is called, and during its execution, another call is triggered that unexpectedly re-enters the same non-reentrant code path, corrupting its internal state. |
| CWE-1266 | Improper Scrubbing of Sensitive Data from Decommissioned Device | This vulnerability occurs when a system lacks a reliable method for administrators to permanently erase sensitive information before taking hardware or software out of service. The data scrubbing feature might be missing, ineffective, or flawed, leaving confidential data behind. |
| CWE-1267 | Policy Uses Obsolete Encoding | This vulnerability occurs when a hardware system uses outdated or deprecated encoding methods to enforce security policies and access controls. |
| CWE-1268 | Policy Privileges are not Assigned Consistently Between Control and Data Agents | This vulnerability occurs when hardware access control policies are inconsistent, allowing an agent with control privileges to modify write permissions even when it shouldn't have direct write access. |
| CWE-1269 | Product Released in Non-Release Configuration | This vulnerability occurs when a product ships to customers while still configured with its pre-production or manufacturing settings, which typically include powerful debugging and testing features not intended for real-world use. |
| CWE-127 | Buffer Under-read | A buffer under-read occurs when a program attempts to read data from a memory location positioned before the start of an allocated buffer. |
| CWE-1270 | Generation of Incorrect Security Tokens | This vulnerability occurs when a system's security token mechanism, designed to control permissions for different entities or agents, generates tokens that are fundamentally flawed or incorrect. |
| CWE-1271 | Uninitialized Value on Reset for Registers Holding Security Settings | Security-critical hardware registers start with random, unpredictable values when a device powers on or resets, creating an immediate vulnerability window before software can initialize them. |
| CWE-1272 | Sensitive Information Uncleared Before Debug/Power State Transition | This vulnerability occurs when a device changes its power mode or enters a debug state but fails to wipe sensitive data that should become inaccessible after the transition. |
| CWE-1273 | Device Unlock Credential Sharing | This vulnerability occurs when the secret keys or passwords required to unlock a device's hidden features are shared between multiple organizations, creating a chain of trust where sensitive access can be leaked. |
| CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code | This vulnerability occurs when a system's secure-boot process loads bootloader code into volatile memory (like DRAM or SRAM) but fails to properly lock down that memory region afterward. Without strong access controls, an attacker can modify the boot code in memory, bypassing secure boot and running malicious software. |
| CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | This vulnerability occurs when a sensitive cookie does not have a secure SameSite attribute configured, leaving it exposed to cross-site request forgery (CSRF) attacks. |
| CWE-1276 | Hardware Child Block Incorrectly Connected to Parent System | This vulnerability occurs when a hardware component (IP block) is wired incorrectly to the main system, creating hidden security flaws even if basic functions appear to work. |
| CWE-1277 | Firmware Not Updateable | This vulnerability occurs when a hardware product lacks a mechanism for users to install firmware updates, leaving known security flaws permanently unpatched. |
| CWE-1278 | Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques | This vulnerability occurs when hardware lacks safeguards against physical inspection, allowing attackers to extract sensitive data by capturing and analyzing high-resolution images of the integrated circuit's internal structure. |
| CWE-1279 | Cryptographic Operations are run Before Supporting Units are Ready | This vulnerability occurs when cryptographic processes start before their required dependencies are properly initialized and ready to supply valid data, potentially compromising security. |
| CWE-128 | Wrap-around Error | A wrap-around error happens when a variable exceeds the maximum value its data type can hold, causing it to unexpectedly reset to a very small, negative, or undefined number instead of increasing further. |
| CWE-1280 | Access Control Check Implemented After Asset is Accessed | This vulnerability occurs when a hardware-based security check runs after the protected resource has already been accessed, creating a dangerous timing window. |
| CWE-1281 | Sequence of Processor Instructions Leads to Unexpected Behavior | Certain sequences of valid and invalid processor instructions can cause the CPU to lock up or behave unpredictably, often requiring a hard reset to recover. |
| CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | This vulnerability occurs when data that should be permanent and unchangeable—like a bootloader, device IDs, or one-time configuration settings—is placed in memory that can be rewritten or updated after deployment. |
| CWE-1283 | Mutable Attestation or Measurement Reporting Data | This vulnerability occurs when the hardware registers storing boot integrity measurements can be altered by an attacker, allowing them to forge verification data and hide a compromised boot process. |
| CWE-1284 | Improper Validation of Specified Quantity in Input | This vulnerability occurs when an application accepts user input meant to define a quantity—like a number, size, or count—but fails to properly check if that value is safe and reasonable before using it. |
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | This vulnerability occurs when software accepts user input to determine a location—like an array index, file position, or memory offset—but fails to properly check if that location is safe and valid before using it. |
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | This vulnerability occurs when software expects input in a specific, well-structured format but fails to properly check that the incoming data actually follows those rules. |
| CWE-1287 | Improper Validation of Specified Type of Input | This vulnerability occurs when software expects a specific type of data as input but fails to properly check that the incoming data actually matches that type. |
| CWE-1288 | Improper Validation of Consistency within Input | This vulnerability occurs when an application accepts structured input containing multiple related fields but fails to verify that the values across those fields are logically consistent with each other. |
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | This vulnerability occurs when an application accepts user input as a reference (like a file path or resource identifier) but fails to properly check if that input is functionally equivalent to a dangerous or restricted value. |
| CWE-129 | Improper Validation of Array Index | This vulnerability occurs when software uses unverified, external input to calculate or access an array index, without properly checking that the index points to a valid location within the array's bounds. |
| CWE-1290 | Incorrect Decoding of Security Identifiers | This vulnerability occurs when a hardware decoder incorrectly interprets security identifiers in bus transactions, allowing untrusted agents to gain unauthorized access to protected assets. |
| CWE-1291 | Public Key Re-Use for Signing both Debug and Production Code | This vulnerability occurs when the same cryptographic key is used to sign both development/debug software builds and final production releases. This insecure practice allows debug versions, which often contain powerful diagnostic features, to be validated and run on live production systems. |
| CWE-1292 | Incorrect Conversion of Security Identifiers | This vulnerability occurs when a hardware system incorrectly translates security identifiers during bus protocol conversion. An improper mapping allows untrusted agents to bypass security checks and gain unauthorized access to protected assets or functions. |
| CWE-1293 | Missing Source Correlation of Multiple Independent Data | This vulnerability occurs when a system trusts a single source of data without verification, making it impossible to detect if that source has been tampered with or compromised by an attacker. |
| CWE-1294 | Insecure Security Identifier Mechanism | This vulnerability occurs when a System-on-Chip (SoC) implements a Security Identifier mechanism to control transaction permissions, but the implementation contains flaws that undermine its security. |
| CWE-1295 | Debug Messages Revealing Unnecessary Information | The product's debug messages or logs expose excessive internal system details, potentially revealing sensitive information that could aid an attacker. |
| CWE-1296 | Incorrect Chaining or Granularity of Debug Components | This vulnerability occurs when hardware debug components, such as test ports and scan chains, are incorrectly connected or organized within a chip's design. This misconfiguration can create unintended access paths, potentially exposing sensitive internal data or functions. |
| CWE-1297 | Unprotected Confidential Information on Device is Accessible by OSAT Vendors | This vulnerability occurs when a semiconductor chip does not properly secure sensitive data, making it accessible to third-party Outsourced Semiconductor Assembly and Test (OSAT) vendors during the manufacturing process. |
| CWE-1298 | Hardware Logic Contains Race Conditions | A hardware race condition occurs when security-critical logic circuits receive signals at slightly different times, creating temporary glitches that can bypass system protections. |
| CWE-1299 | Missing Protection Mechanism for Alternate Hardware Interface | This vulnerability occurs when a hardware component's security controls only protect the primary access path, leaving alternate interfaces unprotected. Attackers can bypass intended restrictions by accessing sensitive assets through these unguarded backdoors, such as shadow registers or other external-facing ports. |
| CWE-13 | ASP.NET Misconfiguration: Password in Configuration File | This vulnerability occurs when an ASP.NET application stores passwords or other sensitive credentials in plaintext within configuration files like web.config. This exposes those credentials to anyone with file system access, effectively bypassing security controls and granting unauthorized access to protected resources. |
| CWE-130 | Improper Handling of Length Parameter Inconsistency | This vulnerability occurs when a program reads a structured data packet or message but fails to properly validate that the declared length field matches the actual amount of data provided. |
| CWE-1300 | Improper Protection of Physical Side Channels | This vulnerability occurs when a hardware device lacks adequate safeguards against physical side-channel attacks. Attackers can exploit measurable patterns in power usage, electromagnetic radiation, or even sound emissions to uncover sensitive information like encryption keys. |
| CWE-1301 | Insufficient or Incomplete Data Removal within Hardware Component | The product's data removal process fails to completely erase all data from hardware components, potentially leaving sensitive information behind. |
| CWE-1302 | Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) | This vulnerability occurs when a System-On-Chip (SoC) component sends a transaction without its required security identifier. The destination hardware cannot properly verify permissions, leading to unintended access or system failure. |
| CWE-1303 | Non-Transparent Sharing of Microarchitectural Resources | This vulnerability occurs when a processor's internal performance features, like caches and branch predictors, are unintentionally shared between different software contexts. This breaks the expected isolation, allowing data to leak across security boundaries. |
| CWE-1304 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation | This vulnerability occurs when a hardware component saves its configuration state during a power-down operation but fails to protect or verify the integrity of that saved data before restoring it. As a result, an attacker can tamper with the stored settings, leading to a compromised state when the device powers back on. |
| CWE-131 | Incorrect Calculation of Buffer Size | This vulnerability occurs when a program miscalculates the amount of memory needed for a buffer, potentially leading to a buffer overflow that can crash the software or allow attackers to execute malicious code. |
| CWE-1310 | Missing Ability to Patch ROM Code | A system or System-on-Chip (SoC) lacks a mechanism to update its initial boot code stored in Read-Only Memory (ROM), permanently exposing devices to unfixable security vulnerabilities. |
| CWE-1311 | Improper Translation of Security Attributes by Fabric Bridge | This vulnerability occurs when a hardware bridge incorrectly converts security attributes between different fabric protocols, potentially changing a transaction's identity from trusted to untrusted or vice versa during protocol translation. |
| CWE-1312 | Missing Protection for Mirrored Regions in On-Chip Fabric Firewall | An on-chip fabric firewall fails to apply its security rules to mirrored memory or MMIO regions, only protecting the primary address range. This allows attackers to bypass read/write restrictions by targeting the unprotected mirrored copies. |
| CWE-1313 | Hardware Allows Activation of Test or Debug Logic at Runtime | This vulnerability occurs when hardware includes test or debug features that remain accessible during normal operation. An attacker can activate these features at runtime to alter the hardware's state, bypass security controls, and potentially leak or manipulate sensitive data. |
| CWE-1314 | Missing Write Protection for Parametric Data Values | This vulnerability occurs when a hardware device fails to protect the scaling parameters used to convert raw sensor readings. Untrusted software can alter these conversion factors, making dangerous conditions appear safe and potentially leading to hardware damage or system failure. |
| CWE-1315 | Improper Setting of Bus Controlling Capability in Fabric End-point | This vulnerability occurs when a hardware fabric endpoint is incorrectly configured to grant bus controller privileges to a device that should only respond to requests. This allows an unauthorized device to initiate and control data transactions across the system bus. |
| CWE-1316 | Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges | This vulnerability occurs when a hardware fabric's address map incorrectly allows protected and unprotected memory regions to overlap. Attackers can exploit this overlap to bypass security controls and access restricted data or functions. |
| CWE-1317 | Improper Access Control in Fabric Bridge | This vulnerability occurs when a hardware fabric bridge, which connects different IP blocks on a chip, fails to properly verify access permissions for transactions passing through it. The bridge forwards requests without checking the master's privilege level or the hardware identity, effectively bypassing critical security controls. |
| CWE-1318 | Missing Support for Security Features in On-chip Fabrics or Buses | This vulnerability occurs when the communication channels (fabrics or buses) within a chip lack built-in or enabled security features, such as privilege separation or access controls, leaving data transfers unprotected. |
| CWE-1319 | Improper Protection against Electromagnetic Fault Injection (EM-FI) | This vulnerability occurs when a hardware device lacks sufficient shielding against electromagnetic interference, allowing attackers to disrupt its internal operations. By inducing targeted electromagnetic pulses, an attacker can force the device to malfunction, potentially bypassing security checks or leaking sensitive data. |
| CWE-132 | DEPRECATED: Miscalculated Null Termination | This entry has been deprecated and merged into CWE-170 (Improper Null Termination). It was originally created as a duplicate, and all relevant information has been consolidated under CWE-170 for clearer vulnerability tracking. |
| CWE-1320 | Improper Protection for Outbound Error Messages and Alert Signals | This vulnerability occurs when hardware alert systems for critical conditions, like overheating or power surges, lack proper security. Untrusted software or agents can disable these warnings or trigger false alarms, preventing the system from taking protective actions. |
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | Prototype pollution occurs when an application takes user-supplied input and uses it to improperly modify the properties of a JavaScript object's prototype. This allows attackers to inject key-value pairs into the base object, potentially altering the application's logic, crashing it, or escalating privileges. |
| CWE-1322 | Use of Blocking Code in Single-threaded, Non-blocking Context | This vulnerability occurs when an application designed to be single-threaded and non-blocking, for performance and scalability, inadvertently executes code that can block the entire process. If an attacker can trigger this blocking code, it can cause the application to freeze, leading to a denial of service. |
| CWE-1323 | Improper Management of Sensitive Trace Data | This vulnerability occurs when sensitive trace data from a System-on-Chip (SoC), such as information from CPUs or cryptographic modules, is stored in unsecured memory or transmitted to unauthorized debuggers, potentially exposing confidential information. |
| CWE-1324 | DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface | This entry has been deprecated. The issue of accessing sensitive data through physical probing of a device's JTAG debugging interface is now comprehensively covered under CWE-319: Cleartext Transmission of Sensitive Information. |
| CWE-1325 | Improperly Controlled Sequential Memory Allocation | This vulnerability occurs when a system allocates memory separately for each item in a collection but fails to enforce a global limit on the total memory used by all items combined. |
| CWE-1326 | Missing Immutable Root of Trust in Hardware | This vulnerability occurs when a hardware chip lacks a permanent, unchangeable root of trust. Without this immutable foundation, attackers can bypass secure boot protections and run unauthorized or malicious code during the system startup process. |
| CWE-1327 | Binding to an Unrestricted IP Address | This vulnerability occurs when software or a service is configured to bind to the IP address 0.0.0.0 (or :: in IPv6), which acts as a wildcard, accepting connections from any network interface on the host system. |
| CWE-1328 | Security Version Number Mutable to Older Versions | This vulnerability occurs when a hardware system's security version number can be changed, allowing an attacker to downgrade or roll back the boot firmware to older, vulnerable versions. |
| CWE-1329 | Reliance on Component That is Not Updateable | This vulnerability occurs when a product depends on a component that cannot be updated or patched to fix security flaws or critical bugs. |
| CWE-1330 | Remanent Data Readable after Memory Erase | Sensitive data stored in memory hardware can still be accessed or reconstructed even after a standard clear or erase command has been executed. |
| CWE-1331 | Improper Isolation of Shared Resources in Network On Chip (NoC) | This vulnerability occurs when a Network on Chip (NoC) fails to properly separate its internal, shared resources—like buffers, switches, and channels—between trusted and untrusted components. This lack of isolation creates a timing side-channel, allowing untrusted agents to potentially infer sensitive data from trusted ones. |
| CWE-1332 | Improper Handling of Faults that Lead to Instruction Skips | This vulnerability occurs when a hardware device lacks or incorrectly implements the necessary circuitry or sensors to detect and respond to the skipping of critical security instructions during CPU execution. |
| CWE-1333 | Inefficient Regular Expression Complexity | This vulnerability occurs when an application uses a poorly constructed regular expression that can trigger catastrophic backtracking, leading to extreme CPU consumption and potential denial-of-service. |
| CWE-1334 | Unauthorized Error Injection Can Degrade Hardware Redundancy | This vulnerability occurs when an attacker without proper permissions can deliberately inject faults into a hardware system's backup components. This action disables the redundancy, forcing the system into a less secure, degraded state. |
| CWE-1335 | Incorrect Bitwise Shift of Integer | This vulnerability occurs when a program attempts to shift an integer's bits by an invalid amount—either a negative number or a value equal to or greater than the integer's bit width (e.g., shifting a 32-bit integer by 32 or more places). This leads to unpredictable and platform-dependent results. |
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | This vulnerability occurs when an application uses a template engine to process user-controlled input but fails to properly sanitize special syntax characters. Attackers can inject template expressions or directives that the engine executes, leading to unintended code execution. |
| CWE-1338 | Improper Protections Against Hardware Overheating | This vulnerability occurs when a hardware device lacks sufficient safeguards to prevent dangerous temperature increases during operation. |
| CWE-1339 | Insufficient Precision or Accuracy of a Real Number | This vulnerability occurs when a program uses a data type or algorithm that cannot accurately represent or calculate the fractional part of a real number, leading to incorrect results in security-critical operations. |
| CWE-134 | Use of Externally-Controlled Format String | This vulnerability occurs when a program uses a format string from an untrusted, external source (like user input, a network packet, or a file) in a formatting function (e.g., printf, sprintf). An attacker can craft a malicious format string to read or write memory, potentially crashing the application or executing arbitrary code. |
| CWE-1341 | Multiple Releases of Same Resource or Handle | This vulnerability occurs when a program incorrectly tries to close or release the same system resource—like memory, a file, or a network connection—more than once. This double-free or double-close violates the API's contract and leads to unpredictable and often dangerous behavior. |
| CWE-1342 | Information Exposure through Microarchitectural State after Transient Execution | This vulnerability occurs when a CPU fails to completely erase temporary data traces left behind by speculative execution or error recovery processes. These lingering microarchitectural hints can be analyzed through side-channels to leak sensitive information. |
| CWE-135 | Incorrect Calculation of Multi-Byte String Length | This vulnerability occurs when software incorrectly measures the length of strings containing multi-byte or wide characters, leading to buffer overflows, data corruption, or crashes. |
| CWE-1351 | Improper Handling of Hardware Behavior in Exceptionally Cold Environments | This weakness occurs when a hardware device or its firmware lacks proper safeguards to maintain security functions when operated in extremely cold temperatures. Designers may fail to anticipate how critical components, like memory or security primitives, behave outside their standard operating range, creating exploitable gaps. |
| CWE-1357 | Reliance on Insufficiently Trustworthy Component | This weakness occurs when a system integrates a component that cannot be fully trusted to meet security, reliability, and maintenance standards, creating risk for the entire product. |
| CWE-138 | Improper Neutralization of Special Elements | This vulnerability occurs when an application accepts external input but fails to properly sanitize special characters or syntax that have specific meanings in the target interpreter or protocol. This allows attackers to inject control elements that alter how downstream components process the data. |
| CWE-1384 | Improper Handling of Physical or Environmental Conditions | This weakness occurs when a hardware device fails to manage unexpected physical or environmental situations, whether they happen naturally or are deliberately caused by an attacker. These conditions can force the hardware into an insecure state. |
| CWE-1385 | Missing Origin Validation in WebSockets | This vulnerability occurs when a WebSocket connection is established without verifying the origin of incoming messages, allowing potentially malicious data from untrusted sources. |
| CWE-1386 | Insecure Operation on Windows Junction / Mount Point | This vulnerability occurs when a Windows application opens a file or directory without properly validating that the path is not a symbolic link (junction or mount point) pointing to a location outside the application's intended security boundary. |
| CWE-1389 | Incorrect Parsing of Numbers with Different Radices | This vulnerability occurs when software processes numeric input expecting standard decimal numbers (base 10), but fails to handle inputs formatted in other bases like octal or hexadecimal. This mismatch leads to the system interpreting the same digits as a completely different numeric value. |
| CWE-1390 | Weak Authentication | This vulnerability occurs when a system's login or identity verification process is too easy to bypass or fool. While it attempts to check who a user claims to be, the checks are insufficient, allowing attackers to impersonate legitimate users. |
| CWE-1391 | Use of Weak Credentials | This vulnerability occurs when a system relies on weak authentication credentials—like default passwords, hard-coded keys, or easily guessable values—that an attacker can deduce, reuse, or predict without needing to perform a full brute-force attack. |
| CWE-1392 | Use of Default Credentials | This vulnerability occurs when a system, device, or application relies on pre-configured, publicly known credentials like passwords or encryption keys for access to critical functions. |
| CWE-1393 | Use of Default Password | This vulnerability occurs when a system or device uses a pre-configured, publicly known password for authentication, often for administrative or critical functions. |
| CWE-1394 | Use of Default Cryptographic Key | This vulnerability occurs when a system uses a pre-configured, publicly known cryptographic key for security-critical operations instead of generating a unique one. |
| CWE-1395 | Dependency on Vulnerable Third-Party Component | This vulnerability occurs when your software relies on an external library, framework, or module that contains known security flaws. |
| CWE-14 | Compiler Removal of Code to Clear Buffers | A compiler optimization can remove security-critical code intended to wipe sensitive data from memory, leaving secrets exposed. This happens when the compiler identifies buffer-clearing operations as unnecessary 'dead stores' and eliminates them. |
| CWE-140 | Improper Neutralization of Delimiters | This vulnerability occurs when an application fails to properly handle or sanitize delimiter characters within data inputs, allowing them to be misinterpreted by downstream systems. |
| CWE-141 | Improper Neutralization of Parameter/Argument Delimiters | This vulnerability occurs when an application fails to properly sanitize special characters that act as delimiters in data being passed between system components. Attackers can inject these characters to manipulate how downstream processes interpret command arguments or parameter lists. |
| CWE-1419 | Incorrect Initialization of Resource | This weakness occurs when a system fails to properly set up a resource during its creation, leaving it in an unstable, incorrect, or insecure state when used later. |
| CWE-142 | Improper Neutralization of Value Delimiters | This vulnerability occurs when an application fails to properly sanitize or escape special characters that act as data separators (delimiters) before passing that data to another system or component. An attacker can inject these characters to manipulate how the downstream process interprets the data structure. |
| CWE-1420 | Exposure of Sensitive Information during Transient Execution | Transient execution vulnerabilities occur when a processor speculatively runs operations that don't officially commit, potentially leaking sensitive data through covert side channels like cache timing. |
| CWE-1421 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution | This vulnerability occurs when a processor's speculative execution (transient operations) can temporarily access restricted data from another security domain. This sensitive information can leave traces in shared hardware structures like CPU caches, where an attacker could potentially retrieve it using a covert channel attack. |
| CWE-1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution | This vulnerability occurs when a CPU incorrectly forwards outdated or incorrect data during speculative execution. This allows sensitive information to leak through covert side-channel attacks, even when software-level protections are in place. |
| CWE-1423 | Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution | This vulnerability occurs when separate software components, like different processes or virtual machines, share the processor's internal prediction mechanisms. An attacker can manipulate these shared predictors to trigger speculative execution in a victim component, potentially leaking sensitive data across a security boundary via covert side channels. |
| CWE-1426 | Improper Validation of Generative AI Output | This vulnerability occurs when an application uses a generative AI model (like an LLM) but fails to properly check the AI's output before using it. Without this validation, the AI's responses might contain security flaws, harmful content, or data leaks that violate the application's intended policies. |
| CWE-1427 | Improper Neutralization of Input Used for LLM Prompting | This vulnerability occurs when an application builds prompts for a Large Language Model (LLM) using external data, but does so in a way that the LLM cannot tell the difference between the developer's intended instructions and the user's potentially malicious input. This allows an attacker to 'hijack' the prompt and make the model ignore its original guidelines. |
| CWE-1428 | Reliance on HTTP instead of HTTPS | This vulnerability occurs when an application uses unencrypted HTTP connections instead of the secure HTTPS alternative, even when HTTPS is available. |
| CWE-1429 | Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface | This vulnerability occurs when a hardware interface discards operations without providing any security-relevant feedback, such as error notifications or logs. This silence prevents the timely detection of critical failures or active attacks, leaving systems vulnerable to undetected compromise. |
| CWE-143 | Improper Neutralization of Record Delimiters | This vulnerability occurs when an application fails to properly sanitize or escape special characters that function as record separators in data streams. When untrusted input containing these delimiters is passed to a downstream system, it can corrupt data structures, cause misinterpretation of records, or trigger unauthorized actions. |
| CWE-1431 | Driving Intermediate Cryptographic State/Results to Hardware Module Outputs | This vulnerability occurs when a hardware cryptographic module leaks sensitive internal data through its output channels. Instead of only providing the final encrypted or decrypted result, the module inadvertently exposes intermediate calculation states or partial results via its output wires or ports. |
| CWE-1434 | Insecure Setting of Generative AI/ML Model Inference Parameters | This vulnerability occurs when a generative AI or ML model is deployed with inference parameters that are too permissive, causing it to frequently generate incorrect, nonsensical, or unpredictable outputs. |
| CWE-144 | Improper Neutralization of Line Delimiters | This vulnerability occurs when an application fails to properly sanitize or escape line break characters (like newline or carriage return) in user-supplied input before passing that data to another system or component. |
| CWE-145 | Improper Neutralization of Section Delimiters | This vulnerability occurs when an application fails to properly sanitize or validate special characters that act as section delimiters in data streams. When this unsanitized input is passed to another component, these delimiters can be misinterpreted, leading to incorrect data parsing or unintended behavior. |
| CWE-146 | Improper Neutralization of Expression/Command Delimiters | This vulnerability occurs when an application fails to properly sanitize input that contains special characters used as delimiters in expressions or commands. When this unsanitized input is passed to another component for processing, those characters can be misinterpreted, altering the intended logic or structure. |
| CWE-147 | Improper Neutralization of Input Terminators | This vulnerability occurs when an application accepts external input but fails to properly handle special characters that downstream systems interpret as commands to stop processing data. |
| CWE-148 | Improper Neutralization of Input Leaders | This vulnerability occurs when an application fails to properly validate or handle input that begins with special control characters or sequences, known as 'leaders.' Issues arise when a required leader is missing, malformed, or when too many leaders are present where only one is expected. |
| CWE-149 | Improper Neutralization of Quoting Syntax | This vulnerability occurs when an application fails to properly validate or escape quote characters (like single ' or double " quotes) in user input. Attackers can inject these quotes to manipulate how the system interprets data, often breaking out of intended data fields to execute unauthorized commands or alter program logic. |
| CWE-15 | External Control of System or Configuration Setting | This vulnerability occurs when an application allows users to directly modify critical system settings or configuration values from an external source. |
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | This vulnerability occurs when an application fails to properly sanitize or escape special character sequences in user-supplied input before passing that data to another system or component. Attackers can inject escape, meta, or control sequences to manipulate how the downstream component interprets the data, often leading to command execution, data corruption, or unauthorized actions. |
| CWE-151 | Improper Neutralization of Comment Delimiters | This vulnerability occurs when an application accepts user input and fails to properly sanitize characters that can be interpreted as comment markers (like /*, */, //, #, or <!--) before passing that data to another system component. This allows an attacker to inject malicious comments that can break data processing, alter logic, or expose sensitive information. |
| CWE-152 | Improper Neutralization of Macro Symbols | This vulnerability occurs when an application accepts user input containing macro symbols (like those used in templates or configuration files) and passes it along without properly sanitizing it. This allows attackers to inject malicious macro commands that get executed by downstream systems, potentially leading to data manipulation, system access, or other unintended behaviors. |
| CWE-153 | Improper Neutralization of Substitution Characters | This vulnerability occurs when an application accepts user input and fails to properly sanitize special characters that can trigger command or variable substitution before passing that data to another system component. This allows attackers to inject malicious substitutions that alter the system's intended behavior. |
| CWE-154 | Improper Neutralization of Variable Name Delimiters | This vulnerability occurs when an application fails to properly sanitize or escape special characters that act as delimiters for variable names before passing data to another component. Attackers can inject these delimiters to manipulate how variables are interpreted. |
| CWE-155 | Improper Neutralization of Wildcards or Matching Symbols | This vulnerability occurs when an application fails to properly sanitize user-supplied input containing wildcard characters (like *, ?, or [ ]) before passing it to a command or function that interprets them as pattern-matching symbols. |
| CWE-156 | Improper Neutralization of Whitespace | This vulnerability occurs when an application fails to properly handle or sanitize whitespace characters in input before passing that data to another system component. This allows special whitespace elements to be interpreted incorrectly downstream, potentially altering how the data is processed. |
| CWE-157 | Failure to Sanitize Paired Delimiters | This vulnerability occurs when an application fails to properly validate or neutralize the special characters that come in pairs to define boundaries, such as parentheses, brackets, quotes, or braces. Attackers can exploit this oversight to manipulate data structure, inject malicious code, or cause the application to crash. |
| CWE-158 | Improper Neutralization of Null Byte or NUL Character | This weakness occurs when an application receives data but fails to properly handle or remove NUL characters (\0) before passing that data to another system component. |
| CWE-159 | Improper Handling of Invalid Use of Special Elements | This vulnerability occurs when an application fails to properly validate or neutralize special characters and control elements within user-supplied input. Without this filtering, attackers can inject these elements to manipulate the application's logic, leading to security breaches or system instability. |
| CWE-160 | Improper Neutralization of Leading Special Elements | This vulnerability occurs when an application accepts external input but fails to properly sanitize leading special characters or commands before passing that data to another system component. This allows an attacker to inject unexpected instructions at the beginning of the data stream. |
| CWE-161 | Improper Neutralization of Multiple Leading Special Elements | This vulnerability occurs when an application accepts external input but fails to properly sanitize multiple special characters or sequences at the beginning of that input before passing it to another system component. This allows an attacker to inject unexpected commands or data structures. |
| CWE-162 | Improper Neutralization of Trailing Special Elements | This vulnerability occurs when an application fails to properly sanitize or remove trailing special characters from user-supplied input before passing it to another system component. These leftover characters can trick the downstream parser into executing unintended commands or altering the data flow. |
| CWE-163 | Improper Neutralization of Multiple Trailing Special Elements | This vulnerability occurs when software accepts external input but fails to properly sanitize or incorrectly handles multiple trailing special characters or elements. When this unsanitized data is passed to another system component, these elements can be interpreted in harmful, unintended ways. |
| CWE-164 | Improper Neutralization of Internal Special Elements | This vulnerability occurs when an application accepts data from a source but fails to properly sanitize internal control elements or metadata before passing it to another internal component. This can cause the downstream component to misinterpret the data and perform unintended actions. |
| CWE-165 | Improper Neutralization of Multiple Internal Special Elements | This vulnerability occurs when an application accepts external input but fails to properly sanitize multiple internal control characters or delimiters before passing that data to another internal component. This can cause the downstream component to misinterpret the data and execute unintended commands. |
| CWE-166 | Improper Handling of Missing Special Element | This vulnerability occurs when software expects a specific delimiter, terminator, or other special marker in its input but fails to properly handle situations where that element is absent. The application may then misinterpret boundaries, leading to crashes, data corruption, or security breaches. |
| CWE-167 | Improper Handling of Additional Special Element | This vulnerability occurs when software receives data from another component but fails to properly process or validate unexpected special characters or control elements within that input. |
| CWE-168 | Improper Handling of Inconsistent Special Elements | This vulnerability occurs when software fails to correctly process input containing conflicting or mismatched special elements like characters, symbols, or reserved keywords. |
| CWE-170 | Improper Null Termination | This weakness occurs when software fails to properly end a string or array with the required null character or equivalent terminator. |
| CWE-172 | Encoding Error | This vulnerability occurs when software incorrectly transforms data between different formats, leading to corrupted or misinterpreted information that can break functionality or create security gaps. |
| CWE-173 | Improper Handling of Alternate Encoding | This vulnerability occurs when software fails to correctly process input that arrives in a different character encoding than expected, allowing that input to bypass security checks or cause misinterpretation. |
| CWE-174 | Double Decoding of the Same Data | This vulnerability occurs when an application decodes the same piece of data twice in sequence. This double processing can bypass or neutralize security checks that happen after the first decode, leaving the system exposed. |
| CWE-175 | Improper Handling of Mixed Encoding | This vulnerability occurs when software fails to correctly process input that contains multiple character encodings within the same data stream. |
| CWE-176 | Improper Handling of Unicode Encoding | This vulnerability occurs when software fails to correctly process or interpret Unicode-encoded input, leading to security bypasses, data corruption, or unexpected behavior. |
| CWE-177 | Improper Handling of URL Encoding (Hex Encoding) | This vulnerability occurs when an application fails to correctly process URL-encoded (also known as percent-encoded or hex-encoded) input, either by double-decoding it, not decoding it at all, or inconsistently handling encoded characters across different security checks. |
| CWE-178 | Improper Handling of Case Sensitivity | This vulnerability occurs when software fails to consistently handle uppercase and lowercase letters when checking or accessing resources, leading to unpredictable behavior and security gaps. |
| CWE-179 | Incorrect Behavior Order: Early Validation | This vulnerability occurs when an application validates user input before applying security filters or data normalization. Attackers can exploit this order of operations by submitting specially crafted input that passes the initial validation but becomes malicious after the application's filters or canonicalization processes modify it. |
| CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | This vulnerability occurs when a system checks user input for malicious content before standardizing its format, allowing specially crafted data to bypass security checks. |
| CWE-181 | Incorrect Behavior Order: Validate Before Filter | This vulnerability occurs when a system checks user input for validity before cleaning or filtering it. This flawed sequence allows malicious data to pass validation, only to be altered by later filters into a dangerous form. |
| CWE-182 | Collapse of Data into Unsafe Value | This vulnerability occurs when an application's data filtering or transformation process incorrectly merges or simplifies information, producing a result that violates security rules. Essentially, safe input gets collapsed into a dangerous value. |
| CWE-183 | Permissive List of Allowed Inputs | This vulnerability occurs when an application's security filter uses an allowlist that is too broad, mistakenly permitting dangerous inputs that should have been blocked. The flawed assumption that everything on the list is safe creates a direct path for attackers to exploit the system. |
| CWE-184 | Incomplete List of Disallowed Inputs | This vulnerability occurs when a security filter or validation mechanism relies on a 'denylist'—a predefined list of forbidden inputs—but that list is missing critical entries. Attackers can bypass the protection by using variations or inputs the developers didn't anticipate. |
| CWE-185 | Incorrect Regular Expression | This vulnerability occurs when a regular expression is written incorrectly, causing it to match or validate data in unintended and potentially dangerous ways. |
| CWE-186 | Overly Restrictive Regular Expression | This weakness occurs when a regular expression is too narrow, failing to detect all the dangerous or unexpected input values it was designed to catch. |
| CWE-187 | Partial String Comparison | This weakness occurs when software checks only part of a string or token to determine a match, instead of comparing the entire value. This incomplete validation can lead to incorrect security decisions. |
| CWE-188 | Reliance on Data/Memory Layout | This vulnerability occurs when software incorrectly assumes how data is structured in memory or within network packets, leading to unexpected behavior when those underlying layouts change. |
| CWE-190 | Integer Overflow or Wraparound | Integer overflow or wraparound occurs when a calculation produces a numeric result that exceeds the maximum value a variable can hold. Instead of increasing as expected, the value wraps around to a very small or negative number, breaking the program's logic. |
| CWE-191 | Integer Underflow (Wrap or Wraparound) | Integer underflow occurs when a subtraction operation results in a value smaller than the data type's minimum limit, causing the value to wrap around to a large, incorrect number. |
| CWE-192 | Integer Coercion Error | An integer coercion error occurs when a program incorrectly converts, extends, or truncates a number between different data types, leading to unexpected values. |
| CWE-193 | Off-by-one Error | An off-by-one error occurs when a program incorrectly calculates a boundary, such as a loop counter or array index, by being one unit too high or too low. This often leads to buffer overflows, memory corruption, or unexpected program behavior. |
| CWE-194 | Unexpected Sign Extension | This vulnerability occurs when a signed number from a smaller data type is moved or cast to a larger type, causing its sign bit to be incorrectly extended. If the original value is negative, this sign extension can fill the new, higher-order bits with '1's, leading to unexpectedly large positive values and causing logic errors, buffer overflows, or security bypasses. |
| CWE-195 | Signed to Unsigned Conversion Error | This vulnerability occurs when a signed integer (which can hold negative values) is converted to an unsigned integer (which holds only non-negative values). If the original signed value is negative, the conversion produces a large, unexpected positive number instead of an error, breaking the program's logic. |
| CWE-196 | Unsigned to Signed Conversion Error | This vulnerability occurs when a program takes an unsigned integer and converts it directly to a signed integer. If the original unsigned value is too large to fit within the signed type's positive range, the conversion results in an unexpected negative number, corrupting the data. |
| CWE-197 | Numeric Truncation Error | A numeric truncation error happens when a program converts a number to a smaller data type, cutting off its higher-order bits and corrupting the original value. |
| CWE-198 | Use of Incorrect Byte Ordering | This vulnerability occurs when software processes data from another system without considering byte order (endianness), such as big-endian or little-endian. This mismatch can cause the program to misinterpret numbers or values, leading to incorrect calculations, crashes, or security flaws. |
| CWE-20 | Improper Input Validation | This vulnerability occurs when an application accepts data from an external source but fails to properly verify that the data is safe and correctly formatted before using it. This missing or flawed validation check allows malicious or malformed inputs to disrupt the application's logic or security. |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | This weakness occurs when an application unintentionally reveals sensitive data to someone who shouldn't have access to it. |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | This vulnerability occurs when an application sends data to an external party, but accidentally includes sensitive information—like passwords, keys, or personal data—that the recipient should not be able to access. |
| CWE-202 | Exposure of Sensitive Information Through Data Queries | This vulnerability occurs when an attacker uses statistical analysis on aggregated or anonymized data to uncover sensitive details about individuals, even when direct identifiers are removed. |
| CWE-203 | Observable Discrepancy | This vulnerability occurs when an application responds differently to unauthorized users based on internal conditions. Attackers can observe these variations—like changes in error messages, timing, or system behavior—to infer sensitive information, such as whether a username exists, a password is incorrect, or a specific operation succeeded. |
| CWE-204 | Observable Response Discrepancy | This vulnerability occurs when an application responds differently to similar requests, unintentionally leaking details about its internal state or logic to unauthorized users. |
| CWE-205 | Observable Behavioral Discrepancy | This vulnerability occurs when an application behaves differently in ways that unauthorized users can detect. These observable differences can reveal internal system logic, state information, or how the product varies from similar applications, providing attackers with valuable clues. |
| CWE-206 | Observable Internal Behavioral Discrepancy | This vulnerability occurs when a system's internal steps or decisions become visible to an attacker because the system behaves differently at each stage. Instead of presenting a single, unified result, the product leaks information about its internal checks, allowing an attacker to map its logic and pinpoint weaknesses. |
| CWE-207 | Observable Behavioral Discrepancy With Equivalent Products | This vulnerability occurs when a system that should remain anonymous behaves differently than other products with the same purpose, allowing attackers to detect and identify it. |
| CWE-208 | Observable Timing Discrepancy | This vulnerability occurs when an application takes measurably different amounts of time to perform different operations, such as checking a password or processing a request. An attacker can observe these timing differences to learn sensitive information, like whether a username is valid or a cryptographic key guess is correct. |
| CWE-209 | Generation of Error Message Containing Sensitive Information | This vulnerability occurs when an application reveals sensitive details about its internal systems, user data, or environment within error messages shown to users. |
| CWE-210 | Self-generated Error Message Containing Sensitive Information | This vulnerability occurs when an application detects a problem and generates its own error messages that accidentally expose sensitive system or user data. |
| CWE-211 | Externally-Generated Error Message Containing Sensitive Information | This vulnerability occurs when an application triggers an error message from an external component—like a database, interpreter, or operating system—and that error reveals sensitive details about the system's internal workings, configuration, or data. |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | This vulnerability occurs when an application stores or transmits a resource containing sensitive data without properly cleaning it first, potentially exposing that information to unauthorized parties. |
| CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | This vulnerability occurs when a system's data handling aligns with the developer's security rules but accidentally reveals information that other stakeholders—like users or administrators—consider confidential. Essentially, the developer's policy conflicts with the security expectations of the people who use or manage the product. |
| CWE-214 | Invocation of Process Using Visible Sensitive Information | This vulnerability occurs when a process is started with sensitive data, such as passwords or API keys, passed directly in its command-line arguments or environment variables. Because this information is often visible to other processes on the system, it can be easily exposed. |
| CWE-215 | Insertion of Sensitive Information Into Debugging Code | This vulnerability occurs when developers embed sensitive data, such as passwords or API keys, within debugging statements like logs or console outputs, and fail to remove or disable this code before deploying to a live environment. |
| CWE-216 | DEPRECATED: Containment Errors (Container Errors) | This entry has been retired because it functioned more as a broad category than a specific, actionable vulnerability. The term 'container' also caused confusion, as developers interpret it differently than originally intended, making the entry unclear for practical use. |
| CWE-217 | DEPRECATED: Failure to Protect Stored Data from Modification | This entry has been deprecated. The security issues it described—specifically around failing to protect stored data from unauthorized changes—are now more precisely covered by CWE-766 (Critical Data Element Declared Public) and CWE-767 (Access to Critical Private Field via Unsafe Reflection). |
| CWE-218 | DEPRECATED: Failure to provide confidentiality for stored data | This entry has been consolidated into CWE-493: Critical Public Variable Without Final Modifier. The original content describing failure to protect stored data confidentiality has been moved to that entry. |
| CWE-219 | Storage of File with Sensitive Data Under Web Root | This vulnerability occurs when an application saves sensitive files, such as configuration data or private keys, inside the web server's publicly accessible directory. Without proper access restrictions, attackers can directly request and download these files. |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | This vulnerability occurs when an application builds a file path using user input but fails to properly validate it, allowing an attacker to break out of the intended directory and access files or folders anywhere on the server. |
| CWE-220 | Storage of File With Sensitive Data Under FTP Root | This vulnerability occurs when an application saves sensitive files, such as configuration or user data, within the directory served by an FTP server without proper access restrictions. This misconfiguration can allow unauthorized users to download these files directly. |
| CWE-221 | Information Loss or Omission | This weakness occurs when an application fails to log critical security events or records them inaccurately, which can misguide security decisions and hinder incident investigation. |
| CWE-222 | Truncation of Security-relevant Information | This vulnerability occurs when a system shortens or cuts off security-critical data during display, logging, or processing. This truncation can hide the true details of an attack, making it harder to detect, investigate, and respond to threats. |
| CWE-223 | Omission of Security-relevant Information | This vulnerability occurs when an application fails to capture or present crucial security-related details, such as the origin of a request or the specifics of a security event. Without this information, developers and security teams cannot effectively trace attacks or validate whether an operation is legitimate. |
| CWE-224 | Obscured Security-relevant Information by Alternate Name | This vulnerability occurs when a system logs or reports security-critical events using a nickname or alias for a component, instead of its official, unique identifier. |
| CWE-225 | DEPRECATED: General Information Management Problems | This entry has been deprecated and consolidated into CWE-199: Information Management Errors. Please refer to that entry for current information. |
| CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | This vulnerability occurs when a system releases a resource like memory or a file for reuse but fails to erase the sensitive data it previously contained. The old information remains accessible when the resource is allocated to a new process or used in a different context. |
| CWE-228 | Improper Handling of Syntactically Invalid Structure | This vulnerability occurs when software fails to properly reject or process input that doesn't follow the expected format or structure, often leading to crashes or unexpected behavior. |
| CWE-229 | Improper Handling of Values | This vulnerability occurs when software fails to correctly process situations where input contains too few values, too many values, or undefined values for expected parameters, fields, or arguments. |
| CWE-23 | Relative Path Traversal | This vulnerability occurs when an application builds file paths using user-supplied input without properly validating or sanitizing it. Attackers can exploit this by inserting special directory traversal sequences like '..' to access files and directories outside the intended restricted folder. |
| CWE-230 | Improper Handling of Missing Values | This vulnerability occurs when software fails to properly check for or handle missing data values. It happens when a parameter, field, or argument name is provided, but its corresponding value is empty, blank, or null, and the system doesn't manage this absence safely. |
| CWE-231 | Improper Handling of Extra Values | This vulnerability occurs when software receives more input values than it was designed to handle, and fails to properly manage or reject the excess data. |
| CWE-232 | Improper Handling of Undefined Values | This vulnerability occurs when software fails to properly check for or handle undefined, null, or unsupported values passed to parameters, configuration fields, or function arguments. Instead of rejecting or safely converting these values, the system proceeds with an unexpected state, often leading to crashes or security flaws. |
| CWE-233 | Improper Handling of Parameters | This vulnerability occurs when software fails to correctly process input that contains an unexpected number of parameters, missing fields, or undefined arguments. It often leads to crashes, unexpected behavior, or security bypasses. |
| CWE-234 | Failure to Handle Missing Parameter | This vulnerability occurs when a function or method receives fewer arguments than it expects. The function will still attempt to process its expected number of parameters, which can lead to reading undefined, stale, or arbitrary values from the program's memory or stack, causing crashes or unexpected behavior. |
| CWE-235 | Improper Handling of Extra Parameters | This vulnerability occurs when a system fails to properly manage situations where it receives more parameters, fields, or arguments with the same name than it was designed to handle. |
| CWE-236 | Improper Handling of Undefined Parameters | This vulnerability occurs when software fails to properly manage input parameters, field names, or arguments that it doesn't recognize or support. Instead of rejecting or safely ignoring the undefined input, the system may behave unpredictably, leading to errors or security issues. |
| CWE-237 | Improper Handling of Structural Elements | This vulnerability occurs when an application fails to properly validate, sanitize, or interpret the complex internal parts of structured data, such as file headers, network packet fields, or document metadata. |
| CWE-238 | Improper Handling of Incomplete Structural Elements | This vulnerability occurs when software fails to properly process or validate data structures that are missing required components or are only partially formed. |
| CWE-239 | Failure to Handle Incomplete Element | This vulnerability occurs when a system fails to properly manage or validate data elements that are missing required parts or are only partially defined. |
| CWE-24 | Path Traversal: '../filedir' | Path traversal, often called directory traversal, occurs when an application builds a file path using user input without properly blocking sequences like '../'. This allows an attacker to break out of the intended directory and access files or folders anywhere on the server. |
| CWE-240 | Improper Handling of Inconsistent Structural Elements | This vulnerability occurs when a system fails to properly manage situations where related data structures or elements should match but are inconsistent. |
| CWE-241 | Improper Handling of Unexpected Data Type | This vulnerability occurs when software fails to properly validate or safely process data that arrives in an unexpected format. For example, the system might expect a numeric input but receives text instead, leading to crashes, errors, or security issues. |
| CWE-242 | Use of Inherently Dangerous Function | This vulnerability occurs when code uses functions that are inherently unsafe and cannot be reliably secured, posing a direct risk to application stability and security. |
| CWE-243 | Creation of chroot Jail Without Changing Working Directory | This vulnerability occurs when a program creates a chroot jail but fails to change its current working directory afterward. Because the process's working directory remains outside the jail, attackers can use relative paths to access files and directories that should be restricted. |
| CWE-244 | Improper Clearing of Heap Memory Before Release ('Heap Inspection') | Using realloc() to resize buffers containing secrets like passwords or keys can leave that sensitive data exposed in memory, as the original data is not securely erased. |
| CWE-245 | J2EE Bad Practices: Direct Management of Connections | This vulnerability occurs when a J2EE application handles database connections directly instead of using the container's built-in connection management system. |
| CWE-246 | J2EE Bad Practices: Direct Use of Sockets | This vulnerability occurs when a J2EE application creates network sockets directly, bypassing the container-managed communication framework provided by the platform. |
| CWE-247 | DEPRECATED: Reliance on DNS Lookups in a Security Decision | This deprecated entry has been merged into CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action. All related content has been moved to that primary weakness entry. |
| CWE-248 | Uncaught Exception | This vulnerability occurs when a function throws an error or exception, but the calling code does not have a proper handler to catch and manage it. |
| CWE-249 | DEPRECATED: Often Misused: Path Manipulation | This entry has been deprecated. Its content was unclear and combined multiple security issues. Most relevant information has been moved to CWE-785. |
| CWE-25 | Path Traversal: '/../filedir' | This vulnerability, often called directory traversal, occurs when an application builds a file path using user input without properly blocking sequences like '/../'. This lets an attacker break out of the intended directory and access files or folders elsewhere on the server. |
| CWE-250 | Execution with Unnecessary Privileges | This vulnerability occurs when software runs with higher permissions than it actually needs to perform its tasks. This excessive privilege creates security risks by opening doors to new attacks or making existing weaknesses more dangerous. |
| CWE-252 | Unchecked Return Value | This vulnerability occurs when a program fails to verify the result of a function or method call, allowing it to continue execution without detecting errors or unexpected conditions. |
| CWE-253 | Incorrect Check of Function Return Value | This vulnerability occurs when a program misinterprets or improperly validates the return value from a function, causing it to miss critical error states or unexpected conditions. |
| CWE-256 | Plaintext Storage of a Password | This vulnerability occurs when an application stores user passwords as readable text instead of using secure, one-way hashing. This insecure practice exposes credentials in memory, files, or databases where attackers can easily retrieve them. |
| CWE-257 | Storing Passwords in a Recoverable Format | This vulnerability occurs when an application stores user passwords in a format that can be easily reversed or decrypted back to their original plaintext form. This practice, often called storing 'recoverable' passwords, defeats the core purpose of password protection. It allows anyone with access to the stored data—including attackers who breach the system or even malicious insiders—to obtain and reuse the actual passwords on other accounts, offering no real security advantage over storing them in plain text. |
| CWE-258 | Empty Password in Configuration File | This vulnerability occurs when a configuration file, script, or application uses an empty string as a password, effectively disabling authentication for a service or account. |
| CWE-259 | Use of Hard-coded Password | This vulnerability occurs when an application embeds a password directly into its source code or configuration files. This hard-coded secret is then used either to authenticate incoming users or to connect to external services and databases. |
| CWE-26 | Path Traversal: '/dir/../filename' | This vulnerability occurs when an application builds a file path using user input but fails to properly block directory traversal sequences like '/dir/../filename'. This allows an attacker to break out of the intended restricted directory and access files or folders elsewhere on the system. |
| CWE-260 | Password in Configuration File | This vulnerability occurs when an application stores sensitive passwords directly within a configuration file, making them easily readable to anyone with access to that file. |
| CWE-261 | Weak Encoding for Password | Using simple encoding like Base64 to hide a password provides no real security, as it can be easily reversed. |
| CWE-262 | Not Using Password Aging | This vulnerability occurs when a system lacks password expiration policies, allowing users to keep the same password indefinitely. |
| CWE-263 | Password Aging with Long Expiration | The system enforces password changes, but the time allowed between changes is excessively long, weakening security. |
| CWE-266 | Incorrect Privilege Assignment | This vulnerability occurs when a system mistakenly grants a user, process, or entity a specific permission or privilege they should not have. This error creates an unintended level of access, allowing the actor to perform actions beyond their intended authority. |
| CWE-267 | Privilege Defined With Unsafe Actions | This vulnerability occurs when a system grants a user, role, or process a specific permission that can be misused to perform dangerous, unintended actions. The permission itself is correctly assigned, but its scope is too broad or allows for unsafe operations. |
| CWE-268 | Privilege Chaining | Privilege chaining occurs when an attacker combines two separate permissions or capabilities, neither of which is dangerous on its own, to perform a harmful action that neither permission should individually allow. |
| CWE-269 | Improper Privilege Management | This vulnerability occurs when an application fails to correctly manage user permissions, allowing someone to perform actions or access data beyond their intended authority. |
| CWE-27 | Path Traversal: 'dir/../../filename' | This vulnerability occurs when an application builds file paths using user input but fails to properly block sequences like 'dir/../../filename'. Attackers can exploit this by injecting multiple '../' segments to escape the intended directory and access unauthorized files or folders elsewhere on the system. |
| CWE-270 | Privilege Context Switching Error | This vulnerability occurs when an application fails to properly manage user permissions while moving between different security contexts, potentially allowing unauthorized actions. |
| CWE-271 | Privilege Dropping / Lowering Errors | This vulnerability occurs when a system or process fails to reduce its elevated permissions before transferring control of a resource to a less-privileged user or component. |
| CWE-272 | Least Privilege Violation | This vulnerability occurs when software fails to reduce its elevated system privileges after completing a sensitive operation, leaving it with unnecessary and dangerous access rights. |
| CWE-273 | Improper Check for Dropped Privileges | This vulnerability occurs when an application tries to lower its system privileges but fails to verify that the operation was successful. |
| CWE-274 | Improper Handling of Insufficient Privileges | This vulnerability occurs when an application fails to properly manage situations where it lacks the necessary permissions to execute an action. This flawed handling can lead to crashes, data corruption, or unintended security bypasses. |
| CWE-276 | Incorrect Default Permissions | This vulnerability occurs when software installation scripts set overly permissive file or directory access rights by default. Instead of restricting write access to authorized users or processes, the installation allows unintended actors to modify, delete, or corrupt critical application files. |
| CWE-277 | Insecure Inherited Permissions | This vulnerability occurs when an application sets default file or directory permissions that are too permissive, and these insecure settings are automatically passed down to new files or objects the program creates. |
| CWE-278 | Insecure Preserved Inherited Permissions | This vulnerability occurs when a software product copies or extracts files while unintentionally preserving insecure permissions from their original source, such as an archive, without the user's knowledge or consent. |
| CWE-279 | Incorrect Execution-Assigned Permissions | This vulnerability occurs when a running application incorrectly changes an object's access permissions, overriding the security settings that a user or administrator intentionally configured. |
| CWE-28 | Path Traversal: '..\filedir' | This vulnerability occurs when an application builds a file path using user input but fails to block or properly handle '..\' sequences. This oversight allows an attacker to break out of the intended directory and navigate to unauthorized locations in the file system. |
| CWE-280 | Improper Handling of Insufficient Permissions or Privileges | This vulnerability occurs when a system fails to properly manage situations where it lacks the necessary permissions to perform an action or access a resource. This flawed handling can force the application into unintended states or error paths, potentially leading to crashes, data corruption, or security bypasses. |
| CWE-281 | Improper Preservation of Permissions | This vulnerability occurs when a system fails to correctly maintain file or object permissions during operations like copying, sharing, or restoring data. As a result, these resources can end up with weaker, more permissive security settings than the original owner intended. |
| CWE-282 | Improper Ownership Management | This vulnerability occurs when a system incorrectly assigns or fails to verify which user or process rightfully controls a specific object or resource. |
| CWE-283 | Unverified Ownership | This vulnerability occurs when an application fails to confirm that a user has legitimate ownership rights to a sensitive resource before allowing them to perform actions on it. |
| CWE-284 | Improper Access Control | The software fails to properly limit who can access a resource, allowing unauthorized users or systems to interact with it. |
| CWE-285 | Improper Authorization | This vulnerability occurs when an application fails to properly verify whether a user has permission to access specific data or perform certain actions before allowing the request. |
| CWE-286 | Incorrect User Management | This vulnerability occurs when an application incorrectly handles user accounts, roles, or group memberships, leading to improper access control. |
| CWE-287 | Improper Authentication | Improper Authentication occurs when a system fails to properly verify a user's claimed identity, allowing access without sufficient proof of who they are. |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | This vulnerability occurs when a system has a primary login requirement, but attackers can find an unprotected backdoor or alternative route that completely bypasses those checks. |
| CWE-289 | Authentication Bypass by Alternate Name | This vulnerability occurs when a system checks access based on a resource or user name, but fails to account for all the different names or aliases that could refer to the same entity, allowing attackers to bypass authentication. |
| CWE-29 | Path Traversal: '\..\filename' | This vulnerability occurs when an application builds file paths using user input but fails to block '\..\filename' sequences. Attackers can use these leading backslash and dot-dot sequences to escape the intended directory and access unauthorized files or folders elsewhere on the system. |
| CWE-290 | Authentication Bypass by Spoofing | This weakness occurs when an application's authentication system can be tricked into accepting forged or manipulated credentials, allowing unauthorized access without proper verification. |
| CWE-291 | Reliance on IP Address for Authentication | This vulnerability occurs when a system uses a client's IP address as the sole or primary method to verify their identity. |
| CWE-292 | DEPRECATED: Trusting Self-reported DNS Name | This entry is a duplicate and has been consolidated into CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action. The content from this deprecated entry has been fully migrated to CWE-350. |
| CWE-293 | Using Referer Field for Authentication | This vulnerability occurs when a web application uses the HTTP Referer header as a sole or primary method for authentication or authorization decisions. Since this header is entirely controlled by the user's browser or client and can be easily forged, it provides no reliable security. |
| CWE-294 | Authentication Bypass by Capture-replay | This vulnerability occurs when an attacker can intercept and record legitimate authentication traffic, then replay it later to gain unauthorized access. The system accepts the replayed data as valid, effectively bypassing normal authentication checks. |
| CWE-295 | Improper Certificate Validation | This vulnerability occurs when an application fails to properly verify the authenticity of a digital certificate, or performs the verification incorrectly, allowing untrusted connections to appear legitimate. |
| CWE-296 | Improper Following of a Certificate's Chain of Trust | This vulnerability occurs when software fails to properly validate the entire certificate chain back to a trusted root authority. This mistake can cause the system to incorrectly trust a certificate and the resource it represents, creating a security gap. |
| CWE-297 | Improper Validation of Certificate with Host Mismatch | This vulnerability occurs when an application accepts a valid SSL/TLS certificate without properly verifying that it actually belongs to the specific host it's connecting to. Even a correctly signed certificate from a trusted authority can be misused if the hostname check is missing or flawed. |
| CWE-298 | Improper Validation of Certificate Expiration | This vulnerability occurs when an application fails to properly check if a digital certificate has expired, potentially trusting certificates that are no longer valid due to their age. |
| CWE-299 | Improper Check for Certificate Revocation | This vulnerability occurs when an application fails to properly verify whether a security certificate has been revoked, potentially allowing it to accept and use a compromised or untrustworthy certificate. |
| CWE-30 | Path Traversal: '\dir\..\filename' | This vulnerability occurs when an application builds file paths using user input but fails to properly sanitize sequences like '\dir\..\filename'. Attackers can exploit this to escape the intended directory and access unauthorized files or folders elsewhere on the system. |
| CWE-300 | Channel Accessible by Non-Endpoint | This vulnerability occurs when a system fails to properly verify who is on the other end of a communication link or to secure the channel itself. This allows an unauthorized third party to access or manipulate the communication as if they were a legitimate participant. |
| CWE-301 | Reflection Attack in an Authentication Protocol | A reflection attack is a flaw in mutual authentication protocols that allows an attacker to impersonate a legitimate user without knowing the secret key. This happens when an attacker can bounce, or 'reflect,' a server's own challenge back to it using a second connection, tricking the system into granting access. |
| CWE-302 | Authentication Bypass by Assumed-Immutable Data | This vulnerability occurs when an authentication system incorrectly treats certain data as unchangeable, when in fact an attacker can manipulate it to bypass login or verification checks. |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | This weakness occurs when a developer implements a standard authentication algorithm, but makes critical mistakes in the code that cause it to function incorrectly. |
| CWE-304 | Missing Critical Step in Authentication | This vulnerability occurs when a software authentication process omits a required step, weakening its overall security. |
| CWE-305 | Authentication Bypass by Primary Weakness | This vulnerability occurs when a system's core authentication logic is technically correct, but an attacker can completely bypass it by exploiting a separate, more fundamental flaw in the application. |
| CWE-306 | Missing Authentication for Critical Function | This vulnerability occurs when a software feature that performs a sensitive action or uses significant system resources does not verify the user's identity before executing. Attackers can exploit this to trigger critical functions without any credentials. |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | This vulnerability occurs when an application fails to properly limit how many times someone can attempt to log in or verify their identity in rapid succession, allowing attackers to systematically guess credentials. |
| CWE-308 | Use of Single-factor Authentication | Relying solely on single-factor authentication, like a password, exposes systems to significant security risks because it depends on only one type of proof for verifying a user's identity. |
| CWE-309 | Use of Password System for Primary Authentication | This weakness occurs when an application relies solely on password-based authentication as its main security gate. This single-factor approach is inherently vulnerable to a range of attacks that can compromise user accounts. |
| CWE-31 | Path Traversal: 'dir\..\..\filename' | This vulnerability occurs when an application builds file paths using user input but fails to properly block sequences like 'dir\..\..\filename'. Attackers can use these multiple backslash-dot-dot sequences to escape the intended directory and access files or folders anywhere on the file system. |
| CWE-311 | Missing Encryption of Sensitive Data | This vulnerability occurs when an application stores or sends sensitive information without first encrypting it, leaving the data exposed. |
| CWE-312 | Cleartext Storage of Sensitive Information | This vulnerability occurs when an application stores sensitive data like passwords, credit card numbers, or personal information in plain text, without any encryption. This unsecured data is kept in files, databases, caches, or logs that could be accessed by unauthorized users or systems. |
| CWE-313 | Cleartext Storage in a File or on Disk | This vulnerability occurs when an application writes sensitive data, such as passwords or personal information, directly to a file or disk without using encryption. |
| CWE-314 | Cleartext Storage in the Registry | This vulnerability occurs when an application saves sensitive data, like passwords or keys, as plain text in the Windows Registry. |
| CWE-315 | Cleartext Storage of Sensitive Information in a Cookie | This vulnerability occurs when an application directly stores sensitive data, like session tokens or personal details, in a browser cookie without encryption. |
| CWE-316 | Cleartext Storage of Sensitive Information in Memory | This vulnerability occurs when an application stores sensitive data, such as passwords or encryption keys, in memory without any form of encryption or protection. |
| CWE-317 | Cleartext Storage of Sensitive Information in GUI | This vulnerability occurs when an application stores sensitive data, such as passwords or personal information, in plain text within its graphical user interface (GUI) elements. |
| CWE-318 | Cleartext Storage of Sensitive Information in Executable | This vulnerability occurs when an application embeds sensitive information, like passwords or keys, directly within its executable code without encryption. |
| CWE-319 | Cleartext Transmission of Sensitive Information | This vulnerability occurs when an application sends sensitive data, such as passwords or personal information, over a network connection without using encryption. Attackers can easily intercept and read this unprotected data as it travels. |
| CWE-32 | Path Traversal: '...' (Triple Dot) | This vulnerability occurs when an application builds file paths using user input but fails to properly filter out '...' (triple dot) sequences. Attackers can exploit this to escape restricted directories and access unauthorized files or folders on the server. |
| CWE-321 | Use of Hard-coded Cryptographic Key | This vulnerability occurs when an application embeds a fixed, unchangeable cryptographic key directly within its source code or configuration files. |
| CWE-322 | Key Exchange without Entity Authentication | This vulnerability occurs when a system establishes a cryptographic key with another party without first confirming that party's true identity. |
| CWE-323 | Reusing a Nonce, Key Pair in Encryption | This vulnerability occurs when a cryptographic nonce or key pair is reused, compromising the security of the encrypted data. |
| CWE-324 | Use of a Key Past its Expiration Date | This vulnerability occurs when an application continues to use a cryptographic key or password after its designated expiration date. Doing so dramatically increases the security risk by giving attackers more time to discover or crack the key. |
| CWE-325 | Missing Cryptographic Step | This vulnerability occurs when a software implementation skips a critical step in a cryptographic process, resulting in security that is significantly weaker than the intended algorithm provides. |
| CWE-326 | Inadequate Encryption Strength | This vulnerability occurs when an application protects sensitive information with encryption, but the specific algorithm or key strength used is too weak to withstand modern attack methods. |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | The software relies on a cryptographic algorithm or protocol that is either fundamentally flawed or considered too weak by modern security standards. |
| CWE-328 | Use of Weak Hash | This vulnerability occurs when software uses a hashing algorithm that is cryptographically weak, allowing attackers to feasibly reverse the hash to find the original input, find a different input that creates the same hash, or discover collisions where two inputs produce identical hash values. |
| CWE-329 | Generation of Predictable IV with CBC Mode | This vulnerability occurs when software uses a predictable or reused Initialization Vector (IV) with Cipher Block Chaining (CBC) mode encryption. Predictable IVs undermine the security of CBC, making encrypted data vulnerable to dictionary and chosen-plaintext attacks, especially when the same key is used multiple times. |
| CWE-33 | Path Traversal: '....' (Multiple Dot) | This vulnerability occurs when an application builds file paths using user input but fails to properly filter sequences of multiple dots ('....'). Attackers can exploit this to break out of the intended directory and access unauthorized files or folders elsewhere on the system. |
| CWE-330 | Use of Insufficiently Random Values | This vulnerability occurs when an application uses random values that are not sufficiently unpredictable in security-sensitive operations, making them easier for attackers to guess or calculate. |
| CWE-331 | Insufficient Entropy | This vulnerability occurs when a system's random number generator or algorithm lacks sufficient unpredictability, creating patterns or predictable outputs that are easier for attackers to guess. |
| CWE-332 | Insufficient Entropy in PRNG | This vulnerability occurs when a Pseudo-Random Number Generator (PRNG) doesn't have enough randomness (entropy) to start with, or isn't using enough during operation. This makes its outputs predictable, undermining both system stability and security. |
| CWE-333 | Improper Handling of Insufficient Entropy in TRNG | This vulnerability occurs when a system fails to properly manage the limited or unpredictable output rate of a true random number generator (TRNG), potentially causing failures, delays, or weakened security. |
| CWE-334 | Small Space of Random Values | This vulnerability occurs when a system uses a random number generator that produces too few possible values. Attackers can easily predict or guess these values through brute force attacks. |
| CWE-335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) | This vulnerability occurs when a Pseudo-Random Number Generator (PRNG) is used, but its initial seed value is not handled securely or predictably, compromising the randomness of its output. |
| CWE-336 | Same Seed in Pseudo-Random Number Generator (PRNG) | This vulnerability occurs when a Pseudo-Random Number Generator (PRNG) is repeatedly initialized with the same starting seed value. |
| CWE-337 | Predictable Seed in Pseudo-Random Number Generator (PRNG) | This vulnerability occurs when a Pseudo-Random Number Generator (PRNG) uses an easily guessable starting value, like the current system time or a process ID, to begin its sequence. |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | This vulnerability occurs when software uses a pseudo-random number generator (PRNG) that is not cryptographically strong for security-sensitive operations, such as generating keys, tokens, or initialization vectors. |
| CWE-339 | Small Seed Space in PRNG | This vulnerability occurs when a Pseudo-Random Number Generator (PRNG) uses a seed that has too few possible values, making it easy for an attacker to guess through brute force. |
| CWE-34 | Path Traversal: '....//' | This vulnerability occurs when an application builds file paths using user input but fails to properly sanitize '....//' sequences. Attackers can use this pattern to break out of the intended directory and access unauthorized files or folders elsewhere on the system. |
| CWE-340 | Generation of Predictable Numbers or Identifiers | This vulnerability occurs when a system creates numbers or identifiers that are too easy to guess, undermining security mechanisms that rely on unpredictability. |
| CWE-341 | Predictable from Observable State | This vulnerability occurs when an attacker can guess or deduce sensitive values, like random numbers or identifiers, by observing predictable system or network characteristics such as timestamps, process IDs, or other public information. |
| CWE-342 | Predictable Exact Value from Previous Values | This vulnerability occurs when a system uses a predictable sequence for generating values, allowing an attacker to accurately guess future numbers by analyzing past ones. |
| CWE-343 | Predictable Value Range from Previous Values | This vulnerability occurs when a system's random number generator produces values that, after observing previous outputs, allow an attacker to predict a limited range for the next value. |
| CWE-344 | Use of Invariant Value in Dynamically Changing Context | This vulnerability occurs when code uses a fixed, unchanging value (like a hardcoded string, number, or reference) in a situation where that value should actually be flexible and adapt to different runtime conditions or environments. |
| CWE-345 | Insufficient Verification of Data Authenticity | This vulnerability occurs when an application fails to properly check where data comes from or confirm its legitimacy, allowing untrusted or forged information to be processed as valid. |
| CWE-346 | Origin Validation Error | This vulnerability occurs when an application fails to properly confirm the true origin of incoming data or communication, allowing attackers to spoof their source. |
| CWE-347 | Improper Verification of Cryptographic Signature | This vulnerability occurs when an application fails to properly check the digital signature on data, or skips the verification step entirely, allowing tampered or forged information to be accepted as legitimate. |
| CWE-348 | Use of Less Trusted Source | This vulnerability occurs when a system has access to multiple sources for the same critical data, but it chooses to rely on the less secure or less trustworthy one. This creates a security gap because the system ignores better-protected alternatives that offer stronger verification or are harder for attackers to compromise. |
| CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | This vulnerability occurs when a system processes both trusted and untrusted data together, but fails to separate them. The application incorrectly treats all incoming data—including the untrusted portion—with the same level of trust as the legitimate data. |
| CWE-35 | Path Traversal: '.../...//' | This vulnerability occurs when an application builds file paths using user input but fails to properly sanitize the '.../...//' sequence. Attackers can use this specific pattern to break out of the intended directory and access unauthorized files or folders elsewhere on the system. |
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | This vulnerability occurs when an application uses a reverse DNS lookup on an IP address to get a hostname and then uses that hostname for a security decision—like access control or logging—without verifying that the IP address actually belongs to that hostname. |
| CWE-351 | Insufficient Type Distinction | This vulnerability occurs when an application fails to properly differentiate between different types of data or objects, leading to unintended and insecure behavior. |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Cross-Site Request Forgery (CSRF) happens when a web application cannot reliably tell if a user actually intended to submit a request, allowing an attacker to trick a user's browser into performing unwanted actions on their behalf. |
| CWE-353 | Missing Support for Integrity Check | This vulnerability occurs when a system uses a communication protocol that lacks built-in integrity verification, such as a checksum or cryptographic hash, to detect if data has been altered or corrupted during transmission. |
| CWE-354 | Improper Validation of Integrity Check Value | This vulnerability occurs when software fails to properly check the integrity of data by validating its checksum or hash value. Without this verification, the application cannot reliably detect if information has been altered, corrupted, or tampered with during storage or transmission. |
| CWE-356 | Product UI does not Warn User of Unsafe Actions | This vulnerability occurs when a software interface fails to alert users before they perform a risky action. Without clear warnings, users can be more easily misled into taking steps that harm their system or data. |
| CWE-357 | Insufficient UI Warning of Dangerous Operations | This vulnerability occurs when a software application does present a warning to a user before a risky action, but the warning is designed or placed in a way that makes it too easy to miss, ignore, or accidentally dismiss. |
| CWE-358 | Improperly Implemented Security Check for Standard | This vulnerability occurs when software fails to correctly implement one or more critical security checks required by a standard protocol, algorithm, or security technique. |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | This vulnerability occurs when an application fails to adequately protect sensitive personal data, allowing access to individuals who either lack proper authorization or haven't provided necessary consent for its use. |
| CWE-36 | Absolute Path Traversal | This vulnerability occurs when an application builds file paths using user input without properly blocking absolute paths like '/etc/passwd' or 'C:\Windows\system32'. Attackers can exploit this to escape the intended directory and access sensitive files anywhere on the server. |
| CWE-360 | Trust of System Event Data | This vulnerability occurs when software blindly trusts system event data without verifying its source, allowing attackers to spoof events and manipulate application behavior. |
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | A race condition occurs when multiple processes or threads access a shared resource simultaneously without proper coordination, creating a timing window where the resource's state can be unexpectedly altered, leading to unpredictable behavior or security vulnerabilities. |
| CWE-363 | Race Condition Enabling Link Following | This vulnerability occurs when a program checks a file's status before using it, creating a brief window where an attacker can replace that file with a malicious link. This causes the program to follow the link and access an unintended, potentially dangerous location. |
| CWE-364 | Signal Handler Race Condition | A signal handler race condition occurs when a program's signal handling routine is vulnerable to timing issues, allowing its state to be corrupted through asynchronous execution. |
| CWE-365 | DEPRECATED: Race Condition in Switch | This deprecated entry originally suggested a race condition could occur if a switch statement's controlling expression was evaluated multiple times. In practice, this doesn't happen—the expression is evaluated just once, making this specific scenario not a valid software weakness. |
| CWE-366 | Race Condition within a Thread | This vulnerability occurs when two or more threads within the same application access and manipulate a shared resource (like a variable, data structure, or file) without proper synchronization. Because the threads can execute in an unpredictable order, they can corrupt the resource's state, leading to crashes, incorrect calculations, or data loss. |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | This vulnerability occurs when a program verifies a resource's state (like a file's permissions or existence) but then uses it after that state has already changed. The gap between checking and using creates a race window where an attacker can manipulate the resource, causing the program to operate on invalid or malicious data. |
| CWE-368 | Context Switching Race Condition | This vulnerability occurs when an application switches between different security contexts (like privilege levels or domains) using a series of steps that can be interrupted. An attacker can exploit the timing gap during this switch to trick the application into performing actions with the wrong permissions or resources. |
| CWE-369 | Divide By Zero | A divide-by-zero error occurs when software attempts to perform a division operation where the denominator is zero. |
| CWE-37 | Path Traversal: '/absolute/pathname/here' | This vulnerability occurs when an application accepts user input containing absolute file paths (starting with a forward slash like '/etc/passwd') and uses it to access files without proper security checks. Attackers can exploit this to read, write, or delete sensitive files anywhere on the server's filesystem. |
| CWE-370 | Missing Check for Certificate Revocation after Initial Check | This vulnerability occurs when software only verifies a certificate's revocation status once, then continues to trust it for subsequent privileged actions without re-checking. This allows operations to proceed even if the certificate is revoked later. |
| CWE-372 | Incomplete Internal State Distinction | This vulnerability occurs when an application fails to accurately track its own operational state. The system incorrectly assumes it's in one mode or condition when it's actually in another, leading to security-critical actions being performed with the wrong assumptions. |
| CWE-373 | DEPRECATED: State Synchronization Error | This entry has been retired because its core concept—errors that occur when different parts of a system fail to coordinate their shared state correctly—is fully covered by two more precise and actively maintained categories: Race Conditions (CWE-362) and Improper Synchronization (CWE-662). |
| CWE-374 | Passing Mutable Objects to an Untrusted Method | This vulnerability occurs when a function receives a direct reference to mutable data, such as an object or array, instead of a safe copy of that data. |
| CWE-375 | Returning a Mutable Object to an Untrusted Caller | This vulnerability occurs when a method directly returns a reference to its internal mutable data, allowing untrusted calling code to modify that data unexpectedly. |
| CWE-377 | Insecure Temporary File | This vulnerability occurs when an application creates temporary files with insecure permissions or in predictable locations, allowing attackers to read, modify, or delete sensitive data. |
| CWE-378 | Creation of Temporary File With Insecure Permissions | This vulnerability occurs when a program creates a temporary file but sets its file permissions too loosely, allowing other users or processes on the system to read, modify, or delete the file. |
| CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | This vulnerability occurs when an application creates a temporary file in a directory that is too permissive, allowing unauthorized users or processes to see, access, or manipulate the file. |
| CWE-38 | Path Traversal: '\absolute\pathname\here' | This vulnerability occurs when an application accepts user-supplied input containing Windows-style absolute paths (like '\absolute\pathname\here') without proper validation. Attackers can exploit this to navigate outside the intended directory and access or manipulate sensitive files anywhere on the server's file system. |
| CWE-382 | J2EE Bad Practices: Use of System.exit() | This vulnerability occurs when a J2EE application directly calls System.exit(), which forcibly terminates the entire application server process, not just the application itself. |
| CWE-383 | J2EE Bad Practices: Direct Use of Threads | Creating or managing threads directly within a J2EE application is a risky practice that violates the platform's standards and often leads to unstable applications. |
| CWE-384 | Session Fixation | Session fixation occurs when an application authenticates a user without first destroying the previous session ID. This allows an attacker who knows that session identifier to hijack the user's authenticated session. |
| CWE-385 | Covert Timing Channel | A covert timing channel is a security flaw where an attacker can deduce secret information by observing how long certain operations take to execute. Instead of directly reading data, they analyze timing variations in system behavior to infer protected details. |
| CWE-386 | Symbolic Name not Mapping to Correct Object | This vulnerability occurs when a program uses a fixed symbolic name (like a constant or identifier) to refer to an object, but that name can later point to a different, unintended object during execution. |
| CWE-39 | Path Traversal: 'C:dirname' | This vulnerability occurs when an application accepts user input containing Windows drive letters (like 'C:dirname') without proper validation, allowing attackers to redirect file operations to unintended locations or access arbitrary files on the system. |
| CWE-390 | Detection of Error Condition Without Action | This weakness occurs when software successfully identifies an error condition but then fails to take any meaningful action to address it. The error is detected but ignored, leaving the system in an inconsistent or vulnerable state. |
| CWE-391 | Unchecked Error Condition | This vulnerability occurs when a program fails to properly check or handle error conditions, such as exceptions or return codes. By ignoring these failures, the software can enter an unexpected state that attackers might exploit, often without any logging or user notification. |
| CWE-392 | Missing Report of Error Condition | This vulnerability occurs when a system fails to properly signal that an error has happened. Instead of returning a clear error code, status, or exception, the software continues as if nothing went wrong, leaving other components unaware of the failure. |
| CWE-393 | Return of Wrong Status Code | This vulnerability occurs when a function returns an inaccurate status code or value that misrepresents the actual outcome of an operation. This false signal can cause the application to behave in unexpected and potentially insecure ways. |
| CWE-394 | Unexpected Status Code or Return Value | This vulnerability occurs when software fails to properly validate the full range of possible return values from a function or system call. While a returned value might be technically valid for that operation, the application doesn't anticipate or handle it correctly, leading to unexpected behavior. |
| CWE-395 | Use of NullPointerException Catch to Detect NULL Pointer Dereference | Using a try-catch block for NullPointerException as a substitute for proper null checks is an anti-pattern. This approach masks the root cause of null pointer dereferences instead of preventing them, leading to unstable and difficult-to-debug code. |
| CWE-396 | Declaration of Catch for Generic Exception | This weakness occurs when code catches a generic exception type like 'Exception' or 'Throwable', which can hide specific errors and create insecure error handling logic. |
| CWE-397 | Declaration of Throws for Generic Exception | This vulnerability occurs when a method is declared to throw an overly broad exception type, such as a generic 'Exception' or 'Throwable'. This practice masks the specific error conditions that can occur, making it difficult for calling code to handle failures appropriately. |
| CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | This vulnerability occurs when an application accepts user input containing a Windows UNC share path (like '\\UNC\share\name') without proper validation, allowing attackers to redirect file operations to unintended network locations or arbitrary files. |
| CWE-400 | Uncontrolled Resource Consumption | This vulnerability occurs when an application fails to properly manage a finite resource, allowing an attacker to exhaust it and cause a denial of service. |
| CWE-401 | Missing Release of Memory after Effective Lifetime | This vulnerability occurs when a program allocates memory but fails to properly release it after it's no longer needed, causing a gradual accumulation of unused memory that can't be reclaimed by the system. |
| CWE-402 | Transmission of Private Resources into a New Sphere ('Resource Leak') | This vulnerability occurs when an application unintentionally exposes internal resources, like files, memory, or database connections, to unauthorized users or systems. Essentially, it's a type of resource leak where sensitive assets cross a security boundary. |
| CWE-403 | Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') | This vulnerability occurs when a parent process launches a child process without first closing sensitive file descriptors. The child process inherits these open handles, potentially gaining unauthorized access to files, sockets, or other resources it shouldn't be able to interact with. |
| CWE-404 | Improper Resource Shutdown or Release | This vulnerability occurs when a program fails to properly close or release a system resource—like a file handle, database connection, or memory block—after it's no longer needed, preventing its reuse. |
| CWE-405 | Asymmetric Resource Consumption (Amplification) | This vulnerability occurs when a system allows an attacker to trigger a disproportionate amount of resource consumption—like CPU, memory, or bandwidth—with minimal effort on their part. The attacker's small input causes a large, inefficient output, creating an unfair 'asymmetric' advantage. |
| CWE-406 | Insufficient Control of Network Message Volume (Network Amplification) | This vulnerability occurs when a system fails to properly limit the amount of network traffic it can generate in response to a request, allowing an attacker to abuse it to send a disproportionately large volume of data. |
| CWE-407 | Inefficient Algorithmic Complexity | This vulnerability occurs when a software component uses an algorithm with poor worst-case performance. An attacker can exploit this by providing specially crafted input that forces the algorithm into its slowest possible execution path, leading to severe performance degradation or denial of service. |
| CWE-408 | Incorrect Behavior Order: Early Amplification | This vulnerability occurs when a system allows a user to trigger a resource-intensive operation before verifying their identity or checking their permissions. |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | This vulnerability occurs when software fails to safely process highly compressed data, where a small input file can trigger the creation of an extremely large amount of data during decompression, overwhelming system resources. |
| CWE-41 | Improper Resolution of Path Equivalence | This vulnerability occurs when an application fails to properly handle different text representations that refer to the same file or directory on the system. Attackers can use special characters or alternative naming conventions to bypass security checks and access restricted files. |
| CWE-410 | Insufficient Resource Pool | This vulnerability occurs when a system's resource pool is too small to handle maximum usage. Attackers can exploit this by making a high volume of requests, consuming all available resources and blocking legitimate users. |
| CWE-412 | Unrestricted Externally Accessible Lock | This vulnerability occurs when a system correctly checks for a lock's existence, but an unauthorized external actor can control or influence that lock. |
| CWE-413 | Improper Resource Locking | This vulnerability occurs when an application fails to properly lock a shared resource, such as a file or memory location, before performing operations that require exclusive access. |
| CWE-414 | Missing Lock Check | This vulnerability occurs when software fails to verify that a proper synchronization lock is active before accessing or modifying a shared resource, potentially leading to race conditions and data corruption. |
| CWE-415 | Double Free | A double free vulnerability occurs when a program mistakenly calls the 'free()' function twice on the same block of memory. |
| CWE-416 | Use After Free | Use After Free happens when a program continues to use a pointer to a memory location after that memory has been freed. This can lead to unpredictable behavior, crashes, or security vulnerabilities because the freed memory may have been reallocated for a different purpose. |
| CWE-419 | Unprotected Primary Channel | This vulnerability occurs when an application exposes a privileged administrative interface or restricted functionality through a primary channel (like a specific port, endpoint, or protocol) without implementing adequate security controls to protect it. |
| CWE-42 | Path Equivalence: 'filename.' (Trailing Dot) | This vulnerability occurs when a system accepts file or directory paths that end with a dot (like 'file.txt.' or 'folder.') without properly checking them. Attackers can exploit this to bypass security checks, potentially accessing files or directories they shouldn't be able to reach. |
| CWE-420 | Unprotected Alternate Channel | This vulnerability occurs when an application secures its main communication path but leaves a backup or alternative channel with weaker or no protection. |
| CWE-421 | Race Condition During Access to Alternate Channel | A race condition occurs when an application opens a secondary communication channel intended for an authorized user, but fails to secure it, allowing other actors to potentially access it first. |
| CWE-422 | Unprotected Windows Messaging Channel ('Shatter') | This vulnerability, often called a 'Shatter' attack, occurs when a Windows application running with high privileges accepts messages from the Windows messaging system without verifying their source. This allows a less-privileged or malicious application to send commands directly to the privileged application, potentially hijacking its functionality. |
| CWE-423 | DEPRECATED: Proxied Trusted Channel | This entry is no longer active. It was merged into CWE-441 (The 'Proxied Trusted Channel' weakness) to eliminate duplication. Please refer to CWE-441 for all related information. |
| CWE-424 | Improper Protection of Alternate Path | This vulnerability occurs when an application fails to secure every possible route a user could take to reach sensitive features or data, leaving backdoors or unintended access points open. |
| CWE-425 | Direct Request ('Forced Browsing') | This vulnerability occurs when a web application fails to verify user permissions for every protected page, file, or API endpoint, allowing attackers to access them directly. |
| CWE-426 | Untrusted Search Path | This vulnerability occurs when an application relies on an external search path, provided by a user or environment, to find and load critical resources like executables or libraries. Because the application does not fully control this path, an attacker can manipulate it to point to malicious files. |
| CWE-427 | Uncontrolled Search Path Element | This vulnerability occurs when an application searches for critical files like libraries or executables using a predefined list of directories, but one or more of those directories can be manipulated by an unauthorized user. |
| CWE-428 | Unquoted Search Path or Element | This vulnerability occurs when a program uses a file path or command that contains spaces and is not enclosed in quotes. The operating system may misinterpret where the executable file is located, potentially allowing an attacker to run a malicious program with higher privileges. |
| CWE-43 | Path Equivalence: 'filename....' (Multiple Trailing Dot) | This vulnerability occurs when an application accepts file or directory paths containing multiple trailing dots (like 'file....') without proper validation. Attackers can exploit this to bypass security checks, potentially accessing files or directories outside the intended scope. |
| CWE-430 | Deployment of Wrong Handler | This vulnerability occurs when a system incorrectly assigns or routes an object to the wrong processing component. |
| CWE-431 | Missing Handler | This vulnerability occurs when a software component lacks the necessary code to properly handle an error or unexpected event. |
| CWE-432 | Dangerous Signal Handler not Disabled During Sensitive Operations | This vulnerability occurs when a program's signal handler, which shares resources like global variables with other handlers, can be interrupted and re-entered before it finishes its work. The program fails to block other signals during this sensitive operation, leaving shared state vulnerable to corruption. |
| CWE-433 | Unparsed Raw Web Content Delivery | This vulnerability occurs when a web application stores unprocessed files—like configuration scripts or raw source code—in publicly accessible directories using file extensions the server doesn't recognize. |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | This vulnerability occurs when an application accepts file uploads without properly restricting the file types, allowing attackers to upload and execute malicious files on the server. |
| CWE-435 | Improper Interaction Between Multiple Correctly-Behaving Entities | This weakness occurs when individually secure components interact in unexpected ways within a larger system, creating new security flaws that weren't present in isolation. |
| CWE-436 | Interpretation Conflict | An interpretation conflict occurs when two systems process the same data or sequence of events differently, leading one system to make incorrect decisions based on its flawed understanding of the other's state. |
| CWE-437 | Incomplete Model of Endpoint Features | This vulnerability occurs when a security product, proxy, or monitoring system sits between endpoints but lacks a full understanding of what those endpoints can do or their current state. Because it's working with incomplete information, it can make wrong decisions, allowing malicious traffic to pass or incorrectly blocking legitimate requests. |
| CWE-439 | Behavioral Change in New Version or Environment | This vulnerability occurs when a component's behavior unexpectedly changes after an update or when deployed to a different environment, and the systems or users depending on it are unaware of and cannot manage this change. |
| CWE-44 | Path Equivalence: 'file.name' (Internal Dot) | This vulnerability occurs when an application accepts file paths containing internal dots (like 'file.ordir') without properly checking them. Attackers can exploit this to bypass security checks, traverse directories, and access sensitive files or system areas they shouldn't be able to reach. |
| CWE-440 | Expected Behavior Violation | This weakness occurs when a software component, such as a function, API, or feature, fails to act as documented or intended. The system's actual behavior deviates from its promised specification, leading to unpredictable results. |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | A confused deputy vulnerability occurs when a system receives a request from a client and forwards it to an external destination without properly identifying the original source. This makes the system appear to be the originator of the request, effectively turning it into an unintended proxy for the client. |
| CWE-443 | DEPRECATED: HTTP response splitting | This entry has been deprecated and consolidated into CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting'). |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | This weakness occurs when a proxy, firewall, or other intermediary HTTP agent interprets a malformed HTTP request or response differently than the final destination server or client. This inconsistency allows an attacker to craft messages that bypass the intermediary's security checks. |
| CWE-446 | UI Discrepancy for Security Feature | This vulnerability occurs when a user interface incorrectly displays a security feature as active or properly configured, misleading users into believing they are protected when they are not. |
| CWE-447 | Unimplemented or Unsupported Feature in UI | This vulnerability occurs when a user interface displays a security feature as active and functional, but the underlying code that powers it is either missing or disabled. Users receive visual confirmation that a protection is in place, creating a false sense of security. |
| CWE-448 | Obsolete Feature in UI | This vulnerability occurs when a user interface (UI) includes outdated or deprecated features, but fails to alert users about their obsolete status. This can mislead users into relying on functionality that may be broken, unsupported, or pose a security risk. |
| CWE-449 | The UI Performs the Wrong Action | This vulnerability occurs when a user interface (UI) element or command performs a different, unintended action than what the user requested, potentially leading to security bypass, data corruption, or unexpected system behavior. |
| CWE-45 | Path Equivalence: 'file...name' (Multiple Internal Dot) | This vulnerability occurs when an application accepts file paths containing sequences of multiple internal dots (like 'file...name') without proper validation. Attackers can exploit this ambiguity to bypass security checks, traverse directories, and access sensitive files or system areas they shouldn't be able to reach. |
| CWE-450 | Multiple Interpretations of UI Input | This vulnerability occurs when a user interface can interpret the same input in multiple ways, but automatically chooses a less secure option without warning the user. |
| CWE-451 | User Interface (UI) Misrepresentation of Critical Information | This vulnerability occurs when a user interface fails to accurately display or highlight crucial information, potentially misleading users about the true state of the system or the source of data. Attackers exploit this weakness to trick users into performing unintended actions, often as part of phishing campaigns or other deception-based attacks. |
| CWE-453 | Insecure Default Variable Initialization | This vulnerability occurs when software sets an internal variable to an insecure or unnecessarily weak default value during initialization, rather than using the most secure option available. |
| CWE-454 | External Initialization of Trusted Variables or Data Stores | This vulnerability occurs when an application sets up its critical internal variables or storage systems using data from untrusted, external sources that an attacker could control. |
| CWE-455 | Non-exit on Failed Initialization | This vulnerability occurs when software continues to run as normal after encountering a critical security failure during its startup process. Instead of halting or entering a safe mode, the application proceeds with weakened or missing security controls, leaving it exposed. |
| CWE-456 | Missing Initialization of a Variable | This vulnerability occurs when a program uses a variable before giving it a starting value, causing the software to rely on unpredictable data left over in memory. |
| CWE-457 | Use of Uninitialized Variable | This vulnerability occurs when a program accesses a variable before it has been assigned a value, leading to unpredictable behavior and potential security risks. |
| CWE-458 | DEPRECATED: Incorrect Initialization | This CWE entry has been retired. Its original description overlapped with another vulnerability (CWE-454), while its name pointed to a broader category of initialization issues. For guidance on improper initialization problems, please see CWE-665. |
| CWE-459 | Incomplete Cleanup | This vulnerability occurs when an application fails to properly remove temporary files, data structures, or system resources after they are no longer needed. |
| CWE-46 | Path Equivalence: 'filename ' (Trailing Space) | This vulnerability occurs when an application processes file paths that end with a space character (like 'document.txt ') without properly normalizing or rejecting them. Because many operating systems ignore trailing spaces in paths, this can cause the application to resolve the path differently than intended, potentially allowing attackers to access unauthorized files or directories. |
| CWE-460 | Improper Cleanup on Thrown Exception | This vulnerability occurs when a program fails to properly restore its state or release resources after an exception is thrown, leaving the application in an inconsistent or unexpected condition. |
| CWE-462 | Duplicate Key in Associative List (Alist) | This vulnerability occurs when an associative list (alist) contains duplicate keys, which can cause unexpected behavior when software incorrectly handles or interprets these duplicates. |
| CWE-463 | Deletion of Data Structure Sentinel | This vulnerability occurs when a program accidentally removes or corrupts a special marker used to define the boundaries of a data structure, leading to logic errors and unexpected behavior. |
| CWE-464 | Addition of Data Structure Sentinel | This vulnerability occurs when a program unintentionally adds or modifies a special marker, known as a sentinel, within a data structure, leading to critical logic errors. |
| CWE-466 | Return of Pointer Value Outside of Expected Range | This vulnerability occurs when a function returns a memory pointer that points outside the expected buffer range, potentially exposing unrelated memory or causing crashes. |
| CWE-467 | Use of sizeof() on a Pointer Type | This vulnerability occurs when a developer uses the sizeof() operator on a pointer variable instead of the data it points to, leading to incorrect size calculations and potential buffer overflows or underflows. |
| CWE-468 | Incorrect Pointer Scaling | This vulnerability occurs when a programmer incorrectly accounts for pointer arithmetic in C or C++, causing the program to access unintended memory locations. The core issue is forgetting that adding an integer to a pointer automatically scales that integer by the size of the data type it points to. |
| CWE-469 | Use of Pointer Subtraction to Determine Size | This vulnerability occurs when a program calculates a size or offset by subtracting two memory pointers, but the pointers point to locations in different memory blocks, leading to an incorrect and potentially dangerous result. |
| CWE-47 | Path Equivalence: ' filename' (Leading Space) | This vulnerability occurs when an application accepts file or directory paths that begin with a space character (like ' filename'), without properly normalizing or validating the input. This can trick the file system's resolution logic, potentially allowing attackers to access unauthorized files or directories outside the intended scope. |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | This vulnerability occurs when an application uses unvalidated external input, like a URL parameter or form field, to dynamically decide which class to load or which method to execute via reflection. An attacker can manipulate this input to force the application to load unexpected, potentially malicious code. |
| CWE-471 | Modification of Assumed-Immutable Data (MAID) | This vulnerability occurs when an application fails to protect data it assumes cannot be changed, allowing an attacker to alter it. |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | This vulnerability occurs when a web application incorrectly trusts data that appears to be fixed or hidden from the user, such as values in hidden form fields, cookies, or URL parameters. Because this data is actually controllable by the client, attackers can modify it to bypass security checks or corrupt application logic. |
| CWE-473 | PHP External Variable Modification | This vulnerability occurs when a PHP application fails to properly validate or sanitize variables that originate from outside the application, such as HTTP query strings, cookies, or POST data. Attackers can exploit this to inject unexpected values, altering the program's logic and security controls. |
| CWE-474 | Use of Function with Inconsistent Implementations | This vulnerability occurs when code relies on a function whose behavior changes across different operating systems or versions, leading to unpredictable security risks when the software runs in an unexpected environment. |
| CWE-475 | Undefined Behavior for Input to API | This API function exhibits unpredictable or undefined behavior when its control parameter is not set to the exact, required value. |
| CWE-476 | NULL Pointer Dereference | This vulnerability occurs when a program attempts to access or manipulate memory using a pointer that is set to NULL, causing a crash or unexpected behavior. |
| CWE-477 | Use of Obsolete Function | This vulnerability occurs when code relies on deprecated or obsolete functions, indicating outdated practices and insufficient maintenance that can introduce security gaps. |
| CWE-478 | Missing Default Case in Multiple Condition Expression | This vulnerability occurs when code with multiple conditional branches, like a switch statement, lacks a default case to handle unexpected values. |
| CWE-479 | Signal Handler Use of a Non-reentrant Function | This vulnerability occurs when a signal handler in your code calls a function that is not safe to re-enter. If that function is interrupted and called again before it finishes, it can corrupt memory and crash your program or create security weaknesses. |
| CWE-48 | Path Equivalence: 'file name' (Internal Whitespace) | This vulnerability occurs when an application accepts file paths containing internal spaces (like 'file name') without proper validation. Attackers can exploit this ambiguity to bypass security checks, potentially accessing files or directories outside the intended scope. |
| CWE-480 | Use of Incorrect Operator | This vulnerability occurs when a developer mistakenly uses the wrong operator in their code, leading to unintended and potentially insecure logic. |
| CWE-481 | Assigning instead of Comparing | This flaw occurs when a developer accidentally uses the assignment operator (=) instead of the comparison operator (== or ===). The code assigns a value when it was meant to check for equality, which fundamentally changes the program's logic. |
| CWE-482 | Comparing instead of Assigning | This vulnerability occurs when a developer accidentally uses a comparison operator (like '==') where an assignment operator (like '=') was intended, creating a logic error instead of setting a value. |
| CWE-483 | Incorrect Block Delimitation | This vulnerability occurs when a developer fails to use explicit braces or delimiters to group multiple statements within a block, leading to unexpected program logic. |
| CWE-484 | Omitted Break Statement in Switch | This vulnerability occurs when a developer forgets to include a 'break' statement inside a switch-case block. Without it, the code execution 'falls through' and unintentionally runs the logic for subsequent cases, leading to unexpected behavior. |
| CWE-486 | Comparison of Classes by Name | This vulnerability occurs when an application determines an object's trustworthiness or behavior solely by checking its class name. Since multiple classes can share identical names across different packages or classloaders, this comparison can lead to using the wrong, potentially malicious, class. |
| CWE-487 | Reliance on Package-level Scope | This weakness occurs when a Java application mistakenly treats package-level access as a security boundary, assuming it can prevent unauthorized access to code. |
| CWE-488 | Exposure of Data Element to Wrong Session | This vulnerability occurs when an application fails to properly isolate data between different user sessions, allowing information from one user's session to leak into another's. |
| CWE-489 | Active Debug Code | This vulnerability occurs when software is deployed to production with debugging or diagnostic features still enabled and accessible. |
| CWE-49 | Path Equivalence: 'filename/' (Trailing Slash) | This vulnerability occurs when an application accepts file or directory paths that end with a slash (e.g., 'documents/') without properly normalizing them. This can confuse the system's path resolution logic, potentially allowing an attacker to bypass security checks and access files or directories they shouldn't. |
| CWE-491 | Public cloneable() Method Without Final ('Object Hijack') | This vulnerability occurs when a class implements a public clone() method without declaring it final. This allows attackers to create copies of objects without invoking their constructors, potentially leaving the cloned object in an inconsistent or insecure state. |
| CWE-492 | Use of Inner Class Containing Sensitive Data | Using inner classes to handle sensitive data can unintentionally expose that data because of how Java compiles them. The compiler transforms inner classes into separate, package-visible classes, which can bypass the intended private access restrictions. |
| CWE-493 | Critical Public Variable Without Final Modifier | This vulnerability occurs when a security-sensitive variable is declared as public but not marked as final, allowing untrusted code to unexpectedly change its value after initialization. |
| CWE-494 | Download of Code Without Integrity Check | This vulnerability occurs when an application fetches and runs code from an external source—like a remote server or CDN—without properly verifying where it came from or ensuring it hasn't been tampered with. |
| CWE-495 | Private Data Structure Returned From A Public Method | This vulnerability occurs when a public method directly returns a reference to a private, internal data structure. Because the reference is live, external callers can bypass intended controls and modify the data unexpectedly, corrupting the application's state. |
| CWE-496 | Public Data Assigned to Private Array-Typed Field | This vulnerability occurs when a developer stores sensitive data in a private array, but then assigns a publicly accessible reference to that same array. This effectively makes all the private array's contents available to unauthorized code, bypassing intended access controls. |
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | This vulnerability occurs when an application unintentionally reveals sensitive details about its underlying system, such as file paths, software versions, or environment data, to users who should not have access to that information. |
| CWE-498 | Cloneable Class Containing Sensitive Information | This vulnerability occurs when a class containing sensitive information, such as credentials or personal data, is made cloneable. Attackers can bypass normal initialization and access the sensitive data by creating a copy of the object. |
| CWE-499 | Serializable Class Containing Sensitive Data | This vulnerability occurs when a class containing sensitive information, such as credentials or personal data, is left serializable by default. Because the class does not explicitly prevent serialization, its internal data can be accessed and extracted by other parts of the application or external processes. |
| CWE-5 | J2EE Misconfiguration: Data Transmission Without Encryption | This vulnerability occurs when a J2EE application transmits sensitive data, like login credentials or session tokens, across a network without using strong encryption. Attackers monitoring the network can easily intercept, read, or even alter this information if it's sent in plain text or protected by weak cryptographic methods. |
| CWE-50 | Path Equivalence: '//multiple/leading/slash' | This vulnerability occurs when an application accepts file or directory paths containing multiple leading slashes (like '//multiple/leading/slash') without proper normalization. Attackers can exploit this ambiguity to bypass security checks, potentially accessing files or directories outside the intended scope. |
| CWE-500 | Public Static Field Not Marked Final | This vulnerability occurs when a class exposes a public static field without declaring it as final, allowing unintended modification from anywhere in the application. |
| CWE-501 | Trust Boundary Violation | This vulnerability occurs when an application incorrectly stores or processes trusted and untrusted data together within the same structure, such as an object, array, or message. |
| CWE-502 | Deserialization of Untrusted Data | This vulnerability occurs when an application accepts and processes serialized data from an untrusted source without proper validation, allowing an attacker to manipulate the data to execute malicious code or cause unexpected behavior. |
| CWE-506 | Embedded Malicious Code | This vulnerability occurs when an application or codebase contains intentionally harmful code inserted by a developer or third party. |
| CWE-507 | Trojan Horse | A Trojan Horse vulnerability occurs when software presents itself as legitimate and useful, but secretly contains malicious functionality that bypasses security controls. This hidden code operates without the user's knowledge, violating the intended security policy of the system or its administrator. |
| CWE-508 | Non-Replicating Malicious Code | This type of malicious code is designed to operate only on the specific system it initially infects. Unlike viruses or worms, it does not contain mechanisms to copy itself or spread to other devices or networks. |
| CWE-509 | Replicating Malicious Code (Virus or Worm) | This weakness describes software that is vulnerable to infection by self-replicating malicious programs like viruses or worms. Once such malware compromises a system, it can use that system as a launchpad to automatically spread and attack others. |
| CWE-51 | Path Equivalence: '/multiple//internal/slash' | This vulnerability occurs when an application accepts file or directory paths containing multiple consecutive forward slashes (e.g., '/var//www///html') without normalizing them. Attackers can exploit this ambiguity to bypass security checks and access files or directories outside the intended scope. |
| CWE-510 | Trapdoor | A trapdoor, often called a backdoor, is a hidden piece of code intentionally placed within software. It activates in response to a specific, often secret, input—like a special password or sequence—bypassing standard authentication and authorization checks to grant unauthorized access. |
| CWE-511 | Logic/Time Bomb | A logic or time bomb is malicious code intentionally placed within software to trigger harmful actions when a specific condition is met or a predetermined time is reached. |
| CWE-512 | Spyware | Spyware is software that secretly gathers personal information about a user or their activities. It does this by accessing data from other sources on the system, without the user's direct input or explicit consent. |
| CWE-514 | Covert Channel | A covert channel is a hidden communication path that allows data to be transmitted in a way that bypasses the system's intended security controls and monitoring. |
| CWE-515 | Covert Storage Channel | A covert storage channel is a type of security flaw where one process secretly encodes data into a shared system resource (like a file, memory bit, or status flag), and another unauthorized process later reads that resource to extract the hidden information. |
| CWE-516 | DEPRECATED: Covert Timing Channel | This entry has been deprecated and its content has been moved. Please refer to CWE-385: Covert Timing Channel for the current information. |
| CWE-52 | Path Equivalence: '/multiple/trailing/slash//' | This vulnerability occurs when an application accepts file or directory paths containing multiple consecutive forward slashes (like '/multiple/trailing/slash//') without normalizing them. Different systems may interpret these duplicate slashes differently, potentially allowing attackers to bypass security checks and access restricted files or directories. |
| CWE-520 | .NET Misconfiguration: Use of Impersonation | This vulnerability occurs when a .NET application is configured to run with impersonation, potentially granting it excessive system-level permissions that attackers could exploit. |
| CWE-521 | Weak Password Requirements | This vulnerability occurs when an application fails to enforce strong password policies, making user accounts easier to compromise through guessing or automated attacks. |
| CWE-522 | Insufficiently Protected Credentials | This vulnerability occurs when an application handles sensitive credentials like passwords or API keys in an insecure way, making them easy for attackers to steal during transmission or while stored. |
| CWE-523 | Unprotected Transport of Credentials | This vulnerability occurs when a login page or authentication system transmits user credentials (like usernames and passwords) over a network without proper encryption, exposing them to interception. |
| CWE-524 | Use of Cache Containing Sensitive Information | This vulnerability occurs when an application stores sensitive data in a cache that is accessible to unauthorized users or external systems. |
| CWE-525 | Use of Web Browser Cache Containing Sensitive Information | This vulnerability occurs when a web application fails to implement secure caching directives, allowing sensitive user data or pages to be stored in the browser's cache where unauthorized parties could retrieve them. |
| CWE-526 | Cleartext Storage of Sensitive Information in an Environment Variable | This vulnerability occurs when an application stores sensitive data, such as passwords or API keys, as plain text in an environment variable. |
| CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | This vulnerability occurs when a version control repository, like Git or SVN, is accidentally placed in a location accessible to unauthorized users, such as a web server directory or a public archive. |
| CWE-528 | Exposure of Core Dump File to an Unauthorized Control Sphere | This vulnerability occurs when an application creates a core dump file (a snapshot of memory at the time of a crash) and places it in a location accessible to unauthorized users or systems. |
| CWE-529 | Exposure of Access Control List Files to an Unauthorized Control Sphere | This vulnerability occurs when an application stores sensitive access control list (ACL) files in a location that is accessible to unauthorized users or systems. |
| CWE-53 | Path Equivalence: '\multiple\\internal\backslash' | This vulnerability occurs when an application accepts file paths containing sequences of multiple internal backslashes (like '\multiple\\internal\\backslash') without properly normalizing them. This can confuse the system's path resolution logic, potentially allowing attackers to access files or directories outside the intended scope. |
| CWE-530 | Exposure of Backup File to an Unauthorized Control Sphere | This vulnerability occurs when backup or temporary files are stored in locations that unauthorized users can access, such as web directories. |
| CWE-531 | Inclusion of Sensitive Information in Test Code | This vulnerability occurs when sensitive data, such as credentials, API keys, or internal logic, is embedded within test code or debugging applications that remain accessible in production environments. Attackers can discover and exploit these forgotten endpoints to gain unauthorized access or gather critical intelligence about the system. |
| CWE-532 | Insertion of Sensitive Information into Log File | This vulnerability occurs when an application unintentionally writes confidential data, such as passwords or API keys, into its log files. |
| CWE-533 | DEPRECATED: Information Exposure Through Server Log Files | This entry has been deprecated. Its scope was too narrow, focusing on a specific symptom rather than the root cause. Please refer to CWE-532: Insertion of Sensitive Information into Log File for the current, more comprehensive guidance. |
| CWE-534 | DEPRECATED: Information Exposure Through Debug Log Files | This deprecated entry describes a vulnerability where sensitive application data is unintentionally written to debug log files, potentially exposing it to unauthorized users. It has been consolidated into the broader CWE-532: Information Exposure Through Log Files. |
| CWE-535 | Exposure of Information Through Shell Error Message | This vulnerability occurs when a web application's command shell returns detailed error messages to users. Attackers can analyze these messages to understand the underlying system, identify weaknesses, and potentially gain unauthorized access. |
| CWE-536 | Servlet Runtime Error Message Containing Sensitive Information | This vulnerability occurs when a Java servlet application displays detailed runtime error messages that reveal sensitive information about the application's internal structure, such as stack traces, file paths, or database queries. These unhandled exception details can give attackers critical insights to craft further exploits. |
| CWE-537 | Java Runtime Error Message Containing Sensitive Information | This vulnerability occurs when a Java application's runtime error messages reveal sensitive details about the system, such as file paths, internal IP addresses, or stack traces. Attackers can exploit these overly informative error messages to map the application's structure and gather intelligence for further attacks. |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | This vulnerability occurs when an application unintentionally stores confidential data—like passwords, API keys, or personal user details—in a location that is publicly accessible or readable by unauthorized users. Even if the file itself is intended to be available, the sensitive information within it should not be. |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | This vulnerability occurs when a web application stores sensitive data, like authentication details or personal information, within persistent cookies that remain on a user's device. |
| CWE-54 | Path Equivalence: 'filedir\' (Trailing Backslash) | This vulnerability occurs when an application accepts file or directory paths that end with a backslash (like 'filedir\') without properly normalizing or validating them. This trailing backslash can cause the system to interpret the path ambiguously, potentially allowing attackers to bypass security checks and access files or directories outside the intended scope. |
| CWE-540 | Inclusion of Sensitive Information in Source Code | This vulnerability occurs when sensitive information like passwords, API keys, or internal logic is exposed within source code that remains accessible on a web server or in a public repository. |
| CWE-541 | Inclusion of Sensitive Information in an Include File | This vulnerability occurs when sensitive data like passwords or system details is placed inside a publicly accessible include file. Attackers can directly request these files to steal credentials and compromise the application. |
| CWE-542 | DEPRECATED: Information Exposure Through Cleanup Log Files | This entry has been deprecated because it was too specific. Please refer to the broader and more comprehensive CWE-532: Information Exposure Through Log Files for current guidance. |
| CWE-543 | Use of Singleton Pattern Without Synchronization in a Multithreaded Context | This vulnerability occurs when a singleton pattern is implemented in a multithreaded application without proper synchronization, potentially leading to multiple instances or corrupted state. |
| CWE-544 | Missing Standardized Error Handling Mechanism | This weakness occurs when software lacks a unified, consistent approach to managing errors across its codebase, leading to unpredictable security gaps and unreliable behavior. |
| CWE-545 | DEPRECATED: Use of Dynamic Class Loading | This entry has been retired. Its content is now covered elsewhere, primarily because it described a standard programming technique rather than a specific vulnerability and overlapped with other existing weakness entries. |
| CWE-546 | Suspicious Comment | This weakness occurs when code contains comments that flag potential issues, such as bugs, security gaps, or unfinished work, which can expose underlying problems or oversights. |
| CWE-547 | Use of Hard-coded, Security-relevant Constants | This vulnerability occurs when code directly embeds security-critical values like passwords, cryptographic keys, or access levels as raw numbers or strings, instead of using named constants or configuration files. This practice makes the code brittle and error-prone during updates or security reviews. |
| CWE-548 | Exposure of Information Through Directory Listing | This vulnerability occurs when a web server is misconfigured to display a full list of files within a directory instead of serving a default web page, unintentionally exposing sensitive resources to anyone who visits the URL. |
| CWE-549 | Missing Password Field Masking | This vulnerability occurs when an application fails to hide password characters as they are typed, making them visible to anyone who can see the screen. This exposes user credentials to onlookers or screen-capturing malware. |
| CWE-55 | Path Equivalence: '/./' (Single Dot Directory) | This vulnerability occurs when an application accepts file paths containing '/./' (single dot directory) sequences without proper validation. Attackers can exploit this to bypass intended directory structures, potentially accessing sensitive files or navigating to unauthorized locations within the file system. |
| CWE-550 | Server-generated Error Message Containing Sensitive Information | This vulnerability occurs when a web application or server returns detailed error messages that reveal sensitive internal information about the system. |
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | This vulnerability occurs when a web server checks access permissions before fully processing and normalizing a URL, potentially allowing attackers to bypass security controls. |
| CWE-552 | Files or Directories Accessible to External Parties | This vulnerability occurs when an application exposes files or directories to users who shouldn't have access to them. |
| CWE-553 | Command Shell in Externally Accessible Directory | This vulnerability occurs when a command shell script is placed in a web-accessible directory, such as /cgi-bin/. Attackers can directly request this file to execute arbitrary commands on the server, leading to full system compromise. |
| CWE-554 | ASP.NET Misconfiguration: Not Using Input Validation Framework | This vulnerability occurs when an ASP.NET application fails to implement a structured input validation framework, relying instead on ad-hoc or missing validation checks. |
| CWE-555 | J2EE Misconfiguration: Plaintext Password in Configuration File | A J2EE application insecurely stores an unprotected password within a configuration file. |
| CWE-556 | ASP.NET Misconfiguration: Use of Identity Impersonation | This vulnerability occurs when an ASP.NET application is configured to run using impersonated credentials, which can grant the application excessive and unnecessary system privileges. |
| CWE-558 | Use of getlogin() in Multithreaded Application | Using the getlogin() function in a multithreaded application can lead to unreliable or incorrect username results, creating security and logic flaws. |
| CWE-56 | Path Equivalence: 'filedir*' (Wildcard) | This vulnerability occurs when an application accepts file or directory paths containing an asterisk wildcard ('*') without proper validation. Attackers can exploit this to bypass intended access controls, potentially reading, writing, or executing files in unauthorized locations. |
| CWE-560 | Use of umask() with chmod-style Argument | This vulnerability occurs when a program incorrectly uses the `umask()` system call with an argument formatted for `chmod()`, leading to unintended and overly permissive file permissions. |
| CWE-561 | Dead Code | Dead code refers to sections of a program that can never run during normal execution, effectively making them inactive and unreachable. |
| CWE-562 | Return of Stack Variable Address | This vulnerability occurs when a function returns a pointer to its own local variable. Since that variable's memory is on the stack, the pointer becomes invalid as soon as the function finishes, leading to crashes or unpredictable behavior. |
| CWE-563 | Assignment to Variable without Use | This vulnerability occurs when a value is stored in a variable, but that variable is never read or used in subsequent code, creating a 'dead store.' |
| CWE-564 | SQL Injection: Hibernate | This vulnerability occurs when an application uses Hibernate to construct dynamic SQL queries with unsanitized user input, allowing an attacker to alter the query's logic or execute unauthorized SQL commands. |
| CWE-565 | Reliance on Cookies without Validation and Integrity Checking | This vulnerability occurs when an application uses cookies to make security decisions—like granting access or changing settings—but fails to verify that the cookie data is legitimate, unaltered, and belongs to the current user. |
| CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | This vulnerability occurs when an application allows a user to directly control the primary key value used in a SQL query, enabling them to access database records they are not authorized to view. |
| CWE-567 | Unsynchronized Access to Shared Data in a Multithreaded Context | This vulnerability occurs when multiple threads in an application can read and modify shared data, like static variables, without proper coordination. This unsynchronized access corrupts data, causes crashes, and leads to unpredictable, often security-critical, behavior. |
| CWE-568 | finalize() Method Without super.finalize() | This vulnerability occurs when a Java class overrides the finalize() method but fails to call super.finalize() within it. |
| CWE-57 | Path Equivalence: 'fakedir/../realdir/filename' | This vulnerability occurs when an application uses external input to build file paths, allowing attackers to bypass access controls. By submitting a path like 'fakedir/../realdir/filename', they can navigate out of a restricted directory ('fakedir') and into a protected one ('realdir'), accessing files the security mechanisms were designed to block. |
| CWE-570 | Expression is Always False | This vulnerability occurs when code contains a conditional expression that can never evaluate to true, causing a section of the program to be permanently unreachable. |
| CWE-571 | Expression is Always True | This vulnerability occurs when code contains a conditional expression that will always evaluate to 'true', making the check ineffective and potentially bypassing critical security or logic gates. |
| CWE-572 | Call to Thread run() instead of start() | This vulnerability occurs when a program incorrectly calls a thread's `run()` method directly, instead of using the `start()` method. This mistake causes the thread's code to execute within the caller's current thread, bypassing the creation of a new, concurrent thread of execution. |
| CWE-573 | Improper Following of Specification by Caller | This weakness occurs when software fails to properly follow the documented rules, protocols, or requirements of an external component it uses, such as a library, API, framework, or platform. |
| CWE-574 | EJB Bad Practices: Use of Synchronization Primitives | This vulnerability occurs when an Enterprise JavaBeans (EJB) component improperly uses thread synchronization primitives, violating the EJB specification's design principles. |
| CWE-575 | EJB Bad Practices: Use of AWT Swing | This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses AWT or Swing UI toolkits, violating the EJB specification's design principles. |
| CWE-576 | EJB Bad Practices: Use of Java I/O | This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses Java I/O (java.io) operations to access the file system, violating the EJB specification's design principles. |
| CWE-577 | EJB Bad Practices: Use of Sockets | This vulnerability occurs when an Enterprise JavaBeans (EJB) component breaks the EJB specification by directly creating or using network sockets. |
| CWE-578 | EJB Bad Practices: Use of Class Loader | This vulnerability occurs when an Enterprise JavaBeans (EJB) component directly manipulates the Java class loader, violating the EJB specification's security and portability rules. |
| CWE-579 | J2EE Bad Practices: Non-serializable Object Stored in Session | This vulnerability occurs when a Java application stores an object in the user's session that cannot be serialized, which can break critical application features and hurt reliability. |
| CWE-58 | Path Equivalence: Windows 8.3 Filename | This vulnerability occurs when an application's security controls successfully block access to a file's full name on Windows, but fail to protect the shorter 8.3 format version of the same filename, creating a bypassable loophole. |
| CWE-580 | clone() Method Without super.clone() | This vulnerability occurs when a class's clone() method creates a new object directly instead of calling super.clone(). |
| CWE-581 | Object Model Violation: Just One of Equals and Hashcode Defined | This vulnerability occurs when a Java class defines either the equals() method or the hashCode() method, but not both, breaking a fundamental contract of object equality. |
| CWE-582 | Array Declared Public, Final, and Static | This vulnerability occurs when an array is declared as public, final, and static, which does not protect the data inside the array from being altered. |
| CWE-583 | finalize() Method Declared Public | This vulnerability occurs when a Java class declares its finalize() method as public, violating secure coding practices for mobile code. |
| CWE-584 | Return Inside Finally Block | This vulnerability occurs when a function places a return statement inside a finally block. This dangerous pattern silently discards any unhandled exceptions thrown earlier in the try block, making errors invisible and undermining application stability. |
| CWE-585 | Empty Synchronized Block | An empty synchronized block is a Java code construct where a synchronized block exists but contains no executable statements inside it. |
| CWE-586 | Explicit Call to Finalize() | This vulnerability occurs when code directly calls an object's finalize() method from outside its designated finalizer context. |
| CWE-587 | Assignment of a Fixed Address to a Pointer | This vulnerability occurs when code explicitly assigns a hardcoded memory address to a pointer, instead of using a dynamic or null value. |
| CWE-588 | Attempt to Access Child of a Non-structure Pointer | This vulnerability occurs when code incorrectly treats a pointer to a basic data type (like an integer) as if it points to a structured object (like a 'struct' in C). The program then tries to access a member field that doesn't exist at that memory location, which can cause crashes or corrupt adjacent data. |
| CWE-589 | Call to Non-ubiquitous API | This vulnerability occurs when software relies on an operating system function that isn't available on all versions of the target platform. This can cause crashes, unexpected behavior, or security failures when the software runs in an environment where the API is missing. |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | This vulnerability occurs when an application uses a filename to access a file but fails to properly check if that name points to a symbolic link, shortcut, or junction. This allows an attacker to manipulate the link's target, causing the application to read or write to an unintended, potentially sensitive location. |
| CWE-590 | Free of Memory not on the Heap | This vulnerability occurs when a program calls free() on a memory pointer that wasn't originally allocated using standard heap functions like malloc(), calloc(), or realloc(). |
| CWE-591 | Sensitive Data Storage in Improperly Locked Memory | This vulnerability occurs when an application stores sensitive information, like passwords or encryption keys, in system memory that isn't properly secured from being written to disk. If the memory isn't locked, the operating system's virtual memory manager can swap it to a page or swap file, leaving the data exposed on the storage drive where attackers could potentially recover it. |
| CWE-592 | DEPRECATED: Authentication Bypass Issues | This entry has been retired because its core concept—authentication bypass vulnerabilities—is fully covered by CWE-287: Improper Authentication. It was removed to eliminate redundancy and streamline the CWE list. |
| CWE-593 | Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created | This vulnerability occurs when an application modifies an OpenSSL context object after it has already been used to create active SSL/TLS connections. |
| CWE-594 | J2EE Framework: Saving Unserializable Objects to Disk | This vulnerability occurs when a J2EE application framework attempts to save objects to disk that cannot be properly serialized, risking application failure. |
| CWE-595 | Comparison of Object References Instead of Object Contents | This vulnerability occurs when code incorrectly checks if two object references point to the same memory location, rather than comparing the actual data or values contained within the objects. This mistake prevents the software from correctly identifying when two separate objects hold equivalent content. |
| CWE-596 | DEPRECATED: Incorrect Semantic Object Comparison | This CWE entry has been retired. It was originally created to describe a specific type of bug where code incorrectly compares two objects that should be considered the same, but the description was too vague and overlapped with other weaknesses. It has been consolidated into CWE-1023. |
| CWE-597 | Use of Wrong Operator in String Comparison | This vulnerability occurs when a developer incorrectly compares string values, typically by using reference equality operators (like == or !=) instead of dedicated string comparison methods (like .equals()). |
| CWE-598 | Use of GET Request Method With Sensitive Query Strings | This vulnerability occurs when a web application handles sensitive data, like passwords or session tokens, by passing them within the URL's query string using an HTTP GET request. |
| CWE-599 | Missing Validation of OpenSSL Certificate | This vulnerability occurs when an application uses OpenSSL but fails to properly verify server certificates by not calling SSL_get_verify_result(). Without this validation, the application may accept insecure or fraudulent certificates. |
| CWE-6 | J2EE Misconfiguration: Insufficient Session-ID Length | This vulnerability occurs when a J2EE application uses session identifiers that are too short, making them easier for attackers to predict or capture. |
| CWE-600 | Uncaught Exception in Servlet | This vulnerability occurs when a Java Servlet fails to properly catch and handle exceptions, potentially exposing sensitive system information in error messages. |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | An open redirect vulnerability occurs when a web application uses unvalidated user input to determine the destination of a redirect, allowing an attacker to send users to an untrusted, external website. |
| CWE-602 | Client-Side Enforcement of Server-Side Security | This vulnerability occurs when a server incorrectly trusts the client to enforce critical security rules, such as input validation or access controls, instead of performing these checks itself. |
| CWE-603 | Use of Client-Side Authentication | This vulnerability occurs when an application places its authentication logic solely within the client-side code, such as in a mobile app or web browser, without enforcing the same checks on the server. Attackers can bypass authentication by modifying the client to skip these checks entirely. |
| CWE-605 | Multiple Binds to the Same Port | This vulnerability occurs when a system's socket configuration allows multiple applications to bind to the same network port simultaneously. This can let a malicious process hijack or impersonate legitimate services running on that port. |
| CWE-606 | Unchecked Input for Loop Condition | This vulnerability occurs when an application fails to properly validate or limit user-supplied values that control loop iterations. Without these checks, malicious input can force the program into an endless or excessively long loop, consuming system resources and leading to denial of service or application instability. |
| CWE-607 | Public Static Final Field References Mutable Object | This vulnerability occurs when a class exposes a public or protected static final field that points to a changeable object. Because the field's reference is constant but the object itself is not, malicious code or even accidental code in other packages can modify the object's contents, violating the intended immutability. |
| CWE-608 | Struts: Non-private Field in ActionForm Class | This vulnerability occurs when an Apache Struts ActionForm class exposes a field without declaring it as private. This allows other parts of the application to directly read or modify the field's data, bypassing the intended setter and getter methods. |
| CWE-609 | Double-Checked Locking | Double-checked locking is an insufficient synchronization pattern where a program checks a resource's state, acquires a lock, and checks the state again before initialization, failing to guarantee thread safety across all systems. |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | This vulnerability occurs when a software application opens files or directories without properly checking if they are symbolic links (symlinks). If an attacker can create or control a symlink, they can redirect file operations to locations outside the intended directory, potentially accessing or modifying unauthorized files. |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | This vulnerability occurs when an application uses user-supplied input to reference a resource located outside its intended security boundary, allowing attackers to redirect operations to unintended locations. |
| CWE-611 | Improper Restriction of XML External Entity Reference | This vulnerability occurs when an application processes XML input without properly restricting external entity references. Attackers can exploit this to read local files, trigger internal network requests, or cause denial of service. |
| CWE-612 | Improper Authorization of Index Containing Sensitive Information | This vulnerability occurs when a system indexes sensitive documents for search but fails to properly restrict who can query that index. Attackers can then discover and extract confidential information from the indexed content without having direct access to the original files. |
| CWE-613 | Insufficient Session Expiration | Insufficient session expiration occurs when an application allows old session tokens or IDs to remain valid for too long, letting attackers reuse them to gain unauthorized access. |
| CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | This vulnerability occurs when a web application transmits sensitive cookies over an HTTPS connection but fails to set the 'Secure' attribute on those cookies. |
| CWE-615 | Inclusion of Sensitive Information in Source Code Comments | This vulnerability occurs when developers leave sensitive details within source code comments. These can include internal file paths, hidden URLs, inactive code snippets, credentials, or other information meant for internal use only. |
| CWE-616 | Incomplete Identification of Uploaded File Variables (PHP) | This vulnerability occurs in PHP applications that rely on the deprecated, auto-registered global variables for file uploads (like $varname, $varname_size). Because these variables are not properly validated, an attacker can overwrite them to trick the application into processing malicious or unauthorized files. |
| CWE-617 | Reachable Assertion | A reachable assertion occurs when an attacker can trigger an assert() statement or similar debugging check, causing the application to crash or behave in a more disruptive way than intended. This turns a helpful development tool into a denial-of-service vulnerability. |
| CWE-618 | Exposed Unsafe ActiveX Method | This vulnerability occurs when an ActiveX control, designed for web browsers, exposes methods that bypass the browser's built-in security restrictions. These unsafe methods can perform actions outside the browser's intended security boundaries, such as those defined by zones or domains. |
| CWE-619 | Dangling Database Cursor ('Cursor Injection') | A dangling database cursor occurs when a database cursor is not properly closed, potentially allowing other users to access it while it retains its original, often elevated, privileges. |
| CWE-62 | UNIX Hard Link | This vulnerability occurs when an application opens a file or directory without verifying if the name points to a hard link that leads outside its intended security boundary. Attackers can exploit this to trick the software into accessing or modifying unauthorized system files. |
| CWE-620 | Unverified Password Change | This vulnerability occurs when an application allows a user to set a new password without first verifying their identity through the old password or a secure secondary authentication method. |
| CWE-621 | Variable Extraction Error | This vulnerability occurs when an application uses unvalidated external input to dynamically select which variables to populate with data. Without proper checks, this can allow an attacker to overwrite critical internal variables, leading to unexpected behavior or security breaches. |
| CWE-622 | Improper Validation of Function Hook Arguments | This vulnerability occurs when an application adds monitoring or interception hooks to critical functions, but fails to properly check the arguments passed to those hooks. This lack of validation can allow attackers to inject malicious data, leading to security bypasses or system compromise. |
| CWE-623 | Unsafe ActiveX Control Marked Safe For Scripting | This vulnerability occurs when an ActiveX control designed for limited use is incorrectly flagged as safe for scripting, allowing web pages to access its potentially dangerous functions. |
| CWE-624 | Executable Regular Expression Error | This vulnerability occurs when an application uses a regular expression that can execute code, either because it directly contains executable logic with unsafe user input, or because an attacker can inject pattern modifiers that enable code execution. |
| CWE-625 | Permissive Regular Expression | This weakness occurs when a regular expression is too permissive, failing to properly validate or sanitize input by allowing unintended values or patterns. |
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | This vulnerability occurs when software incorrectly processes null bytes (NUL characters) as data moves between different systems or programming languages, leading to unexpected and potentially dangerous behavior. |
| CWE-627 | Dynamic Variable Evaluation | This vulnerability occurs when an application allows user input to directly determine which variable or function name is used at runtime. Without strict validation, an attacker can manipulate these names to access or modify sensitive data, execute unauthorized functions, or disrupt the application's logic. |
| CWE-628 | Function Call with Incorrectly Specified Arguments | This weakness occurs when a function is called with arguments that are incorrectly specified, causing the function to behave in an unintended and consistently wrong manner. |
| CWE-636 | Not Failing Securely ('Failing Open') | This vulnerability occurs when a system, upon encountering an error or failure, defaults to its least secure configuration instead of a safer alternative. Examples include reverting to the weakest encryption or the most permissive access rules. |
| CWE-637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') | This weakness occurs when a security feature is implemented with excessive complexity, creating unnecessary risk. Overly intricate protection mechanisms are harder to understand, configure, and implement correctly, often leading to security gaps and misconfigurations. |
| CWE-638 | Not Using Complete Mediation | This vulnerability occurs when software fails to verify access permissions every single time a user or process tries to use a resource. Instead, it might rely on a single, outdated check, creating a security gap if the user's privileges are later revoked or changed. |
| CWE-639 | Authorization Bypass Through User-Controlled Key | This vulnerability occurs when an application's authorization system fails to verify that a user is allowed to access specific data before retrieving it, allowing an attacker to access another user's information by manipulating an identifier they control. |
| CWE-64 | Windows Shortcut Following (.LNK) | This vulnerability occurs when an application opens a file or directory without properly validating that it is a Windows shortcut (.LNK). If the shortcut's target points to a location outside the application's intended security boundary, an attacker can trick the software into accessing unauthorized files. |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | This vulnerability occurs when an application's password reset or recovery feature is poorly designed or implemented, allowing attackers to bypass authentication and hijack user accounts. |
| CWE-641 | Improper Restriction of Names for Files and Other Resources | This vulnerability occurs when an application creates file or resource names using unvalidated user input, failing to properly limit what characters or paths can be used. |
| CWE-642 | External Control of Critical State Data | This vulnerability occurs when an application stores security-sensitive state data in locations that unauthorized users can access and modify. |
| CWE-643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') | XPath Injection occurs when an application uses unvalidated user input to build an XPath query for an XML database. Without proper sanitization, attackers can manipulate the query's structure. |
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | This vulnerability occurs when an application fails to properly sanitize or escape user-controlled data placed within HTTP response headers. Malicious scripting syntax can then be injected and executed by client-side components like Flash that process raw headers. |
| CWE-645 | Overly Restrictive Account Lockout Mechanism | This vulnerability occurs when an application's account lockout feature is too strict, allowing attackers to easily trigger it and lock legitimate users out of their accounts, causing a denial of service. |
| CWE-646 | Reliance on File Name or Extension of Externally-Supplied File | This vulnerability occurs when an application uses the name or extension of an uploaded file to decide how to handle it. Attackers can manipulate this by uploading files with deceptive names, causing the application to process them incorrectly and potentially dangerously. |
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | This vulnerability occurs when an application's authorization logic relies on specific URL paths but fails to enforce a single, standardized format. Attackers can bypass access controls by using alternative, equivalent URL formats that the system doesn't recognize as the same protected resource. |
| CWE-648 | Incorrect Use of Privileged APIs | This vulnerability occurs when software incorrectly uses functions that require special permissions. Attackers can exploit these mistakes to gain unauthorized access, elevate their privileges, or steal sensitive data. |
| CWE-649 | Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking | This vulnerability occurs when an application uses obfuscation or encryption to hide security-sensitive data (like tokens or parameters) but fails to verify whether that data has been altered. Without integrity checks, the system cannot detect if an attacker has tampered with these inputs. |
| CWE-65 | Windows Hard Link | This vulnerability occurs when a Windows application opens a file or directory without properly verifying if the path points to a hard link. An attacker can exploit this by creating a hard link that redirects the application to access files outside its intended permissions, potentially leading to unauthorized data manipulation. |
| CWE-650 | Trusting HTTP Permission Methods on the Server Side | This vulnerability occurs when a server incorrectly assumes that HTTP GET requests are always safe and cannot change server-side data. Attackers can exploit this flawed assumption to bypass security controls and perform unauthorized actions like modifying or deleting resources. |
| CWE-651 | Exposure of WSDL File Containing Sensitive Information | This vulnerability occurs when a Web Service Definition Language (WSDL) file, which acts as a public blueprint for a web service, is exposed in a way that reveals sensitive information about the application's internal structure or functionality. |
| CWE-652 | Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') | XQuery Injection occurs when an application uses unvalidated user input to build an XQuery expression for querying an XML database. Without proper neutralization, an attacker can manipulate the query's structure. |
| CWE-653 | Improper Isolation or Compartmentalization | This vulnerability occurs when an application fails to enforce strong boundaries between components that operate at different security levels, allowing lower-privileged functions to improperly interact with higher-privileged ones. |
| CWE-654 | Reliance on a Single Factor in a Security Decision | This vulnerability occurs when a system's security check depends almost entirely on just one condition, object, or piece of data to decide whether to grant access to sensitive resources or actions. It's like having a single, easily compromised lock on a vault, instead of a layered defense. |
| CWE-655 | Insufficient Psychological Acceptability | This weakness occurs when security features are so cumbersome or confusing that well-intentioned users feel forced to turn them off or find workarounds, defeating their purpose entirely. |
| CWE-656 | Reliance on Security Through Obscurity | This weakness occurs when a system's primary defense relies on hiding how it works, rather than using a robust, well-tested security mechanism. If an attacker discovers the hidden details—like a secret algorithm or hardcoded key—the protection fails completely. |
| CWE-657 | Violation of Secure Design Principles | This weakness occurs when a system's architecture or design fails to follow fundamental security principles, creating a flawed foundation that can lead to multiple vulnerabilities. |
| CWE-66 | Improper Handling of File Names that Identify Virtual Resources | This vulnerability occurs when software incorrectly processes a filename that points to a 'virtual' resource—like a device, pipe, or internal system object—instead of a regular file. The application mistakenly performs file operations (like read, write, or copy) on this non-file resource, which can lead to crashes, data exposure, or unexpected system behavior. |
| CWE-662 | Improper Synchronization | This vulnerability occurs when a multi-threaded or multi-process application allows shared resources to be accessed by multiple threads or processes simultaneously, without proper safeguards to enforce exclusive access. |
| CWE-663 | Use of a Non-reentrant Function in a Concurrent Context | This vulnerability occurs when a program uses a function that is not safe for reentrancy within a concurrent environment, such as multi-threaded code or signal handlers. If another thread or signal handler interrupts and calls the same function, it can corrupt shared data, cause crashes, or create unpredictable behavior. |
| CWE-664 | Improper Control of a Resource Through its Lifetime | This vulnerability occurs when software fails to properly manage a resource throughout its entire lifecycle—from creation and active use to its final release or destruction. |
| CWE-665 | Improper Initialization | This vulnerability occurs when software fails to properly set up a resource before use, or provides incorrect starting values, leaving it in an unpredictable and potentially dangerous state. |
| CWE-666 | Operation on Resource in Wrong Phase of Lifetime | This vulnerability occurs when software interacts with a resource—like memory, a file, or a network connection—at an incorrect stage of its existence, leading to crashes, data corruption, or unpredictable behavior. |
| CWE-667 | Improper Locking | This vulnerability occurs when a program fails to correctly acquire or release a lock on a shared resource, such as a file, database record, or memory location. This improper synchronization allows other processes or threads to interfere, leading to corrupted data, crashes, or unpredictable behavior. |
| CWE-668 | Exposure of Resource to Wrong Sphere | This vulnerability occurs when an application unintentionally makes a resource accessible to users or systems that should not have permission to use it. |
| CWE-669 | Incorrect Resource Transfer Between Spheres | This vulnerability occurs when an application incorrectly moves or shares a resource (like data, permissions, or functionality) between different trust boundaries or security contexts. This improper transfer can give unintended actors control over that resource, leading to security breaches. |
| CWE-67 | Improper Handling of Windows Device Names | This vulnerability occurs when an application builds file paths from user input but fails to properly recognize or handle Windows reserved device names like AUX, CON, or COM1. Attackers can exploit this by submitting these special names, which typically causes the application to crash, hang, or leak sensitive information when it tries to access them as regular files. |
| CWE-670 | Always-Incorrect Control Flow Implementation | This weakness occurs when a section of code is structured in a way that always executes incorrectly, regardless of input or conditions. The control flow logic is fundamentally flawed and does not match the intended algorithm. |
| CWE-671 | Lack of Administrator Control over Security | This weakness occurs when a system's built-in security settings cannot be adjusted by its administrator. This prevents tailoring security to the specific deployment environment, forcing the system to operate at a lower or inappropriate security level than required. |
| CWE-672 | Operation on a Resource after Expiration or Release | This vulnerability occurs when a program continues to use a resource—like memory, a file handle, or a network connection—after it has been freed, closed, or is no longer valid. |
| CWE-673 | External Influence of Sphere Definition | The application allows external parties to modify its security boundaries or trusted zones, which should be defined and controlled internally. |
| CWE-674 | Uncontrolled Recursion | This vulnerability occurs when an application fails to limit how deeply a function can call itself. Without proper controls, this uncontrolled recursion can exhaust system resources like memory or stack space, leading to crashes or denial-of-service. |
| CWE-675 | Multiple Operations on Resource in Single-Operation Context | This vulnerability occurs when a software component performs the same action on a resource multiple times, even though the action is designed to be executed only once. This redundant execution can lead to unintended side effects, data corruption, or resource exhaustion. |
| CWE-676 | Use of Potentially Dangerous Function | This vulnerability occurs when code calls a function that can be dangerous if misused, but can also be used safely with proper precautions. The risk lies not in the function itself, but in how it's implemented. |
| CWE-680 | Integer Overflow to Buffer Overflow | This vulnerability occurs when a program calculates the size of memory to allocate, but an integer overflow in that calculation results in a much smaller buffer being created than intended. This undersized buffer can then be overflowed by subsequent operations, corrupting adjacent memory. |
| CWE-681 | Incorrect Conversion between Numeric Types | This vulnerability occurs when a program converts a value from one numeric type to another (like a 64-bit integer to a 32-bit integer) and the conversion loses or misinterprets data. If these corrupted values are later used in security-critical operations—like calculating buffer sizes, checking permissions, or performing financial transactions—they can lead to crashes, incorrect behavior, or security bypasses. |
| CWE-682 | Incorrect Calculation | This vulnerability occurs when software performs a calculation that produces wrong or unexpected results, which are then used to make security decisions or manage critical resources. |
| CWE-683 | Function Call With Incorrect Order of Arguments | This vulnerability occurs when a program calls a function but supplies the arguments in the wrong order, which can cause unexpected behavior or security flaws. |
| CWE-684 | Incorrect Provision of Specified Functionality | This weakness occurs when software behaves differently than its documented specifications, which can mislead users and create security risks. |
| CWE-685 | Function Call With Incorrect Number of Arguments | This weakness occurs when a program calls a function, method, or subroutine but provides the wrong number of arguments—either too many or too few. This mismatch can cause the program to behave unpredictably, access incorrect memory, or crash, creating a security vulnerability. |
| CWE-686 | Function Call With Incorrect Argument Type | This vulnerability occurs when a program calls a function or method but passes an argument of the wrong data type, which can cause unexpected behavior or security flaws. |
| CWE-687 | Function Call With Incorrectly Specified Argument Value | This vulnerability occurs when a function is called with an argument that holds an incorrect or unexpected value, leading to unintended program behavior or security flaws. |
| CWE-688 | Function Call With Incorrect Variable or Reference as Argument | This vulnerability occurs when a function is called with the wrong variable or reference passed as an argument. This simple coding mistake can cause the program to behave unpredictably, access incorrect data, or trigger other security flaws. |
| CWE-689 | Permission Race Condition During Resource Copy | This vulnerability occurs when a system copies a file or resource but delays setting its final permissions until the entire copy operation is finished. During the copy process, the resource remains exposed with default or overly permissive access, creating a temporary window where unauthorized users or processes could read, modify, or delete it. |
| CWE-69 | Improper Handling of Windows ::DATA Alternate Data Stream | This vulnerability occurs when an application fails to properly secure or monitor Windows Alternate Data Streams (ADS), allowing them to be used to hide or bypass security controls. |
| CWE-690 | Unchecked Return Value to NULL Pointer Dereference | This vulnerability occurs when a program calls a function that can return a NULL pointer to signal failure, but the code does not check for this error condition before using the returned value, leading to a crash or unexpected behavior from dereferencing the NULL pointer. |
| CWE-691 | Insufficient Control Flow Management | This vulnerability occurs when a program's execution flow isn't properly managed, allowing attackers to bypass critical checks, trigger unexpected code paths, or disrupt normal operation. |
| CWE-692 | Incomplete Denylist to Cross-Site Scripting | This vulnerability occurs when an application relies on an incomplete denylist to block cross-site scripting (XSS) attacks, leaving the door open for attackers to craft payloads that bypass the filter. |
| CWE-693 | Protection Mechanism Failure | This weakness occurs when software either lacks a necessary security control, implements one that is too weak, or fails to activate an existing control in a critical area, leaving it vulnerable to targeted attacks. |
| CWE-694 | Use of Multiple Resources with Duplicate Identifier | This vulnerability occurs when a system uses multiple resources that can share the same identifier, even though the application logic requires each identifier to be unique. |
| CWE-695 | Use of Low-Level Functionality | This vulnerability occurs when code bypasses high-level framework controls by directly using low-level system functions, violating the intended security model. |
| CWE-696 | Incorrect Behavior Order | This weakness occurs when a system executes multiple dependent actions in the wrong sequence, leading to unexpected and potentially vulnerable states. |
| CWE-697 | Incorrect Comparison | This weakness occurs when a security-critical decision relies on a flawed comparison between two pieces of data. The incorrect logic can create a gap that attackers exploit to bypass checks or trigger unintended behavior. |
| CWE-698 | Execution After Redirect (EAR) | Execution After Redirect (EAR) occurs when a web application sends a redirect response to a user's browser but continues to run server-side code, potentially performing unintended actions. |
| CWE-7 | J2EE Misconfiguration: Missing Custom Error Page | This vulnerability occurs when a J2EE application uses the server's default error pages instead of custom ones, potentially leaking sensitive system details. |
| CWE-703 | Improper Check or Handling of Exceptional Conditions | This vulnerability occurs when software fails to properly plan for or manage rare but possible error scenarios, leaving it unprepared for unexpected events that can disrupt normal operation. |
| CWE-704 | Incorrect Type Conversion or Cast | This vulnerability occurs when software incorrectly changes data from one type to another, leading to unexpected behavior or security flaws. |
| CWE-705 | Incorrect Control Flow Scoping | This vulnerability occurs when a program fails to return execution to the correct point in the code after finishing a specific operation or handling an error. Instead of resuming normal flow, it may jump to an unintended location, leading to unpredictable behavior or security issues. |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | This vulnerability occurs when software uses a name, path, or reference to access a resource, but that identifier points to something outside the area the application is supposed to control, leading to unauthorized access or manipulation. |
| CWE-707 | Improper Neutralization | This vulnerability occurs when an application fails to properly validate or sanitize structured data before it's received from an external source or sent to another component. This allows malformed messages to be processed, which can lead to misinterpretation and security breaches. |
| CWE-708 | Incorrect Ownership Assignment | This vulnerability occurs when a system grants ownership of a resource to an entity that should not have that level of control, placing it outside the intended security boundary. |
| CWE-71 | DEPRECATED: Apple '.DS_Store' | This entry has been deprecated because it describes a specific real-world example of a UNIX hard link vulnerability, not a distinct weakness category. For the core issue, please refer to CWE-62: UNIX Hard Link. |
| CWE-710 | Improper Adherence to Coding Standards | This weakness occurs when developers don't consistently follow established coding standards and best practices, which can introduce security flaws or make existing vulnerabilities more severe. |
| CWE-72 | Improper Handling of Apple HFS+ Alternate Data Stream Path | This vulnerability occurs when software fails to correctly process HFS+ file system paths that point to alternate data streams, such as a file's data or resource fork. |
| CWE-73 | External Control of File Name or Path | This vulnerability occurs when an application uses unvalidated user input to construct file or directory paths for filesystem operations. |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | This vulnerability occurs when a system grants overly permissive access to a sensitive resource, allowing unauthorized users or processes to read or alter it. |
| CWE-733 | Compiler Optimization Removal or Modification of Security-critical Code | This vulnerability occurs when a compiler's optimization process unintentionally strips out or alters security-critical code that a developer intentionally wrote, leaving the application exposed. |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | This vulnerability occurs when an application uses untrusted external input to build a command, query, or data structure for another component, but fails to properly sanitize special characters or syntax. This allows the input to alter the intended meaning or behavior when the downstream component processes it. |
| CWE-749 | Exposed Dangerous Method or Function | This vulnerability occurs when a software component exposes an API or interface containing a high-risk function that lacks proper access controls, allowing unauthorized actors to trigger it. |
| CWE-75 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) | This vulnerability occurs when an application fails to properly filter or encode user-supplied data containing special characters or commands that can be interpreted in a different context, such as a command shell, file system, or data format. |
| CWE-754 | Improper Check for Unusual or Exceptional Conditions | This weakness occurs when software fails to properly anticipate and handle rare or unexpected runtime situations that fall outside normal operation. |
| CWE-755 | Improper Handling of Exceptional Conditions | This vulnerability occurs when software fails to properly manage unexpected situations or errors, leaving it in an unstable or insecure state. |
| CWE-756 | Missing Custom Error Page | This vulnerability occurs when an application fails to display its own user-friendly error pages, instead falling back to default system messages that can leak sensitive technical details. |
| CWE-757 | Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') | This vulnerability occurs when a protocol or system allows negotiating a security algorithm (like encryption) but chooses a weaker option than the strongest one both parties support, creating an unnecessary security gap. |
| CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | This weakness occurs when software depends on specific behaviors of an API, data structure, or system component that are not formally guaranteed by its specification. The code assumes these behaviors will always work a certain way, but they might change or fail under different conditions. |
| CWE-759 | Use of a One-Way Hash without a Salt | This vulnerability occurs when a system uses a one-way hash function (like MD5 or SHA-256) to protect sensitive data like passwords, but fails to add a unique random value called a salt before hashing. |
| CWE-76 | Improper Neutralization of Equivalent Special Elements | This vulnerability occurs when an application successfully blocks or sanitizes a known set of dangerous inputs but fails to recognize and handle alternative forms that have the same meaning or effect. |
| CWE-760 | Use of a One-Way Hash with a Predictable Salt | This vulnerability occurs when an application uses a one-way hash (like for password storage) but combines it with a predictable or easily guessed salt. This undermines the security benefit of salting, making pre-computed attack methods like rainbow tables highly effective. |
| CWE-761 | Free of Pointer not at Start of Buffer | This vulnerability occurs when a program incorrectly frees a memory pointer that no longer points to the beginning of the allocated heap buffer, often due to pointer arithmetic. |
| CWE-762 | Mismatched Memory Management Routines | This vulnerability occurs when a program uses incompatible functions to allocate and free memory. For example, freeing memory with a function that doesn't match the one used to create it, like mixing different memory management systems. |
| CWE-763 | Release of Invalid Pointer or Reference | This vulnerability occurs when a program tries to free a memory resource back to the system but uses an incorrect deallocation method or calls the correct method improperly. |
| CWE-764 | Multiple Locks of a Critical Resource | This vulnerability occurs when a critical resource, such as a file, data structure, or connection, is locked more times than the software logic intended, putting the system into an unstable or unresponsive state. |
| CWE-765 | Multiple Unlocks of a Critical Resource | This vulnerability occurs when a critical resource, like a lock or semaphore, is unlocked more times than it was locked, putting the system into an unexpected and potentially unstable state. |
| CWE-766 | Critical Data Element Declared Public | This vulnerability occurs when a critical piece of data—like a variable, field, or class member—is mistakenly declared as public when it should be kept private according to the application's security design. |
| CWE-767 | Access to Critical Private Variable via Public Method | This vulnerability occurs when a class exposes a public method that directly accesses or alters a private variable. |
| CWE-768 | Incorrect Short Circuit Evaluation | This vulnerability occurs when a program's conditional statement uses short-circuit evaluation (where later parts of an AND/OR check are skipped if the outcome is already determined), and the skipped portions contain code that changes the program's state. Because these side effects—like updating a variable, checking a permission, or logging an event—are never executed, the application can enter an unexpected and potentially insecure state. |
| CWE-769 | DEPRECATED: Uncontrolled File Descriptor Consumption | This entry has been deprecated and merged into CWE-774 (Allocation of Resources Without Limits or Throttling). The content describing uncontrolled file descriptor consumption is now fully covered under that more comprehensive weakness. |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | This vulnerability occurs when an application builds a system command using untrusted user input without properly sanitizing it. An attacker can inject their own commands by inserting special characters or code, tricking the application into executing unintended and potentially harmful actions on the underlying system. |
| CWE-770 | Allocation of Resources Without Limits or Throttling | This vulnerability occurs when a system allows users or processes to request resources without any built-in caps or rate limits. Think of it as a buffet with no rules on how much one person can take, eventually leaving nothing for others and causing the system to fail. |
| CWE-771 | Missing Reference to Active Allocated Resource | This vulnerability occurs when software loses track of a resource it has allocated, like memory or a file handle, preventing the system from properly releasing it back for future use. |
| CWE-772 | Missing Release of Resource after Effective Lifetime | This vulnerability occurs when a program fails to properly release a system resource—like memory, file handles, or network sockets—after it is no longer needed. This leads to a gradual accumulation of unused resources, known as a resource leak. |
| CWE-773 | Missing Reference to Active File Descriptor or Handle | This vulnerability occurs when a program fails to keep track of open files or resources, preventing the system from properly closing and reclaiming them. |
| CWE-774 | Allocation of File Descriptors or Handles Without Limits or Throttling | This vulnerability occurs when an application creates file descriptors or handles for a user or process without enforcing any limits on the total number that can be opened. |
| CWE-775 | Missing Release of File Descriptor or Handle after Effective Lifetime | This vulnerability occurs when a program fails to properly close file descriptors or handles after they are no longer needed, leaving these system resources allocated. |
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | This vulnerability occurs when an XML parser allows Document Type Definitions (DTDs) to contain recursively defined entities without proper limits, enabling malicious data structures. |
| CWE-777 | Regular Expression without Anchors | This vulnerability occurs when a regular expression used for validation or sanitization lacks anchors, allowing unintended characters or malicious payloads to bypass security checks. |
| CWE-778 | Insufficient Logging | This weakness occurs when an application fails to properly record important security events or captures them with insufficient detail, making it hard to spot and investigate suspicious activity. |
| CWE-779 | Logging of Excessive Data | This vulnerability occurs when an application records more information than necessary in its logs, making log files difficult to analyze and potentially slowing down incident response or security investigations. |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | OS Command Injection occurs when an application builds a system command using untrusted, external input without properly sanitizing it. This allows an attacker to inject and execute arbitrary commands on the underlying operating system. |
| CWE-780 | Use of RSA Algorithm without OAEP | This vulnerability occurs when an application implements RSA encryption but fails to use Optimal Asymmetric Encryption Padding (OAEP), significantly weakening the cryptographic protection. |
| CWE-781 | Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code | This vulnerability occurs when a Windows driver defines an IOCTL using METHOD_NEITHER but fails to properly check the user-supplied memory addresses before using them. |
| CWE-782 | Exposed IOCTL with Insufficient Access Control | This vulnerability occurs when a system exposes an IOCTL (Input/Output Control) interface that performs sensitive operations, but fails to implement proper checks to verify which users or processes are allowed to call it. |
| CWE-783 | Operator Precedence Logic Error | This vulnerability occurs when a developer writes a conditional expression where the intended logic is broken due to misunderstanding or misapplying the rules of operator precedence. |
| CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | This vulnerability occurs when an application makes security decisions—like granting access or verifying identity—based solely on cookie data without first confirming the cookie's authenticity or integrity. |
| CWE-785 | Use of Path Manipulation Function without Maximum-sized Buffer | This vulnerability occurs when a program uses a path manipulation function but supplies an output buffer that is too small to hold the maximum possible path length, such as PATH_MAX. |
| CWE-786 | Access of Memory Location Before Start of Buffer | This vulnerability occurs when software attempts to read from or write to a memory location positioned before the official start of a buffer. |
| CWE-787 | Out-of-bounds Write | This vulnerability occurs when software incorrectly writes data outside the boundaries of its allocated memory buffer, either beyond the end or before the beginning. |
| CWE-788 | Access of Memory Location After End of Buffer | This vulnerability occurs when software attempts to read from or write to a memory buffer using an index or pointer that points past the buffer's allocated boundary. |
| CWE-789 | Memory Allocation with Excessive Size Value | This vulnerability occurs when a program allocates memory based on a user-supplied or untrusted size value without proper validation. If an attacker provides an excessively large number, the application can attempt to allocate massive amounts of system memory, leading to a denial-of-service or system instability. |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | This vulnerability occurs when a web application fails to properly sanitize or encode user-supplied input before displaying it on a webpage viewed by other users. |
| CWE-790 | Improper Filtering of Special Elements | This vulnerability occurs when an application accepts data from a source but fails to properly sanitize or incorrectly filters out special characters or control elements before passing that data to another system component. |
| CWE-791 | Incomplete Filtering of Special Elements | This vulnerability occurs when an application accepts data from a source but fails to properly clean or neutralize all special characters or commands before passing that data to another system component. |
| CWE-792 | Incomplete Filtering of One or More Instances of Special Elements | This vulnerability occurs when an application receives external data but fails to properly neutralize all instances of potentially dangerous characters or code patterns before passing that data to another system component. |
| CWE-793 | Only Filtering One Instance of a Special Element | This vulnerability occurs when an application processes incoming data but only removes or neutralizes one occurrence of a dangerous element, leaving other identical or similar elements untouched before passing the data along. |
| CWE-794 | Incomplete Filtering of Multiple Instances of Special Elements | This vulnerability occurs when an application receives data from a source but fails to remove or neutralize every instance of a potentially dangerous element before passing that data to another component. |
| CWE-795 | Only Filtering Special Elements at a Specified Location | This vulnerability occurs when a security filter only checks for dangerous input patterns at specific, predefined locations within the data. It fails to scan the entire input stream, allowing malicious elements that appear outside the expected location to pass through and potentially harm downstream components. |
| CWE-796 | Only Filtering Special Elements Relative to a Marker | This vulnerability occurs when software filters dangerous inputs or characters, but only checks for them in specific, expected locations (like the start or end of a string). It fails to detect and remove the same dangerous elements if they appear elsewhere in the data, allowing them to pass through to critical system components. |
| CWE-797 | Only Filtering Special Elements at an Absolute Position | This vulnerability occurs when software checks for dangerous characters or patterns only at a fixed, hardcoded location in input data. Because it ignores these same elements if they appear anywhere else, attackers can bypass the filter by simply moving the malicious content to a different position. |
| CWE-798 | Use of Hard-coded Credentials | This vulnerability occurs when software contains built-in, unchangeable authentication secrets like passwords or encryption keys within its source code or configuration files. |
| CWE-799 | Improper Control of Interaction Frequency | This vulnerability occurs when an application fails to properly restrict how often or how many times a user or automated system can interact with it. |
| CWE-8 | J2EE Misconfiguration: Entity Bean Declared Remote | This vulnerability occurs when an Entity Bean in a J2EE application is incorrectly configured with a remote interface. This exposes data access methods to remote clients, allowing unauthorized users to potentially read sensitive information or manipulate data outside the application's intended security boundaries. |
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | This vulnerability, commonly known as Basic Cross-Site Scripting (XSS), occurs when a web application fails to properly sanitize user input containing HTML and JavaScript tags. When untrusted data containing characters like <, >, and & is rendered directly into a webpage, a browser may execute it as active code, not just display it as text. |
| CWE-804 | Guessable CAPTCHA | This vulnerability occurs when a CAPTCHA challenge is too easy for automated bots to solve, either by guessing or using pattern recognition, allowing them to bypass the human verification step. |
| CWE-805 | Buffer Access with Incorrect Length Value | This vulnerability occurs when software reads from or writes to a buffer using a loop or sequential operation, but mistakenly calculates or provides an incorrect length value. This incorrect length causes the operation to access memory outside the buffer's allocated boundaries. |
| CWE-806 | Buffer Access Using Size of Source Buffer | This vulnerability occurs when a program uses the size of the source data buffer to control reading or writing to a smaller destination buffer, potentially accessing memory outside the destination's allocated bounds. |
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | This vulnerability occurs when an application's security check depends on user-controlled data that can be manipulated to bypass protection mechanisms, such as authentication or authorization gates. |
| CWE-81 | Improper Neutralization of Script in an Error Message Web Page | This vulnerability occurs when an application fails to properly sanitize user-supplied input before displaying it within an error message web page. If special characters used in web scripts are not neutralized, an attacker can inject malicious code that executes in a user's browser. |
| CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | This vulnerability occurs when a web application fails to properly sanitize or escape script code within the attributes of HTML IMG tags, such as the 'src' attribute. |
| CWE-820 | Missing Synchronization | This vulnerability occurs when multiple parts of your application (like threads or processes) use the same resource—such as a variable, file, or data structure—without proper coordination to control who accesses it and when. |
| CWE-821 | Incorrect Synchronization | This vulnerability occurs when multiple parts of a program, such as threads or processes, access a shared resource like a variable, file, or data structure without proper coordination, leading to a race condition. |
| CWE-822 | Untrusted Pointer Dereference | This vulnerability occurs when software takes a value from an untrusted source, treats it as a memory address (a pointer), and then accesses that memory location directly for reading or writing. |
| CWE-823 | Use of Out-of-range Pointer Offset | This vulnerability occurs when a program calculates a new memory address using a valid pointer and an offset, but the resulting address points outside the intended, safe memory region, such as beyond the bounds of an array or structure. |
| CWE-824 | Access of Uninitialized Pointer | This vulnerability occurs when a program tries to use a pointer variable before it has been assigned a valid memory address. |
| CWE-825 | Expired Pointer Dereference | This vulnerability occurs when a program tries to use a pointer that still points to a memory location that has already been freed or released. |
| CWE-826 | Premature Release of Resource During Expected Lifetime | This happens when software incorrectly frees or closes a resource—like memory, a file handle, or a network connection—while that resource is still supposed to be in active use by the program or another component. |
| CWE-827 | Improper Control of Document Type Definition | This vulnerability occurs when an application fails to properly restrict which Document Type Definitions (DTDs) can be referenced during XML parsing. Attackers can exploit this by injecting references to malicious DTDs, potentially leading to unauthorized file access, server-side request forgery (SSRF), or denial-of-service through resource exhaustion. |
| CWE-828 | Signal Handler with Functionality that is not Asynchronous-Safe | This weakness occurs when a program's signal handler contains code that is not asynchronous-safe. This means the handler can be interrupted or can corrupt shared data, leading to unpredictable program behavior. |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | This weakness occurs when an application integrates executable code, like a library or plugin, from a source it does not fully control or trust. |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | This vulnerability occurs when a web application fails to properly sanitize or block JavaScript URIs (like 'javascript:') within HTML tag attributes. Attackers can inject malicious code into attributes such as onmouseover, onload, onerror, or style, leading to cross-site scripting (XSS) attacks when the page renders. |
| CWE-830 | Inclusion of Web Functionality from an Untrusted Source | This vulnerability occurs when a web application directly imports and executes functionality, like a widget or script, from an external, untrusted domain. Because the imported code runs within your application's own security context (origin), it gains the same level of access to user data and the DOM as your own code, potentially giving the third party full control. |
| CWE-831 | Signal Handler Function Associated with Multiple Signals | This vulnerability occurs when a single function is registered to handle multiple different operating system signals, creating potential race conditions if that function isn't carefully designed. |
| CWE-832 | Unlock of a Resource that is not Locked | This vulnerability occurs when a program tries to unlock a resource, such as a mutex or semaphore, that is not currently in a locked state. |
| CWE-833 | Deadlock | Deadlock occurs when two or more threads or processes become permanently stuck, each waiting for the other to release a shared resource like a lock or mutex, preventing any of them from progressing. |
| CWE-834 | Excessive Iteration | This vulnerability occurs when a program runs a loop too many times because it lacks proper limits on its iterations. |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | An infinite loop occurs when a program's iteration logic contains an exit condition that can never be satisfied, causing the loop to run indefinitely and consume system resources. |
| CWE-836 | Use of Password Hash Instead of Password for Authentication | This vulnerability occurs when an application's authentication system accepts a password hash directly from the client for verification, instead of receiving and hashing the plaintext password on the server. |
| CWE-837 | Improper Enforcement of a Single, Unique Action | This vulnerability occurs when a system fails to properly prevent users from repeating an action that should only be performed once, such as submitting a vote, finalizing a purchase, or requesting a refund. |
| CWE-838 | Inappropriate Encoding for Output Context | This vulnerability occurs when a system uses one type of encoding for its output, but the component receiving that data expects a different encoding. The mismatch causes the downstream component to interpret the data incorrectly. |
| CWE-839 | Numeric Range Comparison Without Minimum Check | This vulnerability occurs when software validates that a number is within an acceptable range by only checking that it's less than or equal to a maximum value, but fails to also verify that it is greater than or equal to a required minimum. This oversight can allow negative or otherwise invalid low values to pass the check, leading to unexpected behavior. |
| CWE-84 | Improper Neutralization of Encoded URI Schemes in a Web Page | This vulnerability occurs when a web application fails to properly sanitize user-supplied input that contains malicious scripts disguised using encoded URI schemes like `javascript:` or `data:`. |
| CWE-841 | Improper Enforcement of Behavioral Workflow | This weakness occurs when an application requires a user to follow a specific sequence of actions, but fails to enforce that order. Attackers can exploit this by skipping steps, performing actions out of sequence, or interrupting the flow, which can corrupt the business logic or put the system into an invalid state. |
| CWE-842 | Placement of User into Incorrect Group | This vulnerability occurs when a system or administrator assigns a user to the wrong security group or role. |
| CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | Type confusion occurs when a program creates a resource—like a pointer, object, or variable—with one data type, but later incorrectly accesses it as a different, incompatible type. |
| CWE-85 | Doubled Character XSS Manipulations | This vulnerability occurs when a web application fails to properly sanitize user input that contains doubled characters, allowing attackers to bypass filters and inject malicious scripts. |
| CWE-86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | This vulnerability occurs when an application fails to properly filter or escape invalid characters within web identifiers like HTML tag names or URI schemes, allowing malicious sequences to pass through. |
| CWE-862 | Missing Authorization | This vulnerability occurs when an application fails to verify whether a user has permission to access specific data or execute certain actions before allowing the request to proceed. |
| CWE-863 | Incorrect Authorization | This vulnerability occurs when an application checks if a user is allowed to perform an action or access data, but the check is flawed or incomplete, allowing unauthorized access. |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | This vulnerability occurs when an application fails to properly sanitize user-supplied input that uses alternative methods to execute cross-site scripting (XSS) attacks. |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | This vulnerability occurs when an application builds a command string for execution by another component, but fails to properly separate or 'neutralize' the intended arguments. This allows an attacker to inject additional command-line arguments, options, or switches by including argument-separating characters (like spaces or dashes) in untrusted input. |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | SQL Injection occurs when an application builds a database query using untrusted user input without properly sanitizing it. This allows an attacker to insert malicious SQL code that the database executes, potentially letting them view, modify, or delete sensitive data. |
| CWE-9 | J2EE Misconfiguration: Weak Access Permissions for EJB Methods | This vulnerability occurs when Enterprise JavaBean (EJB) methods are configured with overly permissive access rights, allowing attackers to exploit elevated privileges they should not have. |
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | This vulnerability occurs when an application builds an LDAP query using untrusted user input without properly sanitizing it. An attacker can inject special characters or commands to alter the query's logic, potentially gaining unauthorized access to, modifying, or extracting sensitive directory information. |
| CWE-908 | Use of Uninitialized Resource | This vulnerability occurs when software attempts to use a resource—like memory, a file handle, or an object—before it has been properly set up or assigned a valid starting state. |
| CWE-909 | Missing Initialization of Resource | The software fails to properly set up a critical resource before using it. |
| CWE-91 | XML Injection (aka Blind XPath Injection) | XML Injection occurs when an application fails to properly validate or escape user-controlled input before including it in XML documents or queries. This allows attackers to inject malicious XML elements or syntax, potentially altering the document's structure, extracting sensitive data, or disrupting processing logic. |
| CWE-910 | Use of Expired File Descriptor | This vulnerability occurs when a program attempts to use a file descriptor after it has been closed, treating it as if it were still valid. |
| CWE-911 | Improper Update of Reference Count | This vulnerability occurs when a program uses a reference counter to track resource usage but fails to update the count correctly, either by missing an update or applying an incorrect value. |
| CWE-912 | Hidden Functionality | Hidden functionality refers to undocumented features, commands, or code within a product that are not part of its official specification and are not obvious to users or administrators. |
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | This vulnerability occurs when an application fails to properly secure access to code resources that can be created or altered at runtime, such as variables, functions, or objects. |
| CWE-914 | Improper Control of Dynamically-Identified Variables | This vulnerability occurs when an application fails to properly secure access to variables whose names are determined at runtime, allowing attackers to read or modify data they shouldn't have access to. |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | This vulnerability occurs when an application accepts user input that specifies which object attributes or fields to create or update, but fails to restrict which specific attributes can be changed. Attackers can exploit this to modify sensitive internal properties they shouldn't have access to. |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | This vulnerability occurs when a system protects passwords by hashing them, but uses a hashing algorithm that is too fast or computationally cheap. This makes it easy for attackers to crack the stored password hashes using brute-force methods. |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | Expression Language Injection occurs when an application uses untrusted, external input to build an expression language statement—common in frameworks like Java Server Pages (JSP)—without properly sanitizing it. This allows an attacker to inject malicious expressions that alter the intended logic and execute arbitrary code when the statement is processed. |
| CWE-918 | Server-Side Request Forgery (SSRF) | Server-Side Request Forgery (SSRF) occurs when a web application fetches a remote resource based on user-controlled input, but fails to properly validate or restrict where those requests are sent. This allows an attacker to trick the server into making unauthorized connections to internal systems or external domains. |
| CWE-92 | DEPRECATED: Improper Sanitization of Custom Special Characters | This deprecated entry originally flagged issues where custom or non-standard special characters weren't properly sanitized. It has been consolidated into the more comprehensive CWE-75: Failure to Sanitize Special Elements. |
| CWE-920 | Improper Restriction of Power Consumption | This vulnerability occurs when software running on a power-constrained device, like a battery-powered mobile or embedded system, fails to actively manage and limit its own energy usage. |
| CWE-921 | Storage of Sensitive Data in a Mechanism without Access Control | This vulnerability occurs when an application saves sensitive information to a storage location that lacks proper access restrictions, allowing unauthorized users or applications to view or modify the data. |
| CWE-922 | Insecure Storage of Sensitive Information | This vulnerability occurs when an application stores sensitive data—like credentials, personal information, or encryption keys—without enforcing proper access controls, allowing unauthorized users to read or modify it. |
| CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | This vulnerability occurs when a system opens a communication channel for a sensitive task but fails to properly verify that it's actually talking to the correct, intended destination. This allows a malicious actor to impersonate the legitimate endpoint. |
| CWE-924 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | This vulnerability occurs when an application receives data over a network but fails to properly verify that the information wasn't altered in transit. |
| CWE-925 | Improper Verification of Intent by Broadcast Receiver | This vulnerability occurs when an Android app's Broadcast Receiver accepts an Intent without confirming it originated from a trusted, authorized source, such as the operating system. |
| CWE-926 | Improper Export of Android Application Components | This vulnerability occurs when an Android app makes a component (like an Activity, Service, or Content Provider) available to other apps without enforcing proper security checks. This allows unintended or malicious applications to interact with the component, potentially leading to data theft, unauthorized actions, or application compromise. |
| CWE-927 | Use of Implicit Intent for Sensitive Communication | This vulnerability occurs when an Android app uses an implicit intent to send sensitive data, allowing any other app on the device to potentially intercept and read that information. |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | This vulnerability occurs when an application uses carriage return and line feed characters (CRLF) to structure data, like separating lines or records, but fails to properly sanitize these sequences from user-supplied input before processing. |
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | This vulnerability occurs when an app implements a custom URL scheme handler but fails to properly verify which other apps or sources are allowed to trigger it. |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | This vulnerability occurs when an application builds executable code using unvalidated external input, such as user data. Because the application fails to properly filter or escape this input, an attacker can inject special characters or commands that alter the intended code's logic or syntax. |
| CWE-940 | Improper Verification of Source of a Communication Channel | This vulnerability occurs when an application accepts incoming communication requests without properly checking where they originate from, allowing potentially malicious sources to establish a connection. |
| CWE-941 | Incorrectly Specified Destination in a Communication Channel | This vulnerability occurs when an application establishes an outgoing communication channel but fails to correctly define or enforce the intended recipient. This misdirection can allow data to be sent to an untrusted or malicious destination. |
| CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | This vulnerability occurs when a web application's cross-domain security policy, like a Content Security Policy (CSP), explicitly allows communication with untrusted or overly permissive external domains. |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | This vulnerability occurs when an application builds a query for a data store (like a database) but fails to properly sanitize user-controlled input. This allows an attacker to inject special elements that change the query's intended logic, potentially accessing or manipulating data in unauthorized ways. |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | This vulnerability occurs when an application takes user input and passes it directly into a dynamic code execution function, like eval(), without properly sanitizing it. This allows an attacker to inject and execute arbitrary code within the application's context. |
| CWE-96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') | Static Code Injection occurs when an application incorporates unvalidated or improperly sanitized user input directly into a static, executable resource like a configuration file, template, or library. Because this input is saved and later executed, it allows an attacker to inject malicious code that becomes a permanent part of the application's logic. |
| CWE-97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | This vulnerability occurs when a web application dynamically generates pages but fails to properly sanitize user-supplied input that could be interpreted as server-side include (SSI) commands, allowing an attacker to inject malicious directives. |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | This vulnerability occurs when a PHP application uses unvalidated or insufficiently restricted user input directly within file inclusion functions like require() or include(). |
| CWE-99 | Improper Control of Resource Identifiers ('Resource Injection') | This vulnerability occurs when an application accepts user input as a resource identifier (like a file path or port number) without proper validation, allowing an attacker to access or manipulate resources outside the intended scope. |
| CWE-1 | DEPRECATED: Location | This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-10 | DEPRECATED: ASP.NET Environment Issues | This category has been deprecated. It added unnecessary depth and complexity to its associated views. |
| CWE-100 | DEPRECATED: Technology-Specific Input Validation Problems | This category has been deprecated. It was originally intended as a "catch-all" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy. |
| CWE-1001 | SFP Secondary Cluster: Use of an Improper API | This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3). |
| CWE-1002 | SFP Secondary Cluster: Unexpected Entry Points | This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster. |
| CWE-1005 | 7PK - Input Validation and Representation | This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input." |
| CWE-1006 | Bad Coding Practices | Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code. |
| CWE-1009 | Audit | Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture. |
| CWE-101 | DEPRECATED: Struts Validation Problems | This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-1010 | Authenticate Actors | Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture. |
| CWE-1011 | Authorize Actors | Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture. |
| CWE-1012 | Cross Cutting | Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture. |
| CWE-1013 | Encrypt Data | Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture. |
| CWE-1014 | Identify Actors | Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture. |
| CWE-1015 | Limit Access | Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture. |
| CWE-1016 | Limit Exposure | Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture. |
| CWE-1017 | Lock Computer | Weaknesses in this category are related to the design and architecture of a system's lockout mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts to access a given resource. The weaknesses in this category could lead to a degradation of access to system assets if they are not addressed when designing or implementing a secure architecture. |
| CWE-1018 | Manage User Sessions | Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture. |
| CWE-1019 | Validate Inputs | Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture. |
| CWE-1020 | Verify Message Integrity | Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture. |
| CWE-1027 | OWASP Top Ten 2017 Category A1 - Injection | Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2017. |
| CWE-1028 | OWASP Top Ten 2017 Category A2 - Broken Authentication | Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2017. |
| CWE-1029 | OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure | Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2017. |
| CWE-1030 | OWASP Top Ten 2017 Category A4 - XML External Entities (XXE) | Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2017. |
| CWE-1031 | OWASP Top Ten 2017 Category A5 - Broken Access Control | Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2017. |
| CWE-1032 | OWASP Top Ten 2017 Category A6 - Security Misconfiguration | Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2017. |
| CWE-1033 | OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS) | Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2017. |
| CWE-1034 | OWASP Top Ten 2017 Category A8 - Insecure Deserialization | Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2017. |
| CWE-1035 | OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities | Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017. |
| CWE-1036 | OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring | Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2017. |
| CWE-1129 | CISQ Quality Measures (2016) - Reliability | Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software. |
| CWE-1130 | CISQ Quality Measures (2016) - Maintainability | Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software. |
| CWE-1131 | CISQ Quality Measures (2016) - Security | Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software. |
| CWE-1132 | CISQ Quality Measures (2016) - Performance Efficiency | Weaknesses in this category are related to the CISQ Quality Measures for Performance Efficiency, as documented in 2016 with the Automated Source Code Performance Efficiency Measure (ASCPEM) Specification 1.0. Presence of these weaknesses could reduce the performance efficiency of the software. |
| CWE-1134 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS) | Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1135 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL) | Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1136 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP) | Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1137 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM) | Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1138 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR) | Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1139 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ) | Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1140 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET) | Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1141 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR) | Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1142 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA) | Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1143 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK) | Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1144 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI) | Weaknesses in this category are related to the rules and recommendations in the Thread APIs (THI) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1145 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS) | Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1146 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM) | Weaknesses in this category are related to the rules and recommendations in the Thread-Safety Miscellaneous (TSM) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1147 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO) | Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1148 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER) | Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1149 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) | Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1150 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV) | Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1151 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI) | Weaknesses in this category are related to the rules and recommendations in the Java Native Interface (JNI) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1152 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC) | Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1153 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD) | Weaknesses in this category are related to the rules and recommendations in the Android (DRD) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1155 | SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE) | Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) section of the SEI CERT C Coding Standard. |
| CWE-1156 | SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL) | Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT C Coding Standard. |
| CWE-1157 | SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP) | Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard. |
| CWE-1158 | SEI CERT C Coding Standard - Guidelines 04. Integers (INT) | Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard. |
| CWE-1159 | SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP) | Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard. |
| CWE-1160 | SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR) | Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard. |
| CWE-1161 | SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR) | Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard. |
| CWE-1162 | SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM) | Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard. |
| CWE-1163 | SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO) | Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard. |
| CWE-1165 | SEI CERT C Coding Standard - Guidelines 10. Environment (ENV) | Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard. |
| CWE-1166 | SEI CERT C Coding Standard - Guidelines 11. Signals (SIG) | Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard. |
| CWE-1167 | SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR) | Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard. |
| CWE-1168 | SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API) | Weaknesses in this category are related to the rules and recommendations in the Application Programming Interfaces (API) section of the SEI CERT C Coding Standard. |
| CWE-1169 | SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON) | Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard. |
| CWE-1170 | SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC) | Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard. |
| CWE-1171 | SEI CERT C Coding Standard - Guidelines 50. POSIX (POS) | Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard. |
| CWE-1172 | SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN) | Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard. |
| CWE-1175 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON) | Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT Oracle Secure Coding Standard for Java. |
| CWE-1179 | SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS) | Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard. |
| CWE-1180 | SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL) | Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard. |
| CWE-1181 | SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP) | Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard. |
| CWE-1182 | SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT) | Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard. |
| CWE-1183 | SEI CERT Perl Coding Standard - Guidelines 05. Strings (STR) | Weaknesses in this category are related to the rules and recommendations in the Strings (STR) section of the SEI CERT Perl Coding Standard. |
| CWE-1184 | SEI CERT Perl Coding Standard - Guidelines 06. Object-Oriented Programming (OOP) | Weaknesses in this category are related to the rules and recommendations in the Object-Oriented Programming (OOP) section of the SEI CERT Perl Coding Standard. |
| CWE-1185 | SEI CERT Perl Coding Standard - Guidelines 07. File Input and Output (FIO) | Weaknesses in this category are related to the rules and recommendations in the File Input and Output (FIO) section of the SEI CERT Perl Coding Standard. |
| CWE-1186 | SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC) | Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard. |
| CWE-1195 | Manufacturing and Life Cycle Management Concerns | Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain. |
| CWE-1196 | Security Flow Issues | Weaknesses in this category are related to improper design of full-system security flows, including but not limited to secure boot, secure update, and hardware-device attestation. |
| CWE-1197 | Integration Issues | Weaknesses in this category are those that arise due to integration of multiple hardware Intellectual Property (IP) cores, from System-on-a-Chip (SoC) subsystem interactions, or from hardware platform subsystem interactions. |
| CWE-1198 | Privilege Separation and Access Control Issues | Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses. |
| CWE-1199 | General Circuit and Logic Design Concerns | Weaknesses in this category are related to hardware-circuit design and logic (e.g., CMOS transistors, finite state machines, and registers) as well as issues related to hardware description languages such as System Verilog and VHDL. |
| CWE-1201 | Core and Compute Issues | Weaknesses in this category are typically associated with CPUs, Graphics, Vision, AI, FPGA, and microcontrollers. |
| CWE-1202 | Memory and Storage Issues | Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC). |
| CWE-1203 | Peripherals, On-chip Fabric, and Interface/IO Problems | Weaknesses in this category are related to hardware security problems that apply to peripheral devices, IO interfaces, on-chip interconnects, network-on-chip (NoC), and buses. For example, this category includes issues related to design of hardware interconnect and/or protocols such as PCIe, USB, SMBUS, general-purpose IO pins, and user-input peripherals such as mouse and keyboard. |
| CWE-1205 | Security Primitives and Cryptography Issues | Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs). |
| CWE-1206 | Power, Clock, Thermal, and Reset Concerns | Weaknesses in this category are related to system power, voltage, current, temperature, clocks, system state saving/restoring, and resets at the platform and SoC level. |
| CWE-1207 | Debug and Test Problems | Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain. |
| CWE-1208 | Cross-Cutting Problems | Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components. |
| CWE-1210 | Audit / Logging Errors | Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed. |
| CWE-1211 | Authentication Errors | Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability. |
| CWE-1212 | Authorization Errors | Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability. |
| CWE-1213 | Random Number Issues | Weaknesses in this category are related to a software system's random number generation. |
| CWE-1214 | Data Integrity Issues | Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed. |
| CWE-1215 | Data Validation Issues | Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed. |
| CWE-1216 | Lockout Mechanism Errors | Weaknesses in this category are related to a software system's lockout mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts to access a given resource. The weaknesses in this category could lead to a degradation of access to system assets if they are not addressed. |
| CWE-1217 | User Session Errors | Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed. |
| CWE-1218 | Memory Buffer Errors | Weaknesses in this category are related to the handling of memory buffers within a software system. |
| CWE-1219 | File Handling Issues | Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered. |
| CWE-1225 | Documentation Issues | Weaknesses in this category are related to the documentation provided to support, create, or analyze a product. |
| CWE-1226 | Complexity Issues | Weaknesses in this category are associated with things being overly complex. |
| CWE-1227 | Encapsulation Issues | Weaknesses in this category are related to issues surrounding the bundling of data with the methods intended to operate on that data. |
| CWE-1228 | API / Function Errors | Weaknesses in this category are related to the use of built-in functions or external APIs. |
| CWE-1237 | SFP Primary Cluster: Faulty Resource Release | This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37). |
| CWE-1238 | SFP Primary Cluster: Failure to Release Memory | This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38). |
| CWE-1306 | CISQ Quality Measures - Reliability | Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software. |
| CWE-1307 | CISQ Quality Measures - Maintainability | Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software. |
| CWE-1308 | CISQ Quality Measures - Security | Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software. |
| CWE-1309 | CISQ Quality Measures - Efficiency | Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software. |
| CWE-133 | String Errors | Weaknesses in this category are related to the creation and modification of strings. |
| CWE-1345 | OWASP Top Ten 2021 Category A01:2021 - Broken Access Control | Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021. |
| CWE-1346 | OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures | Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021. |
| CWE-1347 | OWASP Top Ten 2021 Category A03:2021 - Injection | Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top Ten 2021. |
| CWE-1348 | OWASP Top Ten 2021 Category A04:2021 - Insecure Design | Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top Ten 2021. |
| CWE-1349 | OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration | Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top Ten 2021. |
| CWE-1352 | OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components | Weaknesses in this category are related to the A06 category "Vulnerable and Outdated Components" in the OWASP Top Ten 2021. |
| CWE-1353 | OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures | Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top Ten 2021. |
| CWE-1354 | OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures | Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top Ten 2021. |
| CWE-1355 | OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures | Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top Ten 2021. |
| CWE-1356 | OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF) | Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top Ten 2021. |
| CWE-1359 | ICS Communications | Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022. |
| CWE-136 | Type Errors | Weaknesses in this category are caused by improper data type transformation or improper handling of multiple data types. |
| CWE-1360 | ICS Dependencies (& Architecture) | Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022. |
| CWE-1361 | ICS Supply Chain | Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022. |
| CWE-1362 | ICS Engineering (Constructions/Deployment) | Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022. |
| CWE-1363 | ICS Operations (& Maintenance) | Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022. |
| CWE-1364 | ICS Communications: Zone Boundary Failures | Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1365 | ICS Communications: Unreliability | Weaknesses in this category are related to the "Unreliability" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise in reaction to disruptions in the physical layer (e.g. creating electrical noise) used to carry the traffic." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1366 | ICS Communications: Frail Security in Protocols | Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1367 | ICS Dependencies (& Architecture): External Physical Systems | Weaknesses in this category are related to the "External Physical Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another physical system could cause an availability interruption for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1368 | ICS Dependencies (& Architecture): External Digital Systems | Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1369 | ICS Supply Chain: IT/OT Convergence/Expansion | Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-137 | Data Neutralization Issues | Weaknesses in this category are related to the creation or neutralization of data using an incorrect format. |
| CWE-1370 | ICS Supply Chain: Common Mode Frailties | Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1371 | ICS Supply Chain: Poorly Documented or Undocumented Features | Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1372 | ICS Supply Chain: OT Counterfeit and Malicious Corruption | Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1373 | ICS Engineering (Construction/Deployment): Trust Model Problems | Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1374 | ICS Engineering (Construction/Deployment): Maker Breaker Blindness | Weaknesses in this category are related to the "Maker Breaker Blindness" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Lack of awareness of deliberate attack techniques by people (vs failure modes from natural causes like weather or metal fatigue) may lead to insufficient security controls being built into ICS systems." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1375 | ICS Engineering (Construction/Deployment): Gaps in Details/Data | Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1376 | ICS Engineering (Construction/Deployment): Security Gaps in Commissioning | Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1377 | ICS Engineering (Construction/Deployment): Inherent Predictability in Design | Weaknesses in this category are related to the "Inherent Predictability in Design" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The commonality of design (in ICS/SCADA architectures) for energy systems and environments opens up the possibility of scaled compromise by leveraging the inherent predictability in the design." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1378 | ICS Operations (& Maintenance): Gaps in obligations and training | Weaknesses in this category are related to the "Gaps in obligations and training" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "OT ownership and responsibility for identifying and mitigating vulnerabilities are not clearly defined or communicated within an organization, leaving environments unpatched, exploitable, and with a broader attack surface." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1379 | ICS Operations (& Maintenance): Human factors in ICS environments | Weaknesses in this category are related to the "Human factors in ICS environments" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Environmental factors in ICS including physical duress, system complexities, and isolation may result in security gaps or inadequacies in the performance of individual duties and responsibilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1380 | ICS Operations (& Maintenance): Post-analysis changes | Weaknesses in this category are related to the "Post-analysis changes" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Changes made to a previously analyzed and approved ICS environment can introduce new security vulnerabilities (as opposed to safety)." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1381 | ICS Operations (& Maintenance): Exploitable Standard Operational Procedures | Weaknesses in this category are related to the "Exploitable Standard Operational Procedures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Standard ICS Operational Procedures developed for safety and operational functionality in a closed, controlled communications environment can introduce vulnerabilities in a more connected environment." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1382 | ICS Operations (& Maintenance): Emerging Energy Technologies | Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1383 | ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements | Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1388 | Physical Access Issues and Concerns | Weaknesses in this category are related to concerns of physical access. |
| CWE-139 | DEPRECATED: General Special Element Problems | This entry has been deprecated. It is a leftover from PLOVER, but CWE-138 is a more appropriate mapping. |
| CWE-1396 | Comprehensive Categorization: Access Control | Weaknesses in this category are related to access control. |
| CWE-1397 | Comprehensive Categorization: Comparison | Weaknesses in this category are related to comparison. |
| CWE-1398 | Comprehensive Categorization: Component Interaction | Weaknesses in this category are related to component interaction. |
| CWE-1399 | Comprehensive Categorization: Memory Safety | Weaknesses in this category are related to memory safety. |
| CWE-1401 | Comprehensive Categorization: Concurrency | Weaknesses in this category are related to concurrency. |
| CWE-1402 | Comprehensive Categorization: Encryption | Weaknesses in this category are related to encryption. |
| CWE-1403 | Comprehensive Categorization: Exposed Resource | Weaknesses in this category are related to exposed resource. |
| CWE-1404 | Comprehensive Categorization: File Handling | Weaknesses in this category are related to file handling. |
| CWE-1405 | Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions | Weaknesses in this category are related to improper check or handling of exceptional conditions. |
| CWE-1406 | Comprehensive Categorization: Improper Input Validation | Weaknesses in this category are related to improper input validation. |
| CWE-1407 | Comprehensive Categorization: Improper Neutralization | Weaknesses in this category are related to improper neutralization. |
| CWE-1408 | Comprehensive Categorization: Incorrect Calculation | Weaknesses in this category are related to incorrect calculation. |
| CWE-1409 | Comprehensive Categorization: Injection | Weaknesses in this category are related to injection. |
| CWE-1410 | Comprehensive Categorization: Insufficient Control Flow Management | Weaknesses in this category are related to insufficient control flow management. |
| CWE-1411 | Comprehensive Categorization: Insufficient Verification of Data Authenticity | Weaknesses in this category are related to insufficient verification of data authenticity. |
| CWE-1412 | Comprehensive Categorization: Poor Coding Practices | Weaknesses in this category are related to poor coding practices. |
| CWE-1413 | Comprehensive Categorization: Protection Mechanism Failure | Weaknesses in this category are related to protection mechanism failure. |
| CWE-1414 | Comprehensive Categorization: Randomness | Weaknesses in this category are related to randomness. |
| CWE-1415 | Comprehensive Categorization: Resource Control | Weaknesses in this category are related to resource control. |
| CWE-1416 | Comprehensive Categorization: Resource Lifecycle Management | Weaknesses in this category are related to resource lifecycle management. |
| CWE-1417 | Comprehensive Categorization: Sensitive Information Exposure | Weaknesses in this category are related to sensitive information exposure. |
| CWE-1418 | Comprehensive Categorization: Violation of Secure Design Principles | Weaknesses in this category are related to violation of secure design principles. |
| CWE-1433 | 2025 MIHW Supplement: Expert Insights | Weaknesses in this category were not included in the 2025 Most Important Hardware Weaknesses (MIHW) because they did not have sufficient weakness data to support their inclusion. However, they stand out as expert-driven selections. Each of these weaknesses received high scores from Subject Matter Experts, reflecting strong consensus among those with deep domain knowledge. |
| CWE-16 | Configuration | Weaknesses in this category are typically introduced during the configuration of the software. |
| CWE-169 | DEPRECATED: Technology-Specific Special Elements | This category has been deprecated. It was originally intended as a "catch-all" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy. |
| CWE-17 | DEPRECATED: Code | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-171 | DEPRECATED: Cleansing, Canonicalization, and Comparison Errors | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories. |
| CWE-18 | DEPRECATED: Source Code | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-189 | Numeric Errors | Weaknesses in this category are related to improper calculation or conversion of numbers. |
| CWE-19 | Data Processing Errors | Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information. |
| CWE-199 | Information Management Errors | Weaknesses in this category are related to improper handling of sensitive information. |
| CWE-2 | 7PK - Environment | This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms." |
| CWE-21 | DEPRECATED: Pathname Traversal and Equivalence Errors | This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706). |
| CWE-227 | 7PK - API Abuse | This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated." |
| CWE-251 | Often Misused: String Management | Functions that manipulate strings encourage buffer overflows. |
| CWE-254 | 7PK - Security Features | Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management. |
| CWE-255 | Credentials Management Errors | Weaknesses in this category are related to the management of credentials. |
| CWE-264 | Permissions, Privileges, and Access Controls | Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control. |
| CWE-265 | Privilege Issues | Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer. |
| CWE-275 | Permission Issues | Weaknesses in this category are related to improper assignment or handling of permissions. |
| CWE-3 | DEPRECATED: Technology-specific Environment Issues | This category has been deprecated. It was originally intended as a "catch-all" for environment issues for technologies that did not have their own CWE, but it introduced unnecessary depth and complexity to the Development View (CWE-699). |
| CWE-310 | Cryptographic Issues | Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed. |
| CWE-320 | Key Management Errors | Weaknesses in this category are related to errors in the management of cryptographic keys. |
| CWE-355 | User Interface Security Issues | Weaknesses in this category are related to or introduced in the User Interface (UI). |
| CWE-361 | 7PK - Time and State | This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information." |
| CWE-371 | State Issues | Weaknesses in this category are related to improper management of system state. |
| CWE-376 | DEPRECATED: Temporary File Issues | This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219). |
| CWE-380 | DEPRECATED: Technology-Specific Time and State Issues | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-381 | DEPRECATED: J2EE Time and State Issues | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-387 | Signal Errors | Weaknesses in this category are related to the improper handling of signals. |
| CWE-388 | 7PK - Errors | This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle." |
| CWE-389 | Error Conditions, Return Values, Status Codes | This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions. |
| CWE-398 | 7PK - Code Quality | This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways." |
| CWE-399 | Resource Management Errors | Weaknesses in this category are related to improper management of system resources. |
| CWE-4 | DEPRECATED: J2EE Environment Issues | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-411 | Resource Locking Problems | Weaknesses in this category are related to improper handling of locks that are used to control access to resources. |
| CWE-417 | Communication Channel Errors | Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors. |
| CWE-418 | DEPRECATED: Channel Errors | This category has been deprecated because it redundant with the grouping provided by CWE-417. |
| CWE-429 | Handler Errors | Weaknesses in this category are related to improper management of handlers. |
| CWE-438 | Behavioral Problems | Weaknesses in this category are related to unexpected behaviors from code that an application uses. |
| CWE-442 | DEPRECATED: Web Problems | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-445 | DEPRECATED: User Interface Errors | This weakness has been deprecated because it was a duplicate of CWE-355. All content has been transferred to CWE-355. |
| CWE-452 | Initialization and Cleanup Errors | Weaknesses in this category occur in behaviors that are used for initialization and breakdown. |
| CWE-461 | DEPRECATED: Data Structure Issues | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-465 | Pointer Issues | Weaknesses in this category are related to improper handling of pointers. |
| CWE-485 | 7PK - Encapsulation | This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not." |
| CWE-490 | DEPRECATED: Mobile Code Issues | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-503 | DEPRECATED: Byte/Object Code | This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-504 | DEPRECATED: Motivation/Intent | This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-505 | DEPRECATED: Intentionally Introduced Weakness | This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-513 | DEPRECATED: Intentionally Introduced Nonmalicious Weakness | This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-517 | DEPRECATED: Other Intentional, Nonmalicious Weakness | This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-518 | DEPRECATED: Inadvertently Introduced Weakness | This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-519 | DEPRECATED: .NET Environment Issues | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-557 | Concurrency Issues | Weaknesses in this category are related to concurrent use of shared resources. |
| CWE-559 | DEPRECATED: Often Misused: Arguments and Parameters | This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. |
| CWE-569 | Expression Issues | Weaknesses in this category are related to incorrectly written expressions within code. |
| CWE-60 | DEPRECATED: UNIX Path Link Problems | This category has been deprecated. It covered a very low level of abstraction based on operating system, which was not useful for any existing view. |
| CWE-63 | DEPRECATED: Windows Path Link Problems | This category has been deprecated. It covered a very low level of abstraction based on operating system, which was not useful for any existing view. |
| CWE-632 | DEPRECATED: Weaknesses that Affect Files or Directories | This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE. |
| CWE-633 | DEPRECATED: Weaknesses that Affect Memory | This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE. |
| CWE-634 | DEPRECATED: Weaknesses that Affect System Processes | This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE. |
| CWE-68 | DEPRECATED: Windows Virtual File Problems | This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships. |
| CWE-70 | DEPRECATED: Mac Virtual File Problems | This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships. |
| CWE-712 | OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS) | Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2007. |
| CWE-713 | OWASP Top Ten 2007 Category A2 - Injection Flaws | Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2007. |
| CWE-714 | OWASP Top Ten 2007 Category A3 - Malicious File Execution | Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2007. |
| CWE-715 | OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference | Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2007. |
| CWE-716 | OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF) | Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2007. |
| CWE-717 | OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling | Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2007. |
| CWE-718 | OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management | Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2007. |
| CWE-719 | OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage | Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2007. |
| CWE-720 | OWASP Top Ten 2007 Category A9 - Insecure Communications | Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2007. |
| CWE-721 | OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access | Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2007. |
| CWE-722 | OWASP Top Ten 2004 Category A1 - Unvalidated Input | Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2004. |
| CWE-723 | OWASP Top Ten 2004 Category A2 - Broken Access Control | Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2004. |
| CWE-724 | OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management | Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2004. |
| CWE-725 | OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws | Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2004. |
| CWE-726 | OWASP Top Ten 2004 Category A5 - Buffer Overflows | Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2004. |
| CWE-727 | OWASP Top Ten 2004 Category A6 - Injection Flaws | Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2004. |
| CWE-728 | OWASP Top Ten 2004 Category A7 - Improper Error Handling | Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2004. |
| CWE-729 | OWASP Top Ten 2004 Category A8 - Insecure Storage | Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2004. |
| CWE-730 | OWASP Top Ten 2004 Category A9 - Denial of Service | Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2004. |
| CWE-731 | OWASP Top Ten 2004 Category A10 - Insecure Configuration Management | Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2004. |
| CWE-735 | CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE) | Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-736 | CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL) | Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-737 | CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP) | Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-738 | CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT) | Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-739 | CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP) | Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-740 | CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR) | Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-741 | CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR) | Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-742 | CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM) | Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-743 | CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO) | Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-744 | CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV) | Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-745 | CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG) | Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-746 | CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR) | Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-747 | CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC) | Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008). |
| CWE-748 | CERT C Secure Coding Standard (2008) Appendix - POSIX (POS) | Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008). |
| CWE-751 | 2009 Top 25 - Insecure Interaction Between Components | Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors. |
| CWE-752 | 2009 Top 25 - Risky Resource Management | Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors. |
| CWE-753 | 2009 Top 25 - Porous Defenses | Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors. |
| CWE-801 | 2010 Top 25 - Insecure Interaction Between Components | Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors. |
| CWE-802 | 2010 Top 25 - Risky Resource Management | Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors. |
| CWE-803 | 2010 Top 25 - Porous Defenses | Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors. |
| CWE-808 | 2010 Top 25 - Weaknesses On the Cusp | Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn. |
| CWE-810 | OWASP Top Ten 2010 Category A1 - Injection | Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2010. |
| CWE-811 | OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS) | Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2010. |
| CWE-812 | OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management | Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2010. |
| CWE-813 | OWASP Top Ten 2010 Category A4 - Insecure Direct Object References | Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2010. |
| CWE-814 | OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF) | Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2010. |
| CWE-815 | OWASP Top Ten 2010 Category A6 - Security Misconfiguration | Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2010. |
| CWE-816 | OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage | Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2010. |
| CWE-817 | OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access | Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2010. |
| CWE-818 | OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection | Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2010. |
| CWE-819 | OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards | Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2010. |
| CWE-840 | Business Logic Errors | Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses. |
| CWE-845 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS) | Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-846 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL) | Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-847 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP) | Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-848 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM) | Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-849 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ) | Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-850 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET) | Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-851 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR) | Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-852 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA) | Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-853 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK) | Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-854 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI) | Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-855 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS) | Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-856 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 13 - Thread-Safety Miscellaneous (TSM) | Weaknesses in this category are related to rules in the Thread-Safety Miscellaneous (TSM) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-857 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO) | Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-858 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER) | Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-859 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC) | Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-860 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV) | Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-861 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC) | Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011). |
| CWE-864 | 2011 Top 25 - Insecure Interaction Between Components | Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors. |
| CWE-865 | 2011 Top 25 - Risky Resource Management | Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors. |
| CWE-866 | 2011 Top 25 - Porous Defenses | Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors. |
| CWE-867 | 2011 Top 25 - Weaknesses On the Cusp | Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn. |
| CWE-869 | CERT C++ Secure Coding Section 01 - Preprocessor (PRE) | Weaknesses in this category are related to rules in the Preprocessor (PRE) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-870 | CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL) | Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-871 | CERT C++ Secure Coding Section 03 - Expressions (EXP) | Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-872 | CERT C++ Secure Coding Section 04 - Integers (INT) | Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-873 | CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP) | Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-874 | CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR) | Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-875 | CERT C++ Secure Coding Section 07 - Characters and Strings (STR) | Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-876 | CERT C++ Secure Coding Section 08 - Memory Management (MEM) | Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-877 | CERT C++ Secure Coding Section 09 - Input Output (FIO) | Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-878 | CERT C++ Secure Coding Section 10 - Environment (ENV) | Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-879 | CERT C++ Secure Coding Section 11 - Signals (SIG) | Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-880 | CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR) | Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-881 | CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP) | Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-882 | CERT C++ Secure Coding Section 14 - Concurrency (CON) | Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-883 | CERT C++ Secure Coding Section 49 - Miscellaneous (MSC) | Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete. |
| CWE-885 | SFP Primary Cluster: Risky Values | This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1). |
| CWE-886 | SFP Primary Cluster: Unused entities | This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2). |
| CWE-887 | SFP Primary Cluster: API | This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3). |
| CWE-889 | SFP Primary Cluster: Exception Management | This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6). |
| CWE-890 | SFP Primary Cluster: Memory Access | This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8). |
| CWE-891 | SFP Primary Cluster: Memory Management | This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38). |
| CWE-892 | SFP Primary Cluster: Resource Management | This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37). |
| CWE-893 | SFP Primary Cluster: Path Resolution | This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18). |
| CWE-894 | SFP Primary Cluster: Synchronization | This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22). |
| CWE-895 | SFP Primary Cluster: Information Leak | This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23). |
| CWE-896 | SFP Primary Cluster: Tainted Input | This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27). |
| CWE-897 | SFP Primary Cluster: Entry Points | This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28). |
| CWE-898 | SFP Primary Cluster: Authentication | This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34). |
| CWE-899 | SFP Primary Cluster: Access Control | This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35). |
| CWE-901 | SFP Primary Cluster: Privilege | This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36). |
| CWE-902 | SFP Primary Cluster: Channel | This category identifies Software Fault Patterns (SFPs) within the Channel cluster. |
| CWE-903 | SFP Primary Cluster: Cryptography | This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster. |
| CWE-904 | SFP Primary Cluster: Malware | This category identifies Software Fault Patterns (SFPs) within the Malware cluster. |
| CWE-905 | SFP Primary Cluster: Predictability | This category identifies Software Fault Patterns (SFPs) within the Predictability cluster. |
| CWE-906 | SFP Primary Cluster: UI | This category identifies Software Fault Patterns (SFPs) within the UI cluster. |
| CWE-907 | SFP Primary Cluster: Other | This category identifies Software Fault Patterns (SFPs) within the Other cluster. |
| CWE-929 | OWASP Top Ten 2013 Category A1 - Injection | Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2013. |
| CWE-930 | OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management | Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2013. |
| CWE-931 | OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS) | Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2013. |
| CWE-932 | OWASP Top Ten 2013 Category A4 - Insecure Direct Object References | Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2013. |
| CWE-933 | OWASP Top Ten 2013 Category A5 - Security Misconfiguration | Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2013. |
| CWE-934 | OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure | Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2013. |
| CWE-935 | OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control | Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2013. |
| CWE-936 | OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF) | Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2013. |
| CWE-937 | OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities | Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013. |
| CWE-938 | OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards | Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2013. |
| CWE-944 | SFP Secondary Cluster: Access Management | This category identifies Software Fault Patterns (SFPs) within the Access Management cluster. |
| CWE-945 | SFP Secondary Cluster: Insecure Resource Access | This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35). |
| CWE-946 | SFP Secondary Cluster: Insecure Resource Permissions | This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster. |
| CWE-947 | SFP Secondary Cluster: Authentication Bypass | This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster. |
| CWE-948 | SFP Secondary Cluster: Digital Certificate | This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster. |
| CWE-949 | SFP Secondary Cluster: Faulty Endpoint Authentication | This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29). |
| CWE-950 | SFP Secondary Cluster: Hardcoded Sensitive Data | This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33). |
| CWE-951 | SFP Secondary Cluster: Insecure Authentication Policy | This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster. |
| CWE-952 | SFP Secondary Cluster: Missing Authentication | This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster. |
| CWE-953 | SFP Secondary Cluster: Missing Endpoint Authentication | This category identifies Software Fault Patterns (SFPs) within the Missing Endpoint Authentication cluster (SFP30). |
| CWE-954 | SFP Secondary Cluster: Multiple Binds to the Same Port | This category identifies Software Fault Patterns (SFPs) within the Multiple Binds to the Same Port cluster (SFP32). |
| CWE-955 | SFP Secondary Cluster: Unrestricted Authentication | This category identifies Software Fault Patterns (SFPs) within the Unrestricted Authentication cluster (SFP34). |
| CWE-956 | SFP Secondary Cluster: Channel Attack | This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster. |
| CWE-957 | SFP Secondary Cluster: Protocol Error | This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster. |
| CWE-958 | SFP Secondary Cluster: Broken Cryptography | This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster. |
| CWE-959 | SFP Secondary Cluster: Weak Cryptography | This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster. |
| CWE-960 | SFP Secondary Cluster: Ambiguous Exception Type | This category identifies Software Fault Patterns (SFPs) within the Ambiguous Exception Type cluster (SFP5). |
| CWE-961 | SFP Secondary Cluster: Incorrect Exception Behavior | This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6). |
| CWE-962 | SFP Secondary Cluster: Unchecked Status Condition | This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4). |
| CWE-963 | SFP Secondary Cluster: Exposed Data | This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23). |
| CWE-964 | SFP Secondary Cluster: Exposure Temporary File | This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster. |
| CWE-965 | SFP Secondary Cluster: Insecure Session Management | This category identifies Software Fault Patterns (SFPs) within the Insecure Session Management cluster. |
| CWE-966 | SFP Secondary Cluster: Other Exposures | This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster. |
| CWE-967 | SFP Secondary Cluster: State Disclosure | This category identifies Software Fault Patterns (SFPs) within the State Disclosure cluster. |
| CWE-968 | SFP Secondary Cluster: Covert Channel | This category identifies Software Fault Patterns (SFPs) within the Covert Channel cluster. |
| CWE-969 | SFP Secondary Cluster: Faulty Memory Release | This category identifies Software Fault Patterns (SFPs) within the Faulty Memory Release cluster (SFP12). |
| CWE-970 | SFP Secondary Cluster: Faulty Buffer Access | This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8). |
| CWE-971 | SFP Secondary Cluster: Faulty Pointer Use | This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7). |
| CWE-972 | SFP Secondary Cluster: Faulty String Expansion | This category identifies Software Fault Patterns (SFPs) within the Faulty String Expansion cluster (SFP9). |
| CWE-973 | SFP Secondary Cluster: Improper NULL Termination | This category identifies Software Fault Patterns (SFPs) within the Improper NULL Termination cluster (SFP11). |
| CWE-974 | SFP Secondary Cluster: Incorrect Buffer Length Computation | This category identifies Software Fault Patterns (SFPs) within the Incorrect Buffer Length Computation cluster (SFP10). |
| CWE-975 | SFP Secondary Cluster: Architecture | This category identifies Software Fault Patterns (SFPs) within the Architecture cluster. |
| CWE-976 | SFP Secondary Cluster: Compiler | This category identifies Software Fault Patterns (SFPs) within the Compiler cluster. |
| CWE-977 | SFP Secondary Cluster: Design | This category identifies Software Fault Patterns (SFPs) within the Design cluster. |
| CWE-978 | SFP Secondary Cluster: Implementation | This category identifies Software Fault Patterns (SFPs) within the Implementation cluster. |
| CWE-979 | SFP Secondary Cluster: Failed Chroot Jail | This category identifies Software Fault Patterns (SFPs) within the Failed Chroot Jail cluster (SFP17). |
| CWE-980 | SFP Secondary Cluster: Link in Resource Name Resolution | This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18). |
| CWE-981 | SFP Secondary Cluster: Path Traversal | This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16). |
| CWE-982 | SFP Secondary Cluster: Failure to Release Resource | This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14). |
| CWE-983 | SFP Secondary Cluster: Faulty Resource Use | This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15). |
| CWE-984 | SFP Secondary Cluster: Life Cycle | This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster. |
| CWE-985 | SFP Secondary Cluster: Unrestricted Consumption | This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13). |
| CWE-986 | SFP Secondary Cluster: Missing Lock | This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19). |
| CWE-987 | SFP Secondary Cluster: Multiple Locks/Unlocks | This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21). |
| CWE-988 | SFP Secondary Cluster: Race Condition Window | This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20). |
| CWE-989 | SFP Secondary Cluster: Unrestricted Lock | This category identifies Software Fault Patterns (SFPs) within the Unrestricted Lock cluster (SFP22). |
| CWE-990 | SFP Secondary Cluster: Tainted Input to Command | This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24). |
| CWE-991 | SFP Secondary Cluster: Tainted Input to Environment | This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27). |
| CWE-992 | SFP Secondary Cluster: Faulty Input Transformation | This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster. |
| CWE-993 | SFP Secondary Cluster: Incorrect Input Handling | This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster. |
| CWE-994 | SFP Secondary Cluster: Tainted Input to Variable | This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25). |
| CWE-995 | SFP Secondary Cluster: Feature | This category identifies Software Fault Patterns (SFPs) within the Feature cluster. |
| CWE-996 | SFP Secondary Cluster: Security | This category identifies Software Fault Patterns (SFPs) within the Security cluster. |
| CWE-997 | SFP Secondary Cluster: Information Loss | This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster. |
| CWE-998 | SFP Secondary Cluster: Glitch in Computation | This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1). |
| CWE-1000 | Research Concepts | This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE. |
| CWE-1003 | Weaknesses for Simplified Mapping of Published Vulnerabilities | CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete. It is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex navigation of the entire CWE corpus. |
| CWE-1008 | Architectural Concepts | This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software. |
| CWE-1026 | Weaknesses in OWASP Top Ten (2017) | CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2017. |
| CWE-1040 | Quality Weaknesses with Indirect Security Impacts | CWE identifiers in this view (slice) are quality issues that only indirectly make it easier to introduce a vulnerability and/or make the vulnerability more difficult to detect or mitigate. |
| CWE-1081 | Entries with Maintenance Notes | CWE entries in this view have maintenance notes. Maintenance notes are an indicator that an entry might change significantly in future versions. This view was created due to feedback from the CWE Board and participants in the CWE Compatibility Summit in March 2021. |
| CWE-1128 | CISQ Quality Measures (2016) | This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards. |
| CWE-1133 | Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java | CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java. |
| CWE-1154 | Weaknesses Addressed by the SEI CERT C Coding Standard | CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard. |
| CWE-1178 | Weaknesses Addressed by the SEI CERT Perl Coding Standard | CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard. |
| CWE-1194 | Hardware Design | This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping. |
| CWE-1200 | Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors | CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors. |
| CWE-1305 | CISQ Quality Measures (2020) | This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards. |
| CWE-1337 | Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses | CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses. |
| CWE-1340 | CISQ Data Protection Measures | This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group. |
| CWE-1343 | Weaknesses in the 2021 CWE Most Important Hardware Weaknesses List | CWE entries in this view are listed in the 2021 CWE Most Important Hardware Weaknesses List, as determined by the Hardware CWE Special Interest Group (HW CWE SIG). |
| CWE-1344 | Weaknesses in OWASP Top Ten (2021) | CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021. |
| CWE-1350 | Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses | CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses. |
| CWE-1358 | Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS | CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions. |
| CWE-1387 | Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses | CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses. |
| CWE-1400 | Comprehensive Categorization for Software Assurance Trends | |
| CWE-1424 | Weaknesses Addressed by ISA/IEC 62443 Requirements | This view (slice) covers weaknesses that are addressed by following requirements in the ISA/IEC 62443 series of standards for industrial automation and control systems (IACS). Members of the CWE ICS/OT SIG analyzed a set of CWEs and mapped them to specific requirements covered by ISA/IEC 62443. These mappings are recorded in Taxonomy_Mapping elements. |
| CWE-1425 | Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses | CWE entries in this view are listed in the 2023 CWE Top 25 Most Dangerous Software Weaknesses. |
| CWE-1430 | Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses | CWE entries in this view are listed in the 2024 CWE Top 25 Most Dangerous Software Weaknesses. |
| CWE-1432 | Weaknesses in the 2025 CWE Most Important Hardware Weaknesses List | CWE entries in this view are listed in the 2025 CWE Most Important Hardware Weaknesses List, as determined by the Hardware CWE Special Interest Group (HW CWE SIG). The 2025 MIHW aims to drive awareness of critical hardware weaknesses and provide the cybersecurity community with practical guidance to prevent security issues at the source. By combining advanced data analysis with expert consensus, the list helps organizations prioritize mitigations, strengthen design practices, and make informed decisions throughout the hardware lifecycle. |
| CWE-2000 | Comprehensive CWE Dictionary | This view (slice) covers all the elements in CWE. |
| CWE-604 | Deprecated Entries | CWE nodes in this view (slice) have been deprecated. There should be a reference pointing to the replacement in each deprecated weakness. |
| CWE-629 | Weaknesses in OWASP Top Ten (2007) | CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top Ten is available. |
| CWE-630 | DEPRECATED: Weaknesses Examined by SAMATE | This view has been deprecated. It was only used for an early year of the NIST SAMATE project, and it did not represent any official or commonly-utilized list. |
| CWE-631 | DEPRECATED: Resource-specific Weaknesses | This view has been deprecated because it is not actively maintained and does not provide utility to stakeholders. It was originally created before CWE 1.0 as a simple example of how views could be structured within CWE. |
| CWE-635 | Weaknesses Originally Used by NVD from 2008 to 2016 | CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects. |
| CWE-658 | Weaknesses in Software Written in C | This view (slice) covers issues that are found in C programs that are not common to all languages. |
| CWE-659 | Weaknesses in Software Written in C++ | This view (slice) covers issues that are found in C++ programs that are not common to all languages. |
| CWE-660 | Weaknesses in Software Written in Java | This view (slice) covers issues that are found in Java programs that are not common to all languages. |
| CWE-661 | Weaknesses in Software Written in PHP | This view (slice) covers issues that are found in PHP programs that are not common to all languages. |
| CWE-677 | Weakness Base Elements | This view (slice) displays only weakness base elements. |
| CWE-678 | Composites | This view displays only composite weaknesses. |
| CWE-679 | DEPRECATED: Chain Elements | This view has been deprecated. It has limited utility for stakeholders, since all weaknesses can be links in a chain. |
| CWE-699 | Software Development | This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping. |
| CWE-700 | Seven Pernicious Kingdoms | This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms. |
| CWE-701 | Weaknesses Introduced During Design | This view (slice) lists weaknesses that can be introduced during design. |
| CWE-702 | Weaknesses Introduced During Implementation | This view (slice) lists weaknesses that can be introduced during implementation. |
| CWE-709 | Named Chains | This view displays Named Chains and their components. |
| CWE-711 | Weaknesses in OWASP Top Ten (2004) | CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top Ten is available. |
| CWE-734 | Weaknesses Addressed by the CERT C Secure Coding Standard (2008) | CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008. |
| CWE-750 | Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors | CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available. |
| CWE-800 | Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors | CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available. |
| CWE-809 | Weaknesses in OWASP Top Ten (2010) | CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top Ten is available. |
| CWE-844 | Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011) | CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available. |
| CWE-868 | Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version) | CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016. |
| CWE-884 | CWE Cross-section | This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries. |
| CWE-888 | Software Fault Pattern (SFP) Clusters | CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs). |
| CWE-900 | Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors | CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors. |
| CWE-919 | Weaknesses in Mobile Applications | CWE entries in this view (slice) are often seen in mobile applications. |
| CWE-928 | Weaknesses in OWASP Top Ten (2013) | CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top Ten is available. |
| CWE-999 | DEPRECATED: Weaknesses without Software Fault Patterns | This view has been deprecated. It was based on gaps in another view (CWE-888) related to research that is no longer updated, but was complete with respect to CWE at the time it was conducted. |
Mapping Notes
Usage: Prohibited
Reasons: View
Rationale:
This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Comment:
Use this View or other Views to search and navigate for the appropriate weakness.