MITRE CWE 4.19.1
CWE vulnerability database
The mistakes behind every vulnerability, and how to stop making them.
Every weakness in MITRE's Common Weakness Enumeration: what it is, what it lets an attacker do, how to prevent it and how to find it, with the CVEs attackers have exploited in the wild because of it.
969 weaknesses · 181 behind known exploited vulnerabilities
Exploited most often
The weaknesses behind the most CVEs in CISA's Known Exploited Vulnerabilities catalog.
- CWE-20Improper Input Validation · 119 exploited CVEs
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') · 110 exploited CVEs
- CWE-787Out-of-bounds Write · 105 exploited CVEs
- CWE-416Use After Free · 93 exploited CVEs
- CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer · 88 exploited CVEs
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') · 81 exploited CVEs
- CWE-94Improper Control of Generation of Code ('Code Injection') · 71 exploited CVEs
- CWE-502Deserialization of Untrusted Data · 71 exploited CVEs
- CWE-287Improper Authentication · 47 exploited CVEs
- CWE-306Missing Authentication for Critical Function · 42 exploited CVEs
- CWE-843Access of Resource Using Incompatible Type ('Type Confusion') · 38 exploited CVEs
- CWE-284Improper Access Control · 37 exploited CVEs
All weaknesses
969 weaknesses
- CWE-5J2EE Misconfiguration: Data Transmission Without Encryption
- CWE-6J2EE Misconfiguration: Insufficient Session-ID Length
- CWE-7J2EE Misconfiguration: Missing Custom Error Page
- CWE-8J2EE Misconfiguration: Entity Bean Declared Remote
- CWE-9J2EE Misconfiguration: Weak Access Permissions for EJB Methods
- CWE-11ASP.NET Misconfiguration: Creating Debug Binary
- CWE-12ASP.NET Misconfiguration: Missing Custom Error Page
- CWE-13ASP.NET Misconfiguration: Password in Configuration File
- CWE-14Compiler Removal of Code to Clear Buffers
- CWE-15External Control of System or Configuration Setting
- CWE-20Improper Input Validation
- CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-23Relative Path Traversal
- CWE-24Path Traversal: '../filedir'
- CWE-25Path Traversal: '/../filedir'
- CWE-26Path Traversal: '/dir/../filename'
- CWE-27Path Traversal: 'dir/../../filename'
- CWE-28Path Traversal: '..\filedir'
- CWE-29Path Traversal: '\..\filename'
- CWE-30Path Traversal: '\dir\..\filename'
- CWE-31Path Traversal: 'dir\..\..\filename'
- CWE-32Path Traversal: '...' (Triple Dot)
- CWE-33Path Traversal: '....' (Multiple Dot)
- CWE-34Path Traversal: '....//'
- CWE-35Path Traversal: '.../...//'
- CWE-36Absolute Path Traversal
- CWE-37Path Traversal: '/absolute/pathname/here'
- CWE-38Path Traversal: '\absolute\pathname\here'
- CWE-39Path Traversal: 'C:dirname'
- CWE-40Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
- CWE-41Improper Resolution of Path Equivalence
- CWE-42Path Equivalence: 'filename.' (Trailing Dot)
- CWE-43Path Equivalence: 'filename....' (Multiple Trailing Dot)
- CWE-44Path Equivalence: 'file.name' (Internal Dot)
- CWE-45Path Equivalence: 'file...name' (Multiple Internal Dot)
- CWE-46Path Equivalence: 'filename ' (Trailing Space)
- CWE-47Path Equivalence: ' filename' (Leading Space)
- CWE-48Path Equivalence: 'file name' (Internal Whitespace)
- CWE-49Path Equivalence: 'filename/' (Trailing Slash)
- CWE-50Path Equivalence: '//multiple/leading/slash'
- CWE-51Path Equivalence: '/multiple//internal/slash'
- CWE-52Path Equivalence: '/multiple/trailing/slash//'
- CWE-53Path Equivalence: '\multiple\\internal\backslash'
- CWE-54Path Equivalence: 'filedir\' (Trailing Backslash)
- CWE-55Path Equivalence: '/./' (Single Dot Directory)
- CWE-56Path Equivalence: 'filedir*' (Wildcard)
- CWE-57Path Equivalence: 'fakedir/../realdir/filename'
- CWE-58Path Equivalence: Windows 8.3 Filename
- CWE-59Improper Link Resolution Before File Access ('Link Following')
- CWE-61UNIX Symbolic Link (Symlink) Following
- CWE-62UNIX Hard Link
- CWE-64Windows Shortcut Following (.LNK)
- CWE-65Windows Hard Link
- CWE-66Improper Handling of File Names that Identify Virtual Resources
- CWE-67Improper Handling of Windows Device Names
- CWE-69Improper Handling of Windows ::DATA Alternate Data Stream
- CWE-71DEPRECATED: Apple '.DS_Store'
- CWE-72Improper Handling of Apple HFS+ Alternate Data Stream Path
- CWE-73External Control of File Name or Path
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
- CWE-76Improper Neutralization of Equivalent Special Elements
- CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CWE-81Improper Neutralization of Script in an Error Message Web Page
- CWE-82Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
- CWE-83Improper Neutralization of Script in Attributes in a Web Page
- CWE-84Improper Neutralization of Encoded URI Schemes in a Web Page
- CWE-85Doubled Character XSS Manipulations
- CWE-86Improper Neutralization of Invalid Characters in Identifiers in Web Pages
- CWE-87Improper Neutralization of Alternate XSS Syntax
- CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
- CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
- CWE-91XML Injection (aka Blind XPath Injection)
- CWE-92DEPRECATED: Improper Sanitization of Custom Special Characters
- CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CWE-94Improper Control of Generation of Code ('Code Injection')
- CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
- CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- CWE-97Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
- CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
- CWE-99Improper Control of Resource Identifiers ('Resource Injection')
- CWE-102Struts: Duplicate Validation Forms
- CWE-103Struts: Incomplete validate() Method Definition
- CWE-104Struts: Form Bean Does Not Extend Validation Class
- CWE-105Struts: Form Field Without Validator
- CWE-106Struts: Plug-in Framework not in Use
- CWE-107Struts: Unused Validation Form
- CWE-108Struts: Unvalidated Action Form
- CWE-109Struts: Validator Turned Off
- CWE-110Struts: Validator Without Form Field
- CWE-111Direct Use of Unsafe JNI
- CWE-112Missing XML Validation
- CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
- CWE-114Process Control
- CWE-115Misinterpretation of Input
- CWE-116Improper Encoding or Escaping of Output
- CWE-117Improper Output Neutralization for Logs
- CWE-118Incorrect Access of Indexable Resource ('Range Error')
- CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
- CWE-121Stack-based Buffer Overflow
- CWE-122Heap-based Buffer Overflow
- CWE-123Write-what-where Condition
- CWE-124Buffer Underwrite ('Buffer Underflow')
- CWE-125Out-of-bounds Read
- CWE-126Buffer Over-read
- CWE-127Buffer Under-read
- CWE-128Wrap-around Error
- CWE-129Improper Validation of Array Index
- CWE-130Improper Handling of Length Parameter Inconsistency
- CWE-131Incorrect Calculation of Buffer Size
- CWE-132DEPRECATED: Miscalculated Null Termination
- CWE-134Use of Externally-Controlled Format String
- CWE-135Incorrect Calculation of Multi-Byte String Length
- CWE-138Improper Neutralization of Special Elements
- CWE-140Improper Neutralization of Delimiters
- CWE-141Improper Neutralization of Parameter/Argument Delimiters
- CWE-142Improper Neutralization of Value Delimiters
- CWE-143Improper Neutralization of Record Delimiters
- CWE-144Improper Neutralization of Line Delimiters
- CWE-145Improper Neutralization of Section Delimiters
- CWE-146Improper Neutralization of Expression/Command Delimiters
- CWE-147Improper Neutralization of Input Terminators
- CWE-148Improper Neutralization of Input Leaders
- CWE-149Improper Neutralization of Quoting Syntax
- CWE-150Improper Neutralization of Escape, Meta, or Control Sequences
- CWE-151Improper Neutralization of Comment Delimiters
- CWE-152Improper Neutralization of Macro Symbols
- CWE-153Improper Neutralization of Substitution Characters
- CWE-154Improper Neutralization of Variable Name Delimiters
- CWE-155Improper Neutralization of Wildcards or Matching Symbols
- CWE-156Improper Neutralization of Whitespace
- CWE-157Failure to Sanitize Paired Delimiters
- CWE-158Improper Neutralization of Null Byte or NUL Character
- CWE-159Improper Handling of Invalid Use of Special Elements
- CWE-160Improper Neutralization of Leading Special Elements
- CWE-161Improper Neutralization of Multiple Leading Special Elements
- CWE-162Improper Neutralization of Trailing Special Elements
- CWE-163Improper Neutralization of Multiple Trailing Special Elements
- CWE-164Improper Neutralization of Internal Special Elements
- CWE-165Improper Neutralization of Multiple Internal Special Elements
- CWE-166Improper Handling of Missing Special Element
- CWE-167Improper Handling of Additional Special Element
- CWE-168Improper Handling of Inconsistent Special Elements
- CWE-170Improper Null Termination
- CWE-172Encoding Error
- CWE-173Improper Handling of Alternate Encoding
- CWE-174Double Decoding of the Same Data
- CWE-175Improper Handling of Mixed Encoding
- CWE-176Improper Handling of Unicode Encoding
- CWE-177Improper Handling of URL Encoding (Hex Encoding)
- CWE-178Improper Handling of Case Sensitivity
- CWE-179Incorrect Behavior Order: Early Validation
- CWE-180Incorrect Behavior Order: Validate Before Canonicalize
- CWE-181Incorrect Behavior Order: Validate Before Filter
- CWE-182Collapse of Data into Unsafe Value
- CWE-183Permissive List of Allowed Inputs
- CWE-184Incomplete List of Disallowed Inputs
- CWE-185Incorrect Regular Expression
- CWE-186Overly Restrictive Regular Expression
- CWE-187Partial String Comparison
- CWE-188Reliance on Data/Memory Layout
- CWE-190Integer Overflow or Wraparound
- CWE-191Integer Underflow (Wrap or Wraparound)
- CWE-192Integer Coercion Error
- CWE-193Off-by-one Error
- CWE-194Unexpected Sign Extension
- CWE-195Signed to Unsigned Conversion Error
- CWE-196Unsigned to Signed Conversion Error
- CWE-197Numeric Truncation Error
- CWE-198Use of Incorrect Byte Ordering
- CWE-200Exposure of Sensitive Information to an Unauthorized Actor
- CWE-201Insertion of Sensitive Information Into Sent Data
- CWE-202Exposure of Sensitive Information Through Data Queries
- CWE-203Observable Discrepancy
- CWE-204Observable Response Discrepancy
- CWE-205Observable Behavioral Discrepancy
- CWE-206Observable Internal Behavioral Discrepancy
- CWE-207Observable Behavioral Discrepancy With Equivalent Products
- CWE-208Observable Timing Discrepancy
- CWE-209Generation of Error Message Containing Sensitive Information
- CWE-210Self-generated Error Message Containing Sensitive Information
- CWE-211Externally-Generated Error Message Containing Sensitive Information
- CWE-212Improper Removal of Sensitive Information Before Storage or Transfer
- CWE-213Exposure of Sensitive Information Due to Incompatible Policies
- CWE-214Invocation of Process Using Visible Sensitive Information
- CWE-215Insertion of Sensitive Information Into Debugging Code
- CWE-216DEPRECATED: Containment Errors (Container Errors)
- CWE-217DEPRECATED: Failure to Protect Stored Data from Modification
- CWE-218DEPRECATED: Failure to provide confidentiality for stored data
- CWE-219Storage of File with Sensitive Data Under Web Root
- CWE-220Storage of File With Sensitive Data Under FTP Root
- CWE-221Information Loss or Omission
- CWE-222Truncation of Security-relevant Information
- CWE-223Omission of Security-relevant Information
- CWE-224Obscured Security-relevant Information by Alternate Name
- CWE-225DEPRECATED: General Information Management Problems
- CWE-226Sensitive Information in Resource Not Removed Before Reuse
- CWE-228Improper Handling of Syntactically Invalid Structure
- CWE-229Improper Handling of Values
- CWE-230Improper Handling of Missing Values
- CWE-231Improper Handling of Extra Values
- CWE-232Improper Handling of Undefined Values
- CWE-233Improper Handling of Parameters
- CWE-234Failure to Handle Missing Parameter
- CWE-235Improper Handling of Extra Parameters
- CWE-236Improper Handling of Undefined Parameters
- CWE-237Improper Handling of Structural Elements
- CWE-238Improper Handling of Incomplete Structural Elements
- CWE-239Failure to Handle Incomplete Element
- CWE-240Improper Handling of Inconsistent Structural Elements
- CWE-241Improper Handling of Unexpected Data Type
- CWE-242Use of Inherently Dangerous Function
- CWE-243Creation of chroot Jail Without Changing Working Directory
- CWE-244Improper Clearing of Heap Memory Before Release ('Heap Inspection')
- CWE-245J2EE Bad Practices: Direct Management of Connections
- CWE-246J2EE Bad Practices: Direct Use of Sockets
- CWE-247DEPRECATED: Reliance on DNS Lookups in a Security Decision
- CWE-248Uncaught Exception
- CWE-249DEPRECATED: Often Misused: Path Manipulation
- CWE-250Execution with Unnecessary Privileges
- CWE-252Unchecked Return Value
- CWE-253Incorrect Check of Function Return Value
- CWE-256Plaintext Storage of a Password
- CWE-257Storing Passwords in a Recoverable Format
- CWE-258Empty Password in Configuration File
- CWE-259Use of Hard-coded Password
- CWE-260Password in Configuration File
- CWE-261Weak Encoding for Password
- CWE-262Not Using Password Aging
- CWE-263Password Aging with Long Expiration
- CWE-266Incorrect Privilege Assignment
- CWE-267Privilege Defined With Unsafe Actions
- CWE-268Privilege Chaining
- CWE-269Improper Privilege Management
- CWE-270Privilege Context Switching Error
- CWE-271Privilege Dropping / Lowering Errors
- CWE-272Least Privilege Violation
- CWE-273Improper Check for Dropped Privileges
- CWE-274Improper Handling of Insufficient Privileges
- CWE-276Incorrect Default Permissions
- CWE-277Insecure Inherited Permissions
- CWE-278Insecure Preserved Inherited Permissions
- CWE-279Incorrect Execution-Assigned Permissions
- CWE-280Improper Handling of Insufficient Permissions or Privileges
- CWE-281Improper Preservation of Permissions
- CWE-282Improper Ownership Management
- CWE-283Unverified Ownership
- CWE-284Improper Access Control
- CWE-285Improper Authorization
- CWE-286Incorrect User Management
- CWE-287Improper Authentication
- CWE-288Authentication Bypass Using an Alternate Path or Channel
- CWE-289Authentication Bypass by Alternate Name
- CWE-290Authentication Bypass by Spoofing
- CWE-291Reliance on IP Address for Authentication
- CWE-292DEPRECATED: Trusting Self-reported DNS Name
- CWE-293Using Referer Field for Authentication
- CWE-294Authentication Bypass by Capture-replay
- CWE-295Improper Certificate Validation
- CWE-296Improper Following of a Certificate's Chain of Trust
- CWE-297Improper Validation of Certificate with Host Mismatch
- CWE-298Improper Validation of Certificate Expiration
- CWE-299Improper Check for Certificate Revocation
- CWE-300Channel Accessible by Non-Endpoint
- CWE-301Reflection Attack in an Authentication Protocol
- CWE-302Authentication Bypass by Assumed-Immutable Data
- CWE-303Incorrect Implementation of Authentication Algorithm
- CWE-304Missing Critical Step in Authentication
- CWE-305Authentication Bypass by Primary Weakness
- CWE-306Missing Authentication for Critical Function
- CWE-307Improper Restriction of Excessive Authentication Attempts
- CWE-308Use of Single-factor Authentication
- CWE-309Use of Password System for Primary Authentication
- CWE-311Missing Encryption of Sensitive Data
- CWE-312Cleartext Storage of Sensitive Information
- CWE-313Cleartext Storage in a File or on Disk
- CWE-314Cleartext Storage in the Registry
- CWE-315Cleartext Storage of Sensitive Information in a Cookie
- CWE-316Cleartext Storage of Sensitive Information in Memory
- CWE-317Cleartext Storage of Sensitive Information in GUI
- CWE-318Cleartext Storage of Sensitive Information in Executable
- CWE-319Cleartext Transmission of Sensitive Information
- CWE-321Use of Hard-coded Cryptographic Key
- CWE-322Key Exchange without Entity Authentication
- CWE-323Reusing a Nonce, Key Pair in Encryption
- CWE-324Use of a Key Past its Expiration Date
- CWE-325Missing Cryptographic Step
- CWE-326Inadequate Encryption Strength
- CWE-327Use of a Broken or Risky Cryptographic Algorithm
- CWE-328Use of Weak Hash
- CWE-329Generation of Predictable IV with CBC Mode
- CWE-330Use of Insufficiently Random Values
- CWE-331Insufficient Entropy
- CWE-332Insufficient Entropy in PRNG
- CWE-333Improper Handling of Insufficient Entropy in TRNG
- CWE-334Small Space of Random Values
- CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
- CWE-336Same Seed in Pseudo-Random Number Generator (PRNG)
- CWE-337Predictable Seed in Pseudo-Random Number Generator (PRNG)
- CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
- CWE-339Small Seed Space in PRNG
- CWE-340Generation of Predictable Numbers or Identifiers
- CWE-341Predictable from Observable State
- CWE-342Predictable Exact Value from Previous Values
- CWE-343Predictable Value Range from Previous Values
- CWE-344Use of Invariant Value in Dynamically Changing Context
- CWE-345Insufficient Verification of Data Authenticity
- CWE-346Origin Validation Error
- CWE-347Improper Verification of Cryptographic Signature
- CWE-348Use of Less Trusted Source
- CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
- CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
- CWE-351Insufficient Type Distinction
- CWE-352Cross-Site Request Forgery (CSRF)
- CWE-353Missing Support for Integrity Check
- CWE-354Improper Validation of Integrity Check Value
- CWE-356Product UI does not Warn User of Unsafe Actions
- CWE-357Insufficient UI Warning of Dangerous Operations
- CWE-358Improperly Implemented Security Check for Standard
- CWE-359Exposure of Private Personal Information to an Unauthorized Actor
- CWE-360Trust of System Event Data
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
- CWE-363Race Condition Enabling Link Following
- CWE-364Signal Handler Race Condition
- CWE-365DEPRECATED: Race Condition in Switch
- CWE-366Race Condition within a Thread
- CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
- CWE-368Context Switching Race Condition
- CWE-369Divide By Zero
- CWE-370Missing Check for Certificate Revocation after Initial Check
- CWE-372Incomplete Internal State Distinction
- CWE-373DEPRECATED: State Synchronization Error
- CWE-374Passing Mutable Objects to an Untrusted Method
- CWE-375Returning a Mutable Object to an Untrusted Caller
- CWE-377Insecure Temporary File
- CWE-378Creation of Temporary File With Insecure Permissions
- CWE-379Creation of Temporary File in Directory with Insecure Permissions
- CWE-382J2EE Bad Practices: Use of System.exit()
- CWE-383J2EE Bad Practices: Direct Use of Threads
- CWE-384Session Fixation
- CWE-385Covert Timing Channel
- CWE-386Symbolic Name not Mapping to Correct Object
- CWE-390Detection of Error Condition Without Action
- CWE-391Unchecked Error Condition
- CWE-392Missing Report of Error Condition
- CWE-393Return of Wrong Status Code
- CWE-394Unexpected Status Code or Return Value
- CWE-395Use of NullPointerException Catch to Detect NULL Pointer Dereference
- CWE-396Declaration of Catch for Generic Exception
- CWE-397Declaration of Throws for Generic Exception
- CWE-400Uncontrolled Resource Consumption
- CWE-401Missing Release of Memory after Effective Lifetime
- CWE-402Transmission of Private Resources into a New Sphere ('Resource Leak')
- CWE-403Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
- CWE-404Improper Resource Shutdown or Release
- CWE-405Asymmetric Resource Consumption (Amplification)
- CWE-406Insufficient Control of Network Message Volume (Network Amplification)
- CWE-407Inefficient Algorithmic Complexity
- CWE-408Incorrect Behavior Order: Early Amplification
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)
- CWE-410Insufficient Resource Pool
- CWE-412Unrestricted Externally Accessible Lock
- CWE-413Improper Resource Locking
- CWE-414Missing Lock Check
- CWE-415Double Free
- CWE-416Use After Free
- CWE-419Unprotected Primary Channel
- CWE-420Unprotected Alternate Channel
- CWE-421Race Condition During Access to Alternate Channel
- CWE-422Unprotected Windows Messaging Channel ('Shatter')
- CWE-423DEPRECATED: Proxied Trusted Channel
- CWE-424Improper Protection of Alternate Path
- CWE-425Direct Request ('Forced Browsing')
- CWE-426Untrusted Search Path
- CWE-427Uncontrolled Search Path Element
- CWE-428Unquoted Search Path or Element
- CWE-430Deployment of Wrong Handler
- CWE-431Missing Handler
- CWE-432Dangerous Signal Handler not Disabled During Sensitive Operations
- CWE-433Unparsed Raw Web Content Delivery
- CWE-434Unrestricted Upload of File with Dangerous Type
- CWE-435Improper Interaction Between Multiple Correctly-Behaving Entities
- CWE-436Interpretation Conflict
- CWE-437Incomplete Model of Endpoint Features
- CWE-439Behavioral Change in New Version or Environment
- CWE-440Expected Behavior Violation
- CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
- CWE-443DEPRECATED: HTTP response splitting
- CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CWE-446UI Discrepancy for Security Feature
- CWE-447Unimplemented or Unsupported Feature in UI
- CWE-448Obsolete Feature in UI
- CWE-449The UI Performs the Wrong Action
- CWE-450Multiple Interpretations of UI Input
- CWE-451User Interface (UI) Misrepresentation of Critical Information
- CWE-453Insecure Default Variable Initialization
- CWE-454External Initialization of Trusted Variables or Data Stores
- CWE-455Non-exit on Failed Initialization
- CWE-456Missing Initialization of a Variable
- CWE-457Use of Uninitialized Variable
- CWE-458DEPRECATED: Incorrect Initialization
- CWE-459Incomplete Cleanup
- CWE-460Improper Cleanup on Thrown Exception
- CWE-462Duplicate Key in Associative List (Alist)
- CWE-463Deletion of Data Structure Sentinel
- CWE-464Addition of Data Structure Sentinel
- CWE-466Return of Pointer Value Outside of Expected Range
- CWE-467Use of sizeof() on a Pointer Type
- CWE-468Incorrect Pointer Scaling
- CWE-469Use of Pointer Subtraction to Determine Size
- CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
- CWE-471Modification of Assumed-Immutable Data (MAID)
- CWE-472External Control of Assumed-Immutable Web Parameter
- CWE-473PHP External Variable Modification
- CWE-474Use of Function with Inconsistent Implementations
- CWE-475Undefined Behavior for Input to API
- CWE-476NULL Pointer Dereference
- CWE-477Use of Obsolete Function
- CWE-478Missing Default Case in Multiple Condition Expression
- CWE-479Signal Handler Use of a Non-reentrant Function
- CWE-480Use of Incorrect Operator
- CWE-481Assigning instead of Comparing
- CWE-482Comparing instead of Assigning
- CWE-483Incorrect Block Delimitation
- CWE-484Omitted Break Statement in Switch
- CWE-486Comparison of Classes by Name
- CWE-487Reliance on Package-level Scope
- CWE-488Exposure of Data Element to Wrong Session
- CWE-489Active Debug Code
- CWE-491Public cloneable() Method Without Final ('Object Hijack')
- CWE-492Use of Inner Class Containing Sensitive Data
- CWE-493Critical Public Variable Without Final Modifier
- CWE-494Download of Code Without Integrity Check
- CWE-495Private Data Structure Returned From A Public Method
- CWE-496Public Data Assigned to Private Array-Typed Field
- CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere
- CWE-498Cloneable Class Containing Sensitive Information
- CWE-499Serializable Class Containing Sensitive Data
- CWE-500Public Static Field Not Marked Final
- CWE-501Trust Boundary Violation
- CWE-502Deserialization of Untrusted Data
- CWE-506Embedded Malicious Code
- CWE-507Trojan Horse
- CWE-508Non-Replicating Malicious Code
- CWE-509Replicating Malicious Code (Virus or Worm)
- CWE-510Trapdoor
- CWE-511Logic/Time Bomb
- CWE-512Spyware
- CWE-514Covert Channel
- CWE-515Covert Storage Channel
- CWE-516DEPRECATED: Covert Timing Channel
- CWE-520.NET Misconfiguration: Use of Impersonation
- CWE-521Weak Password Requirements
- CWE-522Insufficiently Protected Credentials
- CWE-523Unprotected Transport of Credentials
- CWE-524Use of Cache Containing Sensitive Information
- CWE-525Use of Web Browser Cache Containing Sensitive Information
- CWE-526Cleartext Storage of Sensitive Information in an Environment Variable
- CWE-527Exposure of Version-Control Repository to an Unauthorized Control Sphere
- CWE-528Exposure of Core Dump File to an Unauthorized Control Sphere
- CWE-529Exposure of Access Control List Files to an Unauthorized Control Sphere
- CWE-530Exposure of Backup File to an Unauthorized Control Sphere
- CWE-531Inclusion of Sensitive Information in Test Code
- CWE-532Insertion of Sensitive Information into Log File
- CWE-533DEPRECATED: Information Exposure Through Server Log Files
- CWE-534DEPRECATED: Information Exposure Through Debug Log Files
- CWE-535Exposure of Information Through Shell Error Message
- CWE-536Servlet Runtime Error Message Containing Sensitive Information
- CWE-537Java Runtime Error Message Containing Sensitive Information
- CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory
- CWE-539Use of Persistent Cookies Containing Sensitive Information
- CWE-540Inclusion of Sensitive Information in Source Code
- CWE-541Inclusion of Sensitive Information in an Include File
- CWE-542DEPRECATED: Information Exposure Through Cleanup Log Files
- CWE-543Use of Singleton Pattern Without Synchronization in a Multithreaded Context
- CWE-544Missing Standardized Error Handling Mechanism
- CWE-545DEPRECATED: Use of Dynamic Class Loading
- CWE-546Suspicious Comment
- CWE-547Use of Hard-coded, Security-relevant Constants
- CWE-548Exposure of Information Through Directory Listing
- CWE-549Missing Password Field Masking
- CWE-550Server-generated Error Message Containing Sensitive Information
- CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
- CWE-552Files or Directories Accessible to External Parties
- CWE-553Command Shell in Externally Accessible Directory
- CWE-554ASP.NET Misconfiguration: Not Using Input Validation Framework
- CWE-555J2EE Misconfiguration: Plaintext Password in Configuration File
- CWE-556ASP.NET Misconfiguration: Use of Identity Impersonation
- CWE-558Use of getlogin() in Multithreaded Application
- CWE-560Use of umask() with chmod-style Argument
- CWE-561Dead Code
- CWE-562Return of Stack Variable Address
- CWE-563Assignment to Variable without Use
- CWE-564SQL Injection: Hibernate
- CWE-565Reliance on Cookies without Validation and Integrity Checking
- CWE-566Authorization Bypass Through User-Controlled SQL Primary Key
- CWE-567Unsynchronized Access to Shared Data in a Multithreaded Context
- CWE-568finalize() Method Without super.finalize()
- CWE-570Expression is Always False
- CWE-571Expression is Always True
- CWE-572Call to Thread run() instead of start()
- CWE-573Improper Following of Specification by Caller
- CWE-574EJB Bad Practices: Use of Synchronization Primitives
- CWE-575EJB Bad Practices: Use of AWT Swing
- CWE-576EJB Bad Practices: Use of Java I/O
- CWE-577EJB Bad Practices: Use of Sockets
- CWE-578EJB Bad Practices: Use of Class Loader
- CWE-579J2EE Bad Practices: Non-serializable Object Stored in Session
- CWE-580clone() Method Without super.clone()
- CWE-581Object Model Violation: Just One of Equals and Hashcode Defined
- CWE-582Array Declared Public, Final, and Static
- CWE-583finalize() Method Declared Public
- CWE-584Return Inside Finally Block
- CWE-585Empty Synchronized Block
- CWE-586Explicit Call to Finalize()
- CWE-587Assignment of a Fixed Address to a Pointer
- CWE-588Attempt to Access Child of a Non-structure Pointer
- CWE-589Call to Non-ubiquitous API
- CWE-590Free of Memory not on the Heap
- CWE-591Sensitive Data Storage in Improperly Locked Memory
- CWE-592DEPRECATED: Authentication Bypass Issues
- CWE-593Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
- CWE-594J2EE Framework: Saving Unserializable Objects to Disk
- CWE-595Comparison of Object References Instead of Object Contents
- CWE-596DEPRECATED: Incorrect Semantic Object Comparison
- CWE-597Use of Wrong Operator in String Comparison
- CWE-598Use of GET Request Method With Sensitive Query Strings
- CWE-599Missing Validation of OpenSSL Certificate
- CWE-600Uncaught Exception in Servlet
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')
- CWE-602Client-Side Enforcement of Server-Side Security
- CWE-603Use of Client-Side Authentication
- CWE-605Multiple Binds to the Same Port
- CWE-606Unchecked Input for Loop Condition
- CWE-607Public Static Final Field References Mutable Object
- CWE-608Struts: Non-private Field in ActionForm Class
- CWE-609Double-Checked Locking
- CWE-610Externally Controlled Reference to a Resource in Another Sphere
- CWE-611Improper Restriction of XML External Entity Reference
- CWE-612Improper Authorization of Index Containing Sensitive Information
- CWE-613Insufficient Session Expiration
- CWE-614Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
- CWE-615Inclusion of Sensitive Information in Source Code Comments
- CWE-616Incomplete Identification of Uploaded File Variables (PHP)
- CWE-617Reachable Assertion
- CWE-618Exposed Unsafe ActiveX Method
- CWE-619Dangling Database Cursor ('Cursor Injection')
- CWE-620Unverified Password Change
- CWE-621Variable Extraction Error
- CWE-622Improper Validation of Function Hook Arguments
- CWE-623Unsafe ActiveX Control Marked Safe For Scripting
- CWE-624Executable Regular Expression Error
- CWE-625Permissive Regular Expression
- CWE-626Null Byte Interaction Error (Poison Null Byte)
- CWE-627Dynamic Variable Evaluation
- CWE-628Function Call with Incorrectly Specified Arguments
- CWE-636Not Failing Securely ('Failing Open')
- CWE-637Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
- CWE-638Not Using Complete Mediation
- CWE-639Authorization Bypass Through User-Controlled Key
- CWE-640Weak Password Recovery Mechanism for Forgotten Password
- CWE-641Improper Restriction of Names for Files and Other Resources
- CWE-642External Control of Critical State Data
- CWE-643Improper Neutralization of Data within XPath Expressions ('XPath Injection')
- CWE-644Improper Neutralization of HTTP Headers for Scripting Syntax
- CWE-645Overly Restrictive Account Lockout Mechanism
- CWE-646Reliance on File Name or Extension of Externally-Supplied File
- CWE-647Use of Non-Canonical URL Paths for Authorization Decisions
- CWE-648Incorrect Use of Privileged APIs
- CWE-649Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
- CWE-650Trusting HTTP Permission Methods on the Server Side
- CWE-651Exposure of WSDL File Containing Sensitive Information
- CWE-652Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
- CWE-653Improper Isolation or Compartmentalization
- CWE-654Reliance on a Single Factor in a Security Decision
- CWE-655Insufficient Psychological Acceptability
- CWE-656Reliance on Security Through Obscurity
- CWE-657Violation of Secure Design Principles
- CWE-662Improper Synchronization
- CWE-663Use of a Non-reentrant Function in a Concurrent Context
- CWE-664Improper Control of a Resource Through its Lifetime
- CWE-665Improper Initialization
- CWE-666Operation on Resource in Wrong Phase of Lifetime
- CWE-667Improper Locking
- CWE-668Exposure of Resource to Wrong Sphere
- CWE-669Incorrect Resource Transfer Between Spheres
- CWE-670Always-Incorrect Control Flow Implementation
- CWE-671Lack of Administrator Control over Security
- CWE-672Operation on a Resource after Expiration or Release
- CWE-673External Influence of Sphere Definition
- CWE-674Uncontrolled Recursion
- CWE-675Multiple Operations on Resource in Single-Operation Context
- CWE-676Use of Potentially Dangerous Function
- CWE-680Integer Overflow to Buffer Overflow
- CWE-681Incorrect Conversion between Numeric Types
- CWE-682Incorrect Calculation
- CWE-683Function Call With Incorrect Order of Arguments
- CWE-684Incorrect Provision of Specified Functionality
- CWE-685Function Call With Incorrect Number of Arguments
- CWE-686Function Call With Incorrect Argument Type
- CWE-687Function Call With Incorrectly Specified Argument Value
- CWE-688Function Call With Incorrect Variable or Reference as Argument
- CWE-689Permission Race Condition During Resource Copy
- CWE-690Unchecked Return Value to NULL Pointer Dereference
- CWE-691Insufficient Control Flow Management
- CWE-692Incomplete Denylist to Cross-Site Scripting
- CWE-693Protection Mechanism Failure
- CWE-694Use of Multiple Resources with Duplicate Identifier
- CWE-695Use of Low-Level Functionality
- CWE-696Incorrect Behavior Order
- CWE-697Incorrect Comparison
- CWE-698Execution After Redirect (EAR)
- CWE-703Improper Check or Handling of Exceptional Conditions
- CWE-704Incorrect Type Conversion or Cast
- CWE-705Incorrect Control Flow Scoping
- CWE-706Use of Incorrectly-Resolved Name or Reference
- CWE-707Improper Neutralization
- CWE-708Incorrect Ownership Assignment
- CWE-710Improper Adherence to Coding Standards
- CWE-732Incorrect Permission Assignment for Critical Resource
- CWE-733Compiler Optimization Removal or Modification of Security-critical Code
- CWE-749Exposed Dangerous Method or Function
- CWE-754Improper Check for Unusual or Exceptional Conditions
- CWE-755Improper Handling of Exceptional Conditions
- CWE-756Missing Custom Error Page
- CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
- CWE-758Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
- CWE-759Use of a One-Way Hash without a Salt
- CWE-760Use of a One-Way Hash with a Predictable Salt
- CWE-761Free of Pointer not at Start of Buffer
- CWE-762Mismatched Memory Management Routines
- CWE-763Release of Invalid Pointer or Reference
- CWE-764Multiple Locks of a Critical Resource
- CWE-765Multiple Unlocks of a Critical Resource
- CWE-766Critical Data Element Declared Public
- CWE-767Access to Critical Private Variable via Public Method
- CWE-768Incorrect Short Circuit Evaluation
- CWE-769DEPRECATED: Uncontrolled File Descriptor Consumption
- CWE-770Allocation of Resources Without Limits or Throttling
- CWE-771Missing Reference to Active Allocated Resource
- CWE-772Missing Release of Resource after Effective Lifetime
- CWE-773Missing Reference to Active File Descriptor or Handle
- CWE-774Allocation of File Descriptors or Handles Without Limits or Throttling
- CWE-775Missing Release of File Descriptor or Handle after Effective Lifetime
- CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
- CWE-777Regular Expression without Anchors
- CWE-778Insufficient Logging
- CWE-779Logging of Excessive Data
- CWE-780Use of RSA Algorithm without OAEP
- CWE-781Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
- CWE-782Exposed IOCTL with Insufficient Access Control
- CWE-783Operator Precedence Logic Error
- CWE-784Reliance on Cookies without Validation and Integrity Checking in a Security Decision
- CWE-785Use of Path Manipulation Function without Maximum-sized Buffer
- CWE-786Access of Memory Location Before Start of Buffer
- CWE-787Out-of-bounds Write
- CWE-788Access of Memory Location After End of Buffer
- CWE-789Memory Allocation with Excessive Size Value
- CWE-790Improper Filtering of Special Elements
- CWE-791Incomplete Filtering of Special Elements
- CWE-792Incomplete Filtering of One or More Instances of Special Elements
- CWE-793Only Filtering One Instance of a Special Element
- CWE-794Incomplete Filtering of Multiple Instances of Special Elements
- CWE-795Only Filtering Special Elements at a Specified Location
- CWE-796Only Filtering Special Elements Relative to a Marker
- CWE-797Only Filtering Special Elements at an Absolute Position
- CWE-798Use of Hard-coded Credentials
- CWE-799Improper Control of Interaction Frequency
- CWE-804Guessable CAPTCHA
- CWE-805Buffer Access with Incorrect Length Value
- CWE-806Buffer Access Using Size of Source Buffer
- CWE-807Reliance on Untrusted Inputs in a Security Decision
- CWE-820Missing Synchronization
- CWE-821Incorrect Synchronization
- CWE-822Untrusted Pointer Dereference
- CWE-823Use of Out-of-range Pointer Offset
- CWE-824Access of Uninitialized Pointer
- CWE-825Expired Pointer Dereference
- CWE-826Premature Release of Resource During Expected Lifetime
- CWE-827Improper Control of Document Type Definition
- CWE-828Signal Handler with Functionality that is not Asynchronous-Safe
- CWE-829Inclusion of Functionality from Untrusted Control Sphere
- CWE-830Inclusion of Web Functionality from an Untrusted Source
- CWE-831Signal Handler Function Associated with Multiple Signals
- CWE-832Unlock of a Resource that is not Locked
- CWE-833Deadlock
- CWE-834Excessive Iteration
- CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
- CWE-836Use of Password Hash Instead of Password for Authentication
- CWE-837Improper Enforcement of a Single, Unique Action
- CWE-838Inappropriate Encoding for Output Context
- CWE-839Numeric Range Comparison Without Minimum Check
- CWE-841Improper Enforcement of Behavioral Workflow
- CWE-842Placement of User into Incorrect Group
- CWE-843Access of Resource Using Incompatible Type ('Type Confusion')
- CWE-862Missing Authorization
- CWE-863Incorrect Authorization
- CWE-908Use of Uninitialized Resource
- CWE-909Missing Initialization of Resource
- CWE-910Use of Expired File Descriptor
- CWE-911Improper Update of Reference Count
- CWE-912Hidden Functionality
- CWE-913Improper Control of Dynamically-Managed Code Resources
- CWE-914Improper Control of Dynamically-Identified Variables
- CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
- CWE-916Use of Password Hash With Insufficient Computational Effort
- CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
- CWE-918Server-Side Request Forgery (SSRF)
- CWE-920Improper Restriction of Power Consumption
- CWE-921Storage of Sensitive Data in a Mechanism without Access Control
- CWE-922Insecure Storage of Sensitive Information
- CWE-923Improper Restriction of Communication Channel to Intended Endpoints
- CWE-924Improper Enforcement of Message Integrity During Transmission in a Communication Channel
- CWE-925Improper Verification of Intent by Broadcast Receiver
- CWE-926Improper Export of Android Application Components
- CWE-927Use of Implicit Intent for Sensitive Communication
- CWE-939Improper Authorization in Handler for Custom URL Scheme
- CWE-940Improper Verification of Source of a Communication Channel
- CWE-941Incorrectly Specified Destination in a Communication Channel
- CWE-942Permissive Cross-domain Security Policy with Untrusted Domains
- CWE-943Improper Neutralization of Special Elements in Data Query Logic
- CWE-1004Sensitive Cookie Without 'HttpOnly' Flag
- CWE-1007Insufficient Visual Distinction of Homoglyphs Presented to User
- CWE-1021Improper Restriction of Rendered UI Layers or Frames
- CWE-1022Use of Web Link to Untrusted Target with window.opener Access
- CWE-1023Incomplete Comparison with Missing Factors
- CWE-1024Comparison of Incompatible Types
- CWE-1025Comparison Using Wrong Factors
- CWE-1037Processor Optimization Removal or Modification of Security-critical Code
- CWE-1038Insecure Automated Optimizations
- CWE-1039Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
- CWE-1041Use of Redundant Code
- CWE-1042Static Member Data Element outside of a Singleton Class Element
- CWE-1043Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
- CWE-1044Architecture with Number of Horizontal Layers Outside of Expected Range
- CWE-1045Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
- CWE-1046Creation of Immutable Text Using String Concatenation
- CWE-1047Modules with Circular Dependencies
- CWE-1048Invokable Control Element with Large Number of Outward Calls
- CWE-1049Excessive Data Query Operations in a Large Data Table
- CWE-1050Excessive Platform Resource Consumption within a Loop
- CWE-1051Initialization with Hard-Coded Network Resource Configuration Data
- CWE-1052Excessive Use of Hard-Coded Literals in Initialization
- CWE-1053Missing Documentation for Design
- CWE-1054Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
- CWE-1055Multiple Inheritance from Concrete Classes
- CWE-1056Invokable Control Element with Variadic Parameters
- CWE-1057Data Access Operations Outside of Expected Data Manager Component
- CWE-1058Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
- CWE-1059Insufficient Technical Documentation
- CWE-1060Excessive Number of Inefficient Server-Side Data Accesses
- CWE-1061Insufficient Encapsulation
- CWE-1062Parent Class with References to Child Class
- CWE-1063Creation of Class Instance within a Static Code Block
- CWE-1064Invokable Control Element with Signature Containing an Excessive Number of Parameters
- CWE-1065Runtime Resource Management Control Element in a Component Built to Run on Application Servers
- CWE-1066Missing Serialization Control Element
- CWE-1067Excessive Execution of Sequential Searches of Data Resource
- CWE-1068Inconsistency Between Implementation and Documented Design
- CWE-1069Empty Exception Block
- CWE-1070Serializable Data Element Containing non-Serializable Item Elements
- CWE-1071Empty Code Block
- CWE-1072Data Resource Access without Use of Connection Pooling
- CWE-1073Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
- CWE-1074Class with Excessively Deep Inheritance
- CWE-1075Unconditional Control Flow Transfer outside of Switch Block
- CWE-1076Insufficient Adherence to Expected Conventions
- CWE-1077Floating Point Comparison with Incorrect Operator
- CWE-1078Inappropriate Source Code Style or Formatting
- CWE-1079Parent Class without Virtual Destructor Method
- CWE-1080Source Code File with Excessive Number of Lines of Code
- CWE-1082Class Instance Self Destruction Control Element
- CWE-1083Data Access from Outside Expected Data Manager Component
- CWE-1084Invokable Control Element with Excessive File or Data Access Operations
- CWE-1085Invokable Control Element with Excessive Volume of Commented-out Code
- CWE-1086Class with Excessive Number of Child Classes
- CWE-1087Class with Virtual Method without a Virtual Destructor
- CWE-1088Synchronous Access of Remote Resource without Timeout
- CWE-1089Large Data Table with Excessive Number of Indices
- CWE-1090Method Containing Access of a Member Element from Another Class
- CWE-1091Use of Object without Invoking Destructor Method
- CWE-1092Use of Same Invokable Control Element in Multiple Architectural Layers
- CWE-1093Excessively Complex Data Representation
- CWE-1094Excessive Index Range Scan for a Data Resource
- CWE-1095Loop Condition Value Update within the Loop
- CWE-1096Singleton Class Instance Creation without Proper Locking or Synchronization
- CWE-1097Persistent Storable Data Element without Associated Comparison Control Element
- CWE-1098Data Element containing Pointer Item without Proper Copy Control Element
- CWE-1099Inconsistent Naming Conventions for Identifiers
- CWE-1100Insufficient Isolation of System-Dependent Functions
- CWE-1101Reliance on Runtime Component in Generated Code
- CWE-1102Reliance on Machine-Dependent Data Representation
- CWE-1103Use of Platform-Dependent Third Party Components
- CWE-1104Use of Unmaintained Third Party Components
- CWE-1105Insufficient Encapsulation of Machine-Dependent Functionality
- CWE-1106Insufficient Use of Symbolic Constants
- CWE-1107Insufficient Isolation of Symbolic Constant Definitions
- CWE-1108Excessive Reliance on Global Variables
- CWE-1109Use of Same Variable for Multiple Purposes
- CWE-1110Incomplete Design Documentation
- CWE-1111Incomplete I/O Documentation
- CWE-1112Incomplete Documentation of Program Execution
- CWE-1113Inappropriate Comment Style
- CWE-1114Inappropriate Whitespace Style
- CWE-1115Source Code Element without Standard Prologue
- CWE-1116Inaccurate Source Code Comments
- CWE-1117Callable with Insufficient Behavioral Summary
- CWE-1118Insufficient Documentation of Error Handling Techniques
- CWE-1119Excessive Use of Unconditional Branching
- CWE-1120Excessive Code Complexity
- CWE-1121Excessive McCabe Cyclomatic Complexity
- CWE-1122Excessive Halstead Complexity
- CWE-1123Excessive Use of Self-Modifying Code
- CWE-1124Excessively Deep Nesting
- CWE-1125Excessive Attack Surface
- CWE-1126Declaration of Variable with Unnecessarily Wide Scope
- CWE-1127Compilation with Insufficient Warnings or Errors
- CWE-1164Irrelevant Code
- CWE-1173Improper Use of Validation Framework
- CWE-1174ASP.NET Misconfiguration: Improper Model Validation
- CWE-1176Inefficient CPU Computation
- CWE-1177Use of Prohibited Code
- CWE-1187DEPRECATED: Use of Uninitialized Resource
- CWE-1188Initialization of a Resource with an Insecure Default
- CWE-1189Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
- CWE-1190DMA Device Enabled Too Early in Boot Phase
- CWE-1191On-Chip Debug and Test Interface With Improper Access Control
- CWE-1192Improper Identifier for IP Block used in System-On-Chip (SOC)
- CWE-1193Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
- CWE-1204Generation of Weak Initialization Vector (IV)
- CWE-1209Failure to Disable Reserved Bits
- CWE-1220Insufficient Granularity of Access Control
- CWE-1221Incorrect Register Defaults or Module Parameters
- CWE-1222Insufficient Granularity of Address Regions Protected by Register Locks
- CWE-1223Race Condition for Write-Once Attributes
- CWE-1224Improper Restriction of Write-Once Bit Fields
- CWE-1229Creation of Emergent Resource
- CWE-1230Exposure of Sensitive Information Through Metadata
- CWE-1231Improper Prevention of Lock Bit Modification
- CWE-1232Improper Lock Behavior After Power State Transition
- CWE-1233Security-Sensitive Hardware Controls with Missing Lock Bit Protection
- CWE-1234Hardware Internal or Debug Modes Allow Override of Locks
- CWE-1235Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
- CWE-1236Improper Neutralization of Formula Elements in a CSV File
- CWE-1239Improper Zeroization of Hardware Register
- CWE-1240Use of a Cryptographic Primitive with a Risky Implementation
- CWE-1241Use of Predictable Algorithm in Random Number Generator
- CWE-1242Inclusion of Undocumented Features or Chicken Bits
- CWE-1243Sensitive Non-Volatile Information Not Protected During Debug
- CWE-1244Internal Asset Exposed to Unsafe Debug Access Level or State
- CWE-1245Improper Finite State Machines (FSMs) in Hardware Logic
- CWE-1246Improper Write Handling in Limited-write Non-Volatile Memories
- CWE-1247Improper Protection Against Voltage and Clock Glitches
- CWE-1248Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
- CWE-1249Application-Level Admin Tool with Inconsistent View of Underlying Operating System
- CWE-1250Improper Preservation of Consistency Between Independent Representations of Shared State
- CWE-1251Mirrored Regions with Different Values
- CWE-1252CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
- CWE-1253Incorrect Selection of Fuse Values
- CWE-1254Incorrect Comparison Logic Granularity
- CWE-1255Comparison Logic is Vulnerable to Power Side-Channel Attacks
- CWE-1256Improper Restriction of Software Interfaces to Hardware Features
- CWE-1257Improper Access Control Applied to Mirrored or Aliased Memory Regions
- CWE-1258Exposure of Sensitive System Information Due to Uncleared Debug Information
- CWE-1259Improper Restriction of Security Token Assignment
- CWE-1260Improper Handling of Overlap Between Protected Memory Ranges
- CWE-1261Improper Handling of Single Event Upsets
- CWE-1262Improper Access Control for Register Interface
- CWE-1263Improper Physical Access Control
- CWE-1264Hardware Logic with Insecure De-Synchronization between Control and Data Channels
- CWE-1265Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
- CWE-1266Improper Scrubbing of Sensitive Data from Decommissioned Device
- CWE-1267Policy Uses Obsolete Encoding
- CWE-1268Policy Privileges are not Assigned Consistently Between Control and Data Agents
- CWE-1269Product Released in Non-Release Configuration
- CWE-1270Generation of Incorrect Security Tokens
- CWE-1271Uninitialized Value on Reset for Registers Holding Security Settings
- CWE-1272Sensitive Information Uncleared Before Debug/Power State Transition
- CWE-1273Device Unlock Credential Sharing
- CWE-1274Improper Access Control for Volatile Memory Containing Boot Code
- CWE-1275Sensitive Cookie with Improper SameSite Attribute
- CWE-1276Hardware Child Block Incorrectly Connected to Parent System
- CWE-1277Firmware Not Updateable
- CWE-1278Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
- CWE-1279Cryptographic Operations are run Before Supporting Units are Ready
- CWE-1280Access Control Check Implemented After Asset is Accessed
- CWE-1281Sequence of Processor Instructions Leads to Unexpected Behavior
- CWE-1282Assumed-Immutable Data is Stored in Writable Memory
- CWE-1283Mutable Attestation or Measurement Reporting Data
- CWE-1284Improper Validation of Specified Quantity in Input
- CWE-1285Improper Validation of Specified Index, Position, or Offset in Input
- CWE-1286Improper Validation of Syntactic Correctness of Input
- CWE-1287Improper Validation of Specified Type of Input
- CWE-1288Improper Validation of Consistency within Input
- CWE-1289Improper Validation of Unsafe Equivalence in Input
- CWE-1290Incorrect Decoding of Security Identifiers
- CWE-1291Public Key Re-Use for Signing both Debug and Production Code
- CWE-1292Incorrect Conversion of Security Identifiers
- CWE-1293Missing Source Correlation of Multiple Independent Data
- CWE-1294Insecure Security Identifier Mechanism
- CWE-1295Debug Messages Revealing Unnecessary Information
- CWE-1296Incorrect Chaining or Granularity of Debug Components
- CWE-1297Unprotected Confidential Information on Device is Accessible by OSAT Vendors
- CWE-1298Hardware Logic Contains Race Conditions
- CWE-1299Missing Protection Mechanism for Alternate Hardware Interface
- CWE-1300Improper Protection of Physical Side Channels
- CWE-1301Insufficient or Incomplete Data Removal within Hardware Component
- CWE-1302Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
- CWE-1303Non-Transparent Sharing of Microarchitectural Resources
- CWE-1304Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
- CWE-1310Missing Ability to Patch ROM Code
- CWE-1311Improper Translation of Security Attributes by Fabric Bridge
- CWE-1312Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
- CWE-1313Hardware Allows Activation of Test or Debug Logic at Runtime
- CWE-1314Missing Write Protection for Parametric Data Values
- CWE-1315Improper Setting of Bus Controlling Capability in Fabric End-point
- CWE-1316Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
- CWE-1317Improper Access Control in Fabric Bridge
- CWE-1318Missing Support for Security Features in On-chip Fabrics or Buses
- CWE-1319Improper Protection against Electromagnetic Fault Injection (EM-FI)
- CWE-1320Improper Protection for Outbound Error Messages and Alert Signals
- CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
- CWE-1322Use of Blocking Code in Single-threaded, Non-blocking Context
- CWE-1323Improper Management of Sensitive Trace Data
- CWE-1324DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface
- CWE-1325Improperly Controlled Sequential Memory Allocation
- CWE-1326Missing Immutable Root of Trust in Hardware
- CWE-1327Binding to an Unrestricted IP Address
- CWE-1328Security Version Number Mutable to Older Versions
- CWE-1329Reliance on Component That is Not Updateable
- CWE-1330Remanent Data Readable after Memory Erase
- CWE-1331Improper Isolation of Shared Resources in Network On Chip (NoC)
- CWE-1332Improper Handling of Faults that Lead to Instruction Skips
- CWE-1333Inefficient Regular Expression Complexity
- CWE-1334Unauthorized Error Injection Can Degrade Hardware Redundancy
- CWE-1335Incorrect Bitwise Shift of Integer
- CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
- CWE-1338Improper Protections Against Hardware Overheating
- CWE-1339Insufficient Precision or Accuracy of a Real Number
- CWE-1341Multiple Releases of Same Resource or Handle
- CWE-1342Information Exposure through Microarchitectural State after Transient Execution
- CWE-1351Improper Handling of Hardware Behavior in Exceptionally Cold Environments
- CWE-1357Reliance on Insufficiently Trustworthy Component
- CWE-1384Improper Handling of Physical or Environmental Conditions
- CWE-1385Missing Origin Validation in WebSockets
- CWE-1386Insecure Operation on Windows Junction / Mount Point
- CWE-1389Incorrect Parsing of Numbers with Different Radices
- CWE-1390Weak Authentication
- CWE-1391Use of Weak Credentials
- CWE-1392Use of Default Credentials
- CWE-1393Use of Default Password
- CWE-1394Use of Default Cryptographic Key
- CWE-1395Dependency on Vulnerable Third-Party Component
- CWE-1419Incorrect Initialization of Resource
- CWE-1420Exposure of Sensitive Information during Transient Execution
- CWE-1421Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
- CWE-1422Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
- CWE-1423Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
- CWE-1426Improper Validation of Generative AI Output
- CWE-1427Improper Neutralization of Input Used for LLM Prompting
- CWE-1428Reliance on HTTP instead of HTTPS
- CWE-1429Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface
- CWE-1431Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
- CWE-1434Insecure Setting of Generative AI/ML Model Inference Parameters
Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.