CWE IDWeakness Name
CWE-5J2EE Misconfiguration: Data Transmission Without Encryption
CWE-6J2EE Misconfiguration: Insufficient Session-ID Length
CWE-7J2EE Misconfiguration: Missing Custom Error Page
CWE-8J2EE Misconfiguration: Entity Bean Declared Remote
CWE-9J2EE Misconfiguration: Weak Access Permissions for EJB Methods
CWE-11ASP.NET Misconfiguration: Creating Debug Binary
CWE-12ASP.NET Misconfiguration: Missing Custom Error Page
CWE-13ASP.NET Misconfiguration: Password in Configuration File
CWE-14Compiler Removal of Code to Clear Buffers
CWE-15External Control of System or Configuration Setting
CWE-20Improper Input Validation
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23Relative Path Traversal
CWE-24Path Traversal: '../filedir'
CWE-25Path Traversal: '/../filedir'
CWE-26Path Traversal: '/dir/../filename'
CWE-27Path Traversal: 'dir/../../filename'
CWE-28Path Traversal: '..\filedir'
CWE-29Path Traversal: '\..\filename'
CWE-30Path Traversal: '\dir\..\filename'
CWE-31Path Traversal: 'dir\..\..\filename'
CWE-32Path Traversal: '...' (Triple Dot)
CWE-33Path Traversal: '....' (Multiple Dot)
CWE-34Path Traversal: '....//'
CWE-35Path Traversal: '.../...//'
CWE-36Absolute Path Traversal
CWE-37Path Traversal: '/absolute/pathname/here'
CWE-38Path Traversal: '\absolute\pathname\here'
CWE-39Path Traversal: 'C:dirname'
CWE-40Path Traversal: '\\UNC\share\name\' (Windows UNC Share)
CWE-41Improper Resolution of Path Equivalence
CWE-42Path Equivalence: 'filename.' (Trailing Dot)
CWE-43Path Equivalence: 'filename....' (Multiple Trailing Dot)
CWE-44Path Equivalence: 'file.name' (Internal Dot)
CWE-45Path Equivalence: 'file...name' (Multiple Internal Dot)
CWE-46Path Equivalence: 'filename ' (Trailing Space)
CWE-47Path Equivalence: ' filename' (Leading Space)
CWE-48Path Equivalence: 'file name' (Internal Whitespace)
CWE-49Path Equivalence: 'filename/' (Trailing Slash)
CWE-50Path Equivalence: '//multiple/leading/slash'
CWE-51Path Equivalence: '/multiple//internal/slash'
CWE-52Path Equivalence: '/multiple/trailing/slash//'
CWE-53Path Equivalence: '\multiple\\internal\backslash'
CWE-54Path Equivalence: 'filedir\' (Trailing Backslash)
CWE-55Path Equivalence: '/./' (Single Dot Directory)
CWE-56Path Equivalence: 'filedir*' (Wildcard)
CWE-57Path Equivalence: 'fakedir/../realdir/filename'
CWE-58Path Equivalence: Windows 8.3 Filename
CWE-59Improper Link Resolution Before File Access ('Link Following')
CWE-61UNIX Symbolic Link (Symlink) Following
CWE-62UNIX Hard Link
CWE-64Windows Shortcut Following (.LNK)
CWE-65Windows Hard Link
CWE-66Improper Handling of File Names that Identify Virtual Resources
CWE-67Improper Handling of Windows Device Names
CWE-69Improper Handling of Windows ::DATA Alternate Data Stream
CWE-72Improper Handling of Apple HFS+ Alternate Data Stream Path
CWE-73External Control of File Name or Path
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-75Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
CWE-76Improper Neutralization of Equivalent Special Elements
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-80Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
CWE-81Improper Neutralization of Script in an Error Message Web Page
CWE-82Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
CWE-83Improper Neutralization of Script in Attributes in a Web Page
CWE-84Improper Neutralization of Encoded URI Schemes in a Web Page
CWE-85Doubled Character XSS Manipulations
CWE-86Improper Neutralization of Invalid Characters in Identifiers in Web Pages
CWE-87Improper Neutralization of Alternate XSS Syntax
CWE-88Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-90Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
CWE-91XML Injection (aka Blind XPath Injection)
CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-94Improper Control of Generation of Code ('Code Injection')
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
CWE-97Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
CWE-99Improper Control of Resource Identifiers ('Resource Injection')
CWE-102Struts: Duplicate Validation Forms
CWE-103Struts: Incomplete validate() Method Definition
CWE-104Struts: Form Bean Does Not Extend Validation Class
CWE-105Struts: Form Field Without Validator
CWE-106Struts: Plug-in Framework not in Use
CWE-107Struts: Unused Validation Form
CWE-108Struts: Unvalidated Action Form
CWE-109Struts: Validator Turned Off
CWE-110Struts: Validator Without Form Field
CWE-111Direct Use of Unsafe JNI
CWE-112Missing XML Validation
CWE-113Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
CWE-114Process Control
CWE-115Misinterpretation of Input
CWE-116Improper Encoding or Escaping of Output
CWE-117Improper Output Neutralization for Logs
CWE-118Incorrect Access of Indexable Resource ('Range Error')
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-120Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-121Stack-based Buffer Overflow
CWE-122Heap-based Buffer Overflow
CWE-123Write-what-where Condition
CWE-124Buffer Underwrite ('Buffer Underflow')
CWE-125Out-of-bounds Read
CWE-126Buffer Over-read
CWE-127Buffer Under-read
CWE-128Wrap-around Error
CWE-129Improper Validation of Array Index
CWE-130Improper Handling of Length Parameter Inconsistency
CWE-131Incorrect Calculation of Buffer Size
CWE-134Use of Externally-Controlled Format String
CWE-135Incorrect Calculation of Multi-Byte String Length
CWE-138Improper Neutralization of Special Elements
CWE-140Improper Neutralization of Delimiters
CWE-141Improper Neutralization of Parameter/Argument Delimiters
CWE-142Improper Neutralization of Value Delimiters
CWE-143Improper Neutralization of Record Delimiters
CWE-144Improper Neutralization of Line Delimiters
CWE-145Improper Neutralization of Section Delimiters
CWE-146Improper Neutralization of Expression/Command Delimiters
CWE-147Improper Neutralization of Input Terminators
CWE-148Improper Neutralization of Input Leaders
CWE-149Improper Neutralization of Quoting Syntax
CWE-150Improper Neutralization of Escape, Meta, or Control Sequences
CWE-151Improper Neutralization of Comment Delimiters
CWE-152Improper Neutralization of Macro Symbols
CWE-153Improper Neutralization of Substitution Characters
CWE-154Improper Neutralization of Variable Name Delimiters
CWE-155Improper Neutralization of Wildcards or Matching Symbols
CWE-156Improper Neutralization of Whitespace
CWE-157Failure to Sanitize Paired Delimiters
CWE-158Improper Neutralization of Null Byte or NUL Character
CWE-159Improper Handling of Invalid Use of Special Elements
CWE-160Improper Neutralization of Leading Special Elements
CWE-161Improper Neutralization of Multiple Leading Special Elements
CWE-162Improper Neutralization of Trailing Special Elements
CWE-163Improper Neutralization of Multiple Trailing Special Elements
CWE-164Improper Neutralization of Internal Special Elements
CWE-165Improper Neutralization of Multiple Internal Special Elements
CWE-166Improper Handling of Missing Special Element
CWE-167Improper Handling of Additional Special Element
CWE-168Improper Handling of Inconsistent Special Elements
CWE-170Improper Null Termination
CWE-172Encoding Error
CWE-173Improper Handling of Alternate Encoding
CWE-174Double Decoding of the Same Data
CWE-175Improper Handling of Mixed Encoding
CWE-176Improper Handling of Unicode Encoding
CWE-177Improper Handling of URL Encoding (Hex Encoding)
CWE-178Improper Handling of Case Sensitivity
CWE-179Incorrect Behavior Order: Early Validation
CWE-180Incorrect Behavior Order: Validate Before Canonicalize
CWE-181Incorrect Behavior Order: Validate Before Filter
CWE-182Collapse of Data into Unsafe Value
CWE-183Permissive List of Allowed Inputs
CWE-184Incomplete List of Disallowed Inputs
CWE-185Incorrect Regular Expression
CWE-186Overly Restrictive Regular Expression
CWE-187Partial String Comparison
CWE-188Reliance on Data/Memory Layout
CWE-190Integer Overflow or Wraparound
CWE-191Integer Underflow (Wrap or Wraparound)
CWE-192Integer Coercion Error
CWE-193Off-by-one Error
CWE-194Unexpected Sign Extension
CWE-195Signed to Unsigned Conversion Error
CWE-196Unsigned to Signed Conversion Error
CWE-197Numeric Truncation Error
CWE-198Use of Incorrect Byte Ordering
CWE-200Exposure of Sensitive Information to an Unauthorized Actor
CWE-201Insertion of Sensitive Information Into Sent Data
CWE-202Exposure of Sensitive Information Through Data Queries
CWE-203Observable Discrepancy
CWE-204Observable Response Discrepancy
CWE-205Observable Behavioral Discrepancy
CWE-206Observable Internal Behavioral Discrepancy
CWE-207Observable Behavioral Discrepancy With Equivalent Products
CWE-208Observable Timing Discrepancy
CWE-209Generation of Error Message Containing Sensitive Information
CWE-210Self-generated Error Message Containing Sensitive Information
CWE-211Externally-Generated Error Message Containing Sensitive Information
CWE-212Improper Removal of Sensitive Information Before Storage or Transfer
CWE-213Exposure of Sensitive Information Due to Incompatible Policies
CWE-214Invocation of Process Using Visible Sensitive Information
CWE-215Insertion of Sensitive Information Into Debugging Code
CWE-219Storage of File with Sensitive Data Under Web Root
CWE-220Storage of File With Sensitive Data Under FTP Root
CWE-221Information Loss or Omission
CWE-222Truncation of Security-relevant Information
CWE-223Omission of Security-relevant Information
CWE-224Obscured Security-relevant Information by Alternate Name
CWE-226Sensitive Information in Resource Not Removed Before Reuse
CWE-228Improper Handling of Syntactically Invalid Structure
CWE-229Improper Handling of Values
CWE-230Improper Handling of Missing Values
CWE-231Improper Handling of Extra Values
CWE-232Improper Handling of Undefined Values
CWE-233Improper Handling of Parameters
CWE-234Failure to Handle Missing Parameter
CWE-235Improper Handling of Extra Parameters
CWE-236Improper Handling of Undefined Parameters
CWE-237Improper Handling of Structural Elements
CWE-238Improper Handling of Incomplete Structural Elements
CWE-239Failure to Handle Incomplete Element
CWE-240Improper Handling of Inconsistent Structural Elements
CWE-241Improper Handling of Unexpected Data Type
CWE-242Use of Inherently Dangerous Function
CWE-243Creation of chroot Jail Without Changing Working Directory
CWE-244Improper Clearing of Heap Memory Before Release ('Heap Inspection')
CWE-245J2EE Bad Practices: Direct Management of Connections
CWE-246J2EE Bad Practices: Direct Use of Sockets
CWE-248Uncaught Exception
CWE-250Execution with Unnecessary Privileges
CWE-252Unchecked Return Value
CWE-253Incorrect Check of Function Return Value
CWE-256Plaintext Storage of a Password
CWE-257Storing Passwords in a Recoverable Format
CWE-258Empty Password in Configuration File
CWE-259Use of Hard-coded Password
CWE-260Password in Configuration File
CWE-261Weak Encoding for Password
CWE-262Not Using Password Aging
CWE-263Password Aging with Long Expiration
CWE-266Incorrect Privilege Assignment
CWE-267Privilege Defined With Unsafe Actions
CWE-268Privilege Chaining
CWE-269Improper Privilege Management
CWE-270Privilege Context Switching Error
CWE-271Privilege Dropping / Lowering Errors
CWE-272Least Privilege Violation
CWE-273Improper Check for Dropped Privileges
CWE-274Improper Handling of Insufficient Privileges
CWE-276Incorrect Default Permissions
CWE-277Insecure Inherited Permissions
CWE-278Insecure Preserved Inherited Permissions
CWE-279Incorrect Execution-Assigned Permissions
CWE-280Improper Handling of Insufficient Permissions or Privileges
CWE-281Improper Preservation of Permissions
CWE-282Improper Ownership Management
CWE-283Unverified Ownership
CWE-284Improper Access Control
CWE-285Improper Authorization
CWE-286Incorrect User Management
CWE-287Improper Authentication
CWE-288Authentication Bypass Using an Alternate Path or Channel
CWE-289Authentication Bypass by Alternate Name
CWE-290Authentication Bypass by Spoofing
CWE-291Reliance on IP Address for Authentication
CWE-293Using Referer Field for Authentication
CWE-294Authentication Bypass by Capture-replay
CWE-295Improper Certificate Validation
CWE-296Improper Following of a Certificate's Chain of Trust
CWE-297Improper Validation of Certificate with Host Mismatch
CWE-298Improper Validation of Certificate Expiration
CWE-299Improper Check for Certificate Revocation
CWE-300Channel Accessible by Non-Endpoint
CWE-301Reflection Attack in an Authentication Protocol
CWE-302Authentication Bypass by Assumed-Immutable Data
CWE-303Incorrect Implementation of Authentication Algorithm
CWE-304Missing Critical Step in Authentication
CWE-305Authentication Bypass by Primary Weakness
CWE-306Missing Authentication for Critical Function
CWE-307Improper Restriction of Excessive Authentication Attempts
CWE-308Use of Single-factor Authentication
CWE-309Use of Password System for Primary Authentication
CWE-311Missing Encryption of Sensitive Data
CWE-312Cleartext Storage of Sensitive Information
CWE-313Cleartext Storage in a File or on Disk
CWE-314Cleartext Storage in the Registry
CWE-315Cleartext Storage of Sensitive Information in a Cookie
CWE-316Cleartext Storage of Sensitive Information in Memory
CWE-317Cleartext Storage of Sensitive Information in GUI
CWE-318Cleartext Storage of Sensitive Information in Executable
CWE-319Cleartext Transmission of Sensitive Information
CWE-321Use of Hard-coded Cryptographic Key
CWE-322Key Exchange without Entity Authentication
CWE-323Reusing a Nonce, Key Pair in Encryption
CWE-324Use of a Key Past its Expiration Date
CWE-325Missing Cryptographic Step
CWE-326Inadequate Encryption Strength
CWE-327Use of a Broken or Risky Cryptographic Algorithm
CWE-328Use of Weak Hash
CWE-329Generation of Predictable IV with CBC Mode
CWE-330Use of Insufficiently Random Values
CWE-331Insufficient Entropy
CWE-332Insufficient Entropy in PRNG
CWE-333Improper Handling of Insufficient Entropy in TRNG
CWE-334Small Space of Random Values
CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
CWE-336Same Seed in Pseudo-Random Number Generator (PRNG)
CWE-337Predictable Seed in Pseudo-Random Number Generator (PRNG)
CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
CWE-339Small Seed Space in PRNG
CWE-340Generation of Predictable Numbers or Identifiers
CWE-341Predictable from Observable State
CWE-342Predictable Exact Value from Previous Values
CWE-343Predictable Value Range from Previous Values
CWE-344Use of Invariant Value in Dynamically Changing Context
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-347Improper Verification of Cryptographic Signature
CWE-348Use of Less Trusted Source
CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
CWE-351Insufficient Type Distinction
CWE-352Cross-Site Request Forgery (CSRF)
CWE-353Missing Support for Integrity Check
CWE-354Improper Validation of Integrity Check Value
CWE-356Product UI does not Warn User of Unsafe Actions
CWE-357Insufficient UI Warning of Dangerous Operations
CWE-358Improperly Implemented Security Check for Standard
CWE-359Exposure of Private Personal Information to an Unauthorized Actor
CWE-360Trust of System Event Data
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-363Race Condition Enabling Link Following
CWE-364Signal Handler Race Condition
CWE-366Race Condition within a Thread
CWE-367Time-of-check Time-of-use (TOCTOU) Race Condition
CWE-368Context Switching Race Condition
CWE-369Divide By Zero
CWE-370Missing Check for Certificate Revocation after Initial Check
CWE-372Incomplete Internal State Distinction
CWE-374Passing Mutable Objects to an Untrusted Method
CWE-375Returning a Mutable Object to an Untrusted Caller
CWE-377Insecure Temporary File
CWE-378Creation of Temporary File With Insecure Permissions
CWE-379Creation of Temporary File in Directory with Insecure Permissions
CWE-382J2EE Bad Practices: Use of System.exit()
CWE-383J2EE Bad Practices: Direct Use of Threads
CWE-384Session Fixation
CWE-385Covert Timing Channel
CWE-386Symbolic Name not Mapping to Correct Object
CWE-390Detection of Error Condition Without Action
CWE-391Unchecked Error Condition
CWE-392Missing Report of Error Condition
CWE-393Return of Wrong Status Code
CWE-394Unexpected Status Code or Return Value
CWE-395Use of NullPointerException Catch to Detect NULL Pointer Dereference
CWE-396Declaration of Catch for Generic Exception
CWE-397Declaration of Throws for Generic Exception
CWE-400Uncontrolled Resource Consumption
CWE-401Missing Release of Memory after Effective Lifetime
CWE-402Transmission of Private Resources into a New Sphere ('Resource Leak')
CWE-403Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
CWE-404Improper Resource Shutdown or Release
CWE-405Asymmetric Resource Consumption (Amplification)
CWE-406Insufficient Control of Network Message Volume (Network Amplification)
CWE-407Inefficient Algorithmic Complexity
CWE-408Incorrect Behavior Order: Early Amplification
CWE-409Improper Handling of Highly Compressed Data (Data Amplification)
CWE-410Insufficient Resource Pool
CWE-412Unrestricted Externally Accessible Lock
CWE-413Improper Resource Locking
CWE-414Missing Lock Check
CWE-415Double Free
CWE-416Use After Free
CWE-419Unprotected Primary Channel
CWE-420Unprotected Alternate Channel
CWE-421Race Condition During Access to Alternate Channel
CWE-422Unprotected Windows Messaging Channel ('Shatter')
CWE-424Improper Protection of Alternate Path
CWE-425Direct Request ('Forced Browsing')
CWE-426Untrusted Search Path
CWE-427Uncontrolled Search Path Element
CWE-428Unquoted Search Path or Element
CWE-430Deployment of Wrong Handler
CWE-431Missing Handler
CWE-432Dangerous Signal Handler not Disabled During Sensitive Operations
CWE-433Unparsed Raw Web Content Delivery
CWE-434Unrestricted Upload of File with Dangerous Type
CWE-435Improper Interaction Between Multiple Correctly-Behaving Entities
CWE-436Interpretation Conflict
CWE-437Incomplete Model of Endpoint Features
CWE-439Behavioral Change in New Version or Environment
CWE-440Expected Behavior Violation
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
CWE-444Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
CWE-446UI Discrepancy for Security Feature
CWE-447Unimplemented or Unsupported Feature in UI
CWE-448Obsolete Feature in UI
CWE-449The UI Performs the Wrong Action
CWE-450Multiple Interpretations of UI Input
CWE-451User Interface (UI) Misrepresentation of Critical Information
CWE-453Insecure Default Variable Initialization
CWE-454External Initialization of Trusted Variables or Data Stores
CWE-455Non-exit on Failed Initialization
CWE-456Missing Initialization of a Variable
CWE-457Use of Uninitialized Variable
CWE-459Incomplete Cleanup
CWE-460Improper Cleanup on Thrown Exception
CWE-462Duplicate Key in Associative List (Alist)
CWE-463Deletion of Data Structure Sentinel
CWE-464Addition of Data Structure Sentinel
CWE-466Return of Pointer Value Outside of Expected Range
CWE-467Use of sizeof() on a Pointer Type
CWE-468Incorrect Pointer Scaling
CWE-469Use of Pointer Subtraction to Determine Size
CWE-470Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-472External Control of Assumed-Immutable Web Parameter
CWE-473PHP External Variable Modification
CWE-474Use of Function with Inconsistent Implementations
CWE-475Undefined Behavior for Input to API
CWE-476NULL Pointer Dereference
CWE-477Use of Obsolete Function
CWE-478Missing Default Case in Multiple Condition Expression
CWE-479Signal Handler Use of a Non-reentrant Function
CWE-480Use of Incorrect Operator
CWE-481Assigning instead of Comparing
CWE-482Comparing instead of Assigning
CWE-483Incorrect Block Delimitation
CWE-484Omitted Break Statement in Switch
CWE-486Comparison of Classes by Name
CWE-487Reliance on Package-level Scope
CWE-488Exposure of Data Element to Wrong Session
CWE-489Active Debug Code
CWE-491Public cloneable() Method Without Final ('Object Hijack')
CWE-492Use of Inner Class Containing Sensitive Data
CWE-493Critical Public Variable Without Final Modifier
CWE-494Download of Code Without Integrity Check
CWE-495Private Data Structure Returned From A Public Method
CWE-496Public Data Assigned to Private Array-Typed Field
CWE-497Exposure of Sensitive System Information to an Unauthorized Control Sphere
CWE-498Cloneable Class Containing Sensitive Information
CWE-499Serializable Class Containing Sensitive Data
CWE-500Public Static Field Not Marked Final
CWE-501Trust Boundary Violation
CWE-502Deserialization of Untrusted Data
CWE-506Embedded Malicious Code
CWE-507Trojan Horse
CWE-508Non-Replicating Malicious Code
CWE-509Replicating Malicious Code (Virus or Worm)
CWE-510Trapdoor
CWE-511Logic/Time Bomb
CWE-512Spyware
CWE-514Covert Channel
CWE-515Covert Storage Channel
CWE-520.NET Misconfiguration: Use of Impersonation
CWE-521Weak Password Requirements
CWE-522Insufficiently Protected Credentials
CWE-523Unprotected Transport of Credentials
CWE-524Use of Cache Containing Sensitive Information
CWE-525Use of Web Browser Cache Containing Sensitive Information
CWE-526Cleartext Storage of Sensitive Information in an Environment Variable
CWE-527Exposure of Version-Control Repository to an Unauthorized Control Sphere
CWE-528Exposure of Core Dump File to an Unauthorized Control Sphere
CWE-529Exposure of Access Control List Files to an Unauthorized Control Sphere
CWE-530Exposure of Backup File to an Unauthorized Control Sphere
CWE-531Inclusion of Sensitive Information in Test Code
CWE-532Insertion of Sensitive Information into Log File
CWE-535Exposure of Information Through Shell Error Message
CWE-536Servlet Runtime Error Message Containing Sensitive Information
CWE-537Java Runtime Error Message Containing Sensitive Information
CWE-538Insertion of Sensitive Information into Externally-Accessible File or Directory
CWE-539Use of Persistent Cookies Containing Sensitive Information
CWE-540Inclusion of Sensitive Information in Source Code
CWE-541Inclusion of Sensitive Information in an Include File
CWE-543Use of Singleton Pattern Without Synchronization in a Multithreaded Context
CWE-544Missing Standardized Error Handling Mechanism
CWE-546Suspicious Comment
CWE-547Use of Hard-coded, Security-relevant Constants
CWE-548Exposure of Information Through Directory Listing
CWE-549Missing Password Field Masking
CWE-550Server-generated Error Message Containing Sensitive Information
CWE-551Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-552Files or Directories Accessible to External Parties
CWE-553Command Shell in Externally Accessible Directory
CWE-554ASP.NET Misconfiguration: Not Using Input Validation Framework
CWE-555J2EE Misconfiguration: Plaintext Password in Configuration File
CWE-556ASP.NET Misconfiguration: Use of Identity Impersonation
CWE-558Use of getlogin() in Multithreaded Application
CWE-560Use of umask() with chmod-style Argument
CWE-561Dead Code
CWE-562Return of Stack Variable Address
CWE-563Assignment to Variable without Use
CWE-564SQL Injection: Hibernate
CWE-565Reliance on Cookies without Validation and Integrity Checking
CWE-566Authorization Bypass Through User-Controlled SQL Primary Key
CWE-567Unsynchronized Access to Shared Data in a Multithreaded Context
CWE-568finalize() Method Without super.finalize()
CWE-570Expression is Always False
CWE-571Expression is Always True
CWE-572Call to Thread run() instead of start()
CWE-573Improper Following of Specification by Caller
CWE-574EJB Bad Practices: Use of Synchronization Primitives
CWE-575EJB Bad Practices: Use of AWT Swing
CWE-576EJB Bad Practices: Use of Java I/O
CWE-577EJB Bad Practices: Use of Sockets
CWE-578EJB Bad Practices: Use of Class Loader
CWE-579J2EE Bad Practices: Non-serializable Object Stored in Session
CWE-580clone() Method Without super.clone()
CWE-581Object Model Violation: Just One of Equals and Hashcode Defined
CWE-582Array Declared Public, Final, and Static
CWE-583finalize() Method Declared Public
CWE-584Return Inside Finally Block
CWE-585Empty Synchronized Block
CWE-586Explicit Call to Finalize()
CWE-587Assignment of a Fixed Address to a Pointer
CWE-588Attempt to Access Child of a Non-structure Pointer
CWE-589Call to Non-ubiquitous API
CWE-590Free of Memory not on the Heap
CWE-591Sensitive Data Storage in Improperly Locked Memory
CWE-593Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
CWE-594J2EE Framework: Saving Unserializable Objects to Disk
CWE-595Comparison of Object References Instead of Object Contents
CWE-597Use of Wrong Operator in String Comparison
CWE-598Use of GET Request Method With Sensitive Query Strings
CWE-599Missing Validation of OpenSSL Certificate
CWE-600Uncaught Exception in Servlet
CWE-601URL Redirection to Untrusted Site ('Open Redirect')
CWE-602Client-Side Enforcement of Server-Side Security
CWE-603Use of Client-Side Authentication
CWE-605Multiple Binds to the Same Port
CWE-606Unchecked Input for Loop Condition
CWE-607Public Static Final Field References Mutable Object
CWE-608Struts: Non-private Field in ActionForm Class
CWE-609Double-Checked Locking
CWE-610Externally Controlled Reference to a Resource in Another Sphere
CWE-611Improper Restriction of XML External Entity Reference
CWE-612Improper Authorization of Index Containing Sensitive Information
CWE-613Insufficient Session Expiration
CWE-614Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
CWE-615Inclusion of Sensitive Information in Source Code Comments
CWE-616Incomplete Identification of Uploaded File Variables (PHP)
CWE-617Reachable Assertion
CWE-618Exposed Unsafe ActiveX Method
CWE-619Dangling Database Cursor ('Cursor Injection')
CWE-620Unverified Password Change
CWE-621Variable Extraction Error
CWE-622Improper Validation of Function Hook Arguments
CWE-623Unsafe ActiveX Control Marked Safe For Scripting
CWE-624Executable Regular Expression Error
CWE-625Permissive Regular Expression
CWE-626Null Byte Interaction Error (Poison Null Byte)
CWE-627Dynamic Variable Evaluation
CWE-628Function Call with Incorrectly Specified Arguments
CWE-636Not Failing Securely ('Failing Open')
CWE-637Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
CWE-638Not Using Complete Mediation
CWE-639Authorization Bypass Through User-Controlled Key
CWE-640Weak Password Recovery Mechanism for Forgotten Password
CWE-641Improper Restriction of Names for Files and Other Resources
CWE-642External Control of Critical State Data
CWE-643Improper Neutralization of Data within XPath Expressions ('XPath Injection')
CWE-644Improper Neutralization of HTTP Headers for Scripting Syntax
CWE-645Overly Restrictive Account Lockout Mechanism
CWE-646Reliance on File Name or Extension of Externally-Supplied File
CWE-647Use of Non-Canonical URL Paths for Authorization Decisions
CWE-648Incorrect Use of Privileged APIs
CWE-649Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
CWE-650Trusting HTTP Permission Methods on the Server Side
CWE-651Exposure of WSDL File Containing Sensitive Information
CWE-652Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
CWE-653Improper Isolation or Compartmentalization
CWE-654Reliance on a Single Factor in a Security Decision
CWE-655Insufficient Psychological Acceptability
CWE-656Reliance on Security Through Obscurity
CWE-657Violation of Secure Design Principles
CWE-662Improper Synchronization
CWE-663Use of a Non-reentrant Function in a Concurrent Context
CWE-664Improper Control of a Resource Through its Lifetime
CWE-665Improper Initialization
CWE-666Operation on Resource in Wrong Phase of Lifetime
CWE-667Improper Locking
CWE-668Exposure of Resource to Wrong Sphere
CWE-669Incorrect Resource Transfer Between Spheres
CWE-670Always-Incorrect Control Flow Implementation
CWE-671Lack of Administrator Control over Security
CWE-672Operation on a Resource after Expiration or Release
CWE-673External Influence of Sphere Definition
CWE-674Uncontrolled Recursion
CWE-675Multiple Operations on Resource in Single-Operation Context
CWE-676Use of Potentially Dangerous Function
CWE-680Integer Overflow to Buffer Overflow
CWE-681Incorrect Conversion between Numeric Types
CWE-682Incorrect Calculation
CWE-683Function Call With Incorrect Order of Arguments
CWE-684Incorrect Provision of Specified Functionality
CWE-685Function Call With Incorrect Number of Arguments
CWE-686Function Call With Incorrect Argument Type
CWE-687Function Call With Incorrectly Specified Argument Value
CWE-688Function Call With Incorrect Variable or Reference as Argument
CWE-689Permission Race Condition During Resource Copy
CWE-690Unchecked Return Value to NULL Pointer Dereference
CWE-691Insufficient Control Flow Management
CWE-692Incomplete Denylist to Cross-Site Scripting
CWE-693Protection Mechanism Failure
CWE-694Use of Multiple Resources with Duplicate Identifier
CWE-695Use of Low-Level Functionality
CWE-696Incorrect Behavior Order
CWE-697Incorrect Comparison
CWE-698Execution After Redirect (EAR)
CWE-703Improper Check or Handling of Exceptional Conditions
CWE-704Incorrect Type Conversion or Cast
CWE-705Incorrect Control Flow Scoping
CWE-706Use of Incorrectly-Resolved Name or Reference
CWE-707Improper Neutralization
CWE-708Incorrect Ownership Assignment
CWE-710Improper Adherence to Coding Standards
CWE-732Incorrect Permission Assignment for Critical Resource
CWE-733Compiler Optimization Removal or Modification of Security-critical Code
CWE-749Exposed Dangerous Method or Function
CWE-754Improper Check for Unusual or Exceptional Conditions
CWE-755Improper Handling of Exceptional Conditions
CWE-756Missing Custom Error Page
CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-758Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
CWE-759Use of a One-Way Hash without a Salt
CWE-760Use of a One-Way Hash with a Predictable Salt
CWE-761Free of Pointer not at Start of Buffer
CWE-762Mismatched Memory Management Routines
CWE-763Release of Invalid Pointer or Reference
CWE-764Multiple Locks of a Critical Resource
CWE-765Multiple Unlocks of a Critical Resource
CWE-766Critical Data Element Declared Public
CWE-767Access to Critical Private Variable via Public Method
CWE-768Incorrect Short Circuit Evaluation
CWE-770Allocation of Resources Without Limits or Throttling
CWE-771Missing Reference to Active Allocated Resource
CWE-772Missing Release of Resource after Effective Lifetime
CWE-773Missing Reference to Active File Descriptor or Handle
CWE-774Allocation of File Descriptors or Handles Without Limits or Throttling
CWE-775Missing Release of File Descriptor or Handle after Effective Lifetime
CWE-776Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
CWE-777Regular Expression without Anchors
CWE-778Insufficient Logging
CWE-779Logging of Excessive Data
CWE-780Use of RSA Algorithm without OAEP
CWE-781Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
CWE-782Exposed IOCTL with Insufficient Access Control
CWE-783Operator Precedence Logic Error
CWE-784Reliance on Cookies without Validation and Integrity Checking in a Security Decision
CWE-785Use of Path Manipulation Function without Maximum-sized Buffer
CWE-786Access of Memory Location Before Start of Buffer
CWE-787Out-of-bounds Write
CWE-788Access of Memory Location After End of Buffer
CWE-789Memory Allocation with Excessive Size Value
CWE-790Improper Filtering of Special Elements
CWE-791Incomplete Filtering of Special Elements
CWE-792Incomplete Filtering of One or More Instances of Special Elements
CWE-793Only Filtering One Instance of a Special Element
CWE-794Incomplete Filtering of Multiple Instances of Special Elements
CWE-795Only Filtering Special Elements at a Specified Location
CWE-796Only Filtering Special Elements Relative to a Marker
CWE-797Only Filtering Special Elements at an Absolute Position
CWE-798Use of Hard-coded Credentials
CWE-799Improper Control of Interaction Frequency
CWE-804Guessable CAPTCHA
CWE-805Buffer Access with Incorrect Length Value
CWE-806Buffer Access Using Size of Source Buffer
CWE-807Reliance on Untrusted Inputs in a Security Decision
CWE-820Missing Synchronization
CWE-821Incorrect Synchronization
CWE-822Untrusted Pointer Dereference
CWE-823Use of Out-of-range Pointer Offset
CWE-824Access of Uninitialized Pointer
CWE-825Expired Pointer Dereference
CWE-826Premature Release of Resource During Expected Lifetime
CWE-827Improper Control of Document Type Definition
CWE-828Signal Handler with Functionality that is not Asynchronous-Safe
CWE-829Inclusion of Functionality from Untrusted Control Sphere
CWE-830Inclusion of Web Functionality from an Untrusted Source
CWE-831Signal Handler Function Associated with Multiple Signals
CWE-832Unlock of a Resource that is not Locked
CWE-833Deadlock
CWE-834Excessive Iteration
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-836Use of Password Hash Instead of Password for Authentication
CWE-837Improper Enforcement of a Single, Unique Action
CWE-838Inappropriate Encoding for Output Context
CWE-839Numeric Range Comparison Without Minimum Check
CWE-841Improper Enforcement of Behavioral Workflow
CWE-842Placement of User into Incorrect Group
CWE-843Access of Resource Using Incompatible Type ('Type Confusion')
CWE-862Missing Authorization
CWE-863Incorrect Authorization
CWE-908Use of Uninitialized Resource
CWE-909Missing Initialization of Resource
CWE-910Use of Expired File Descriptor
CWE-911Improper Update of Reference Count
CWE-912Hidden Functionality
CWE-913Improper Control of Dynamically-Managed Code Resources
CWE-914Improper Control of Dynamically-Identified Variables
CWE-915Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-916Use of Password Hash With Insufficient Computational Effort
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CWE-918Server-Side Request Forgery (SSRF)
CWE-920Improper Restriction of Power Consumption
CWE-921Storage of Sensitive Data in a Mechanism without Access Control
CWE-922Insecure Storage of Sensitive Information
CWE-923Improper Restriction of Communication Channel to Intended Endpoints
CWE-924Improper Enforcement of Message Integrity During Transmission in a Communication Channel
CWE-925Improper Verification of Intent by Broadcast Receiver
CWE-926Improper Export of Android Application Components
CWE-927Use of Implicit Intent for Sensitive Communication
CWE-939Improper Authorization in Handler for Custom URL Scheme
CWE-940Improper Verification of Source of a Communication Channel
CWE-941Incorrectly Specified Destination in a Communication Channel
CWE-942Permissive Cross-domain Policy with Untrusted Domains
CWE-943Improper Neutralization of Special Elements in Data Query Logic
CWE-1004Sensitive Cookie Without 'HttpOnly' Flag
CWE-1007Insufficient Visual Distinction of Homoglyphs Presented to User
CWE-1021Improper Restriction of Rendered UI Layers or Frames
CWE-1022Use of Web Link to Untrusted Target with window.opener Access
CWE-1023Incomplete Comparison with Missing Factors
CWE-1024Comparison of Incompatible Types
CWE-1025Comparison Using Wrong Factors
CWE-1037Processor Optimization Removal or Modification of Security-critical Code
CWE-1038Insecure Automated Optimizations
CWE-1039Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism,Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations
CWE-1041Use of Redundant Code
CWE-1042Static Member Data Element outside of a Singleton Class Element
CWE-1043Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
CWE-1044Architecture with Number of Horizontal Layers Outside of Expected Range
CWE-1045Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
CWE-1046Creation of Immutable Text Using String Concatenation
CWE-1047Modules with Circular Dependencies
CWE-1048Invokable Control Element with Large Number of Outward Calls
CWE-1049Excessive Data Query Operations in a Large Data Table
CWE-1050Excessive Platform Resource Consumption within a Loop
CWE-1051Initialization with Hard-Coded Network Resource Configuration Data
CWE-1052Excessive Use of Hard-Coded Literals in Initialization
CWE-1053Missing Documentation for Design
CWE-1054Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
CWE-1055Multiple Inheritance from Concrete Classes
CWE-1056Invokable Control Element with Variadic Parameters
CWE-1057Data Access Operations Outside of Expected Data Manager Component
CWE-1058Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
CWE-1059Insufficient Technical Documentation
CWE-1060Excessive Number of Inefficient Server-Side Data Accesses
CWE-1061Insufficient Encapsulation
CWE-1062Parent Class with References to Child Class
CWE-1063Creation of Class Instance within a Static Code Block
CWE-1064Invokable Control Element with Signature Containing an Excessive Number of Parameters
CWE-1065Runtime Resource Management Control Element in a Component Built to Run on Application Servers
CWE-1066Missing Serialization Control Element
CWE-1067Excessive Execution of Sequential Searches of Data Resource
CWE-1068Inconsistency Between Implementation and Documented Design
CWE-1069Empty Exception Block
CWE-1070Serializable Data Element Containing non-Serializable Item Elements
CWE-1071Empty Code Block
CWE-1072Data Resource Access without Use of Connection Pooling
CWE-1073Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
CWE-1074Class with Excessively Deep Inheritance
CWE-1075Unconditional Control Flow Transfer outside of Switch Block
CWE-1076Insufficient Adherence to Expected Conventions
CWE-1077Floating Point Comparison with Incorrect Operator
CWE-1078Inappropriate Source Code Style or Formatting
CWE-1079Parent Class without Virtual Destructor Method
CWE-1080Source Code File with Excessive Number of Lines of Code
CWE-1082Class Instance Self Destruction Control Element
CWE-1083Data Access from Outside Expected Data Manager Component
CWE-1084Invokable Control Element with Excessive File or Data Access Operations
CWE-1085Invokable Control Element with Excessive Volume of Commented-out Code
CWE-1086Class with Excessive Number of Child Classes
CWE-1087Class with Virtual Method without a Virtual Destructor
CWE-1088Synchronous Access of Remote Resource without Timeout
CWE-1089Large Data Table with Excessive Number of Indices
CWE-1090Method Containing Access of a Member Element from Another Class
CWE-1091Use of Object without Invoking Destructor Method
CWE-1092Use of Same Invokable Control Element in Multiple Architectural Layers
CWE-1093Excessively Complex Data Representation
CWE-1094Excessive Index Range Scan for a Data Resource
CWE-1095Loop Condition Value Update within the Loop
CWE-1096Singleton Class Instance Creation without Proper Locking or Synchronization
CWE-1097Persistent Storable Data Element without Associated Comparison Control Element
CWE-1098Data Element containing Pointer Item without Proper Copy Control Element
CWE-1099Inconsistent Naming Conventions for Identifiers
CWE-1100Insufficient Isolation of System-Dependent Functions
CWE-1101Reliance on Runtime Component in Generated Code
CWE-1102Reliance on Machine-Dependent Data Representation
CWE-1103Use of Platform-Dependent Third Party Components
CWE-1104Use of Unmaintained Third Party Components
CWE-1105Insufficient Encapsulation of Machine-Dependent Functionality
CWE-1106Insufficient Use of Symbolic Constants
CWE-1107Insufficient Isolation of Symbolic Constant Definitions
CWE-1108Excessive Reliance on Global Variables
CWE-1109Use of Same Variable for Multiple Purposes
CWE-1110Incomplete Design Documentation
CWE-1111Incomplete I/O Documentation
CWE-1112Incomplete Documentation of Program Execution
CWE-1113Inappropriate Comment Style
CWE-1114Inappropriate Whitespace Style
CWE-1115Source Code Element without Standard Prologue
CWE-1116Inaccurate Comments
CWE-1117Callable with Insufficient Behavioral Summary
CWE-1118Insufficient Documentation of Error Handling Techniques
CWE-1119Excessive Use of Unconditional Branching
CWE-1120Excessive Code Complexity
CWE-1121Excessive McCabe Cyclomatic Complexity
CWE-1122Excessive Halstead Complexity
CWE-1123Excessive Use of Self-Modifying Code
CWE-1124Excessively Deep Nesting
CWE-1125Excessive Attack Surface
CWE-1126Declaration of Variable with Unnecessarily Wide Scope
CWE-1127Compilation with Insufficient Warnings or Errors
CWE-1164Irrelevant Code
CWE-1173Improper Use of Validation Framework
CWE-1174ASP.NET Misconfiguration: Improper Model Validation
CWE-1176Inefficient CPU Computation
CWE-1177Use of Prohibited Code
CWE-1188Insecure Default Initialization of Resource,Initialization of a Resource with an Insecure Default
CWE-1189Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
CWE-1190DMA Device Enabled Too Early in Boot Phase
CWE-1191On-Chip Debug and Test Interface With Improper Access Control
CWE-1192Improper Identifier for IP Block used in System-On-Chip (SOC),System-on-Chip (SoC) Using Components without Unique, Immutable Identifiers
CWE-1193Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
CWE-1204Generation of Weak Initialization Vector (IV)
CWE-1209Failure to Disable Reserved Bits
CWE-1220Insufficient Granularity of Access Control
CWE-1221Incorrect Register Defaults or Module Parameters
CWE-1222Insufficient Granularity of Address Regions Protected by Register Locks
CWE-1223Race Condition for Write-Once Attributes
CWE-1224Improper Restriction of Write-Once Bit Fields
CWE-1229Creation of Emergent Resource
CWE-1230Exposure of Sensitive Information Through Metadata
CWE-1231Improper Prevention of Lock Bit Modification
CWE-1232Improper Lock Behavior After Power State Transition
CWE-1233Security-Sensitive Hardware Controls with Missing Lock Bit Protection
CWE-1234Hardware Internal or Debug Modes Allow Override of Locks
CWE-1235Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
CWE-1236Improper Neutralization of Formula Elements in a CSV File
CWE-1239Improper Zeroization of Hardware Register
CWE-1240Use of a Cryptographic Primitive with a Risky Implementation
CWE-1241Use of Predictable Algorithm in Random Number Generator
CWE-1242Inclusion of Undocumented Features or Chicken Bits
CWE-1243Sensitive Non-Volatile Information Not Protected During Debug
CWE-1244Internal Asset Exposed to Unsafe Debug Access Level or State
CWE-1245Improper Finite State Machines (FSMs) in Hardware Logic
CWE-1246Improper Write Handling in Limited-write Non-Volatile Memories
CWE-1247Improper Protection Against Voltage and Clock Glitches
CWE-1248Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
CWE-1249Application-Level Admin Tool with Inconsistent View of Underlying Operating System
CWE-1250Improper Preservation of Consistency Between Independent Representations of Shared State
CWE-1251Mirrored Regions with Different Values
CWE-1252CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
CWE-1253Incorrect Selection of Fuse Values
CWE-1254Incorrect Comparison Logic Granularity
CWE-1255Comparison Logic is Vulnerable to Power Side-Channel Attacks
CWE-1256Improper Restriction of Software Interfaces to Hardware Features
CWE-1257Improper Access Control Applied to Mirrored or Aliased Memory Regions
CWE-1258Exposure of Sensitive System Information Due to Uncleared Debug Information
CWE-1259Improper Restriction of Security Token Assignment
CWE-1260Improper Handling of Overlap Between Protected Memory Ranges
CWE-1261Improper Handling of Single Event Upsets
CWE-1262Improper Access Control for Register Interface
CWE-1263Improper Physical Access Control
CWE-1264Hardware Logic with Insecure De-Synchronization between Control and Data Channels
CWE-1265Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
CWE-1266Improper Scrubbing of Sensitive Data from Decommissioned Device
CWE-1267Policy Uses Obsolete Encoding
CWE-1268Policy Privileges are not Assigned Consistently Between Control and Data Agents
CWE-1269Product Released in Non-Release Configuration
CWE-1270Generation of Incorrect Security Tokens
CWE-1271Uninitialized Value on Reset for Registers Holding Security Settings
CWE-1272Sensitive Information Uncleared Before Debug/Power State Transition
CWE-1273Device Unlock Credential Sharing
CWE-1274Improper Access Control for Volatile Memory Containing Boot Code
CWE-1275Sensitive Cookie with Improper SameSite Attribute
CWE-1276Hardware Child Block Incorrectly Connected to Parent System
CWE-1277Firmware Not Updateable
CWE-1278Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
CWE-1279Cryptographic Operations are run Before Supporting Units are Ready
CWE-1280Access Control Check Implemented After Asset is Accessed
CWE-1281Sequence of Processor Instructions Leads to Unexpected Behavior
CWE-1282Assumed-Immutable Data is Stored in Writable Memory
CWE-1283Mutable Attestation or Measurement Reporting Data
CWE-1284Improper Validation of Specified Quantity in Input
CWE-1285Improper Validation of Specified Index, Position, or Offset in Input
CWE-1286Improper Validation of Syntactic Correctness of Input
CWE-1287Improper Validation of Specified Type of Input
CWE-1288Improper Validation of Consistency within Input
CWE-1289Improper Validation of Unsafe Equivalence in Input
CWE-1290Incorrect Decoding of Security Identifiers
CWE-1291Public Key Re-Use for Signing both Debug and Production Code
CWE-1292Incorrect Conversion of Security Identifiers
CWE-1293Missing Source Correlation of Multiple Independent Data
CWE-1294Insecure Security Identifier Mechanism
CWE-1295Debug Messages Revealing Unnecessary Information
CWE-1296Incorrect Chaining or Granularity of Debug Components
CWE-1297Unprotected Confidential Information on Device is Accessible by OSAT Vendors
CWE-1298Hardware Logic Contains Race Conditions
CWE-1299Missing Protection Mechanism for Alternate Hardware Interface
CWE-1300Improper Protection of Physical Side Channels
CWE-1301Insufficient or Incomplete Data Removal within Hardware Component
CWE-1302Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC),Missing Security Identifier
CWE-1303Non-Transparent Sharing of Microarchitectural Resources
CWE-1304Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
CWE-1310Missing Ability to Patch ROM Code
CWE-1311Improper Translation of Security Attributes by Fabric Bridge
CWE-1312Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
CWE-1313Hardware Allows Activation of Test or Debug Logic at Runtime
CWE-1314Missing Write Protection for Parametric Data Values
CWE-1315Improper Setting of Bus Controlling Capability in Fabric End-point
CWE-1316Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
CWE-1317Improper Access Control in Fabric Bridge
CWE-1318Missing Support for Security Features in On-chip Fabrics or Buses
CWE-1319Improper Protection against Electromagnetic Fault Injection (EM-FI)
CWE-1320Improper Protection for Outbound Error Messages and Alert Signals
CWE-1321Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CWE-1322Use of Blocking Code in Single-threaded, Non-blocking Context
CWE-1323Improper Management of Sensitive Trace Data
CWE-1325Improperly Controlled Sequential Memory Allocation
CWE-1326Missing Immutable Root of Trust in Hardware
CWE-1327Binding to an Unrestricted IP Address
CWE-1328Security Version Number Mutable to Older Versions
CWE-1329Reliance on Component That is Not Updateable
CWE-1330Remanent Data Readable after Memory Erase
CWE-1331Improper Isolation of Shared Resources in Network On Chip (NoC)
CWE-1332Improper Handling of Faults that Lead to Instruction Skips
CWE-1333Inefficient Regular Expression Complexity
CWE-1334Unauthorized Error Injection Can Degrade Hardware Redundancy
CWE-1335Incorrect Bitwise Shift of Integer
CWE-1336Improper Neutralization of Special Elements Used in a Template Engine
CWE-1338Improper Protections Against Hardware Overheating
CWE-1339Insufficient Precision or Accuracy of a Real Number
CWE-1341Multiple Releases of Same Resource or Handle
CWE-1342Information Exposure through Microarchitectural State after Transient Execution
CWE-1351Improper Handling of Hardware Behavior in Exceptionally Cold Environments
CWE-1357Reliance on Insufficiently Trustworthy Component
CWE-1384Improper Handling of Physical or Environmental Conditions
CWE-1385Missing Origin Validation in WebSockets
CWE-1386Insecure Operation on Windows Junction / Mount Point
CWE-1389Incorrect Parsing of Numbers with Different Radices
CWE-1390Weak Authentication
CWE-1391Use of Weak Credentials
CWE-1392Use of Default Credentials
CWE-1393Use of Default Password
CWE-1394Use of Default Cryptographic Key
CWE-1395Dependency on Vulnerable Third-Party Component
CWE-1419Incorrect Initialization of Resource
CWE-1420Exposure of Sensitive Information during Transient Execution
CWE-1421Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
CWE-1422Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
CWE-1423Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
CWE-1426Improper Validation of Generative AI Output
CWE-1427Improper Neutralization of Input Used for LLM Prompting
CWE-1428Reliance on HTTP instead of HTTPS
CWE-1429Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface
CWE-1431Driving Intermediate Cryptographic State/Results to Hardware Module Outputs

total count: 943