Weakness types

CWE-79 · XSS (CWE-79)28,523 CWE-89 · Unauthenticated SQL injection (CWE-89)12,845 CWE-862 · The software does not perform an authorization check when an actor attempts to access a resource or perform an action.8,521 CWE-284 · The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.7,066 CWE-352 · The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.6,058 CWE-22 · The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.5,839 CWE-20 · The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.5,399 CWE-787 · OUT-OF-BOUNDS WRITE CWE-7875,142 CWE-125 · OUT-OF-BOUNDS READ CWE-1255,119 CWE-416 · USE AFTER FREE CWE-416 (CVE-2019-13510)5,038 CWE-200 · The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.4,877 CWE-74 · The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.4,734 CWE-78 · The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.4,591 CWE-94 · The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.4,423 CWE-121 · Stack buffer overflow (CWE-121)3,823 CWE-119 · Memory Corruption - Generic (CWE-119)3,266 CWE-122 · Heap Overflow (CWE-122)3,190 CWE-120 · Execute unauthorized code or commands3,164 CWE-434 · UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-4343,086 CWE-918 · The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.3,049 CWE-863 · The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.3,004 CWE-400 · UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-4003,000 CWE-77 · The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.2,809 CWE-502 · The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.2,657 CWE-306 · The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.2,599 CWE-269 · The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.2,492 CWE-639 · The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.2,453 CWE-287 · When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.2,430 CWE-476 · Remote authenticated null dereference (CWE-476)2,332 CWE-770 · The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.1,851 CWE-190 · INTEGER OVERFLOW OR WRAPAROUND CWE-1901,664 CWE-285 · The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.1,598 CWE-98 · Remote File Inclusion (CWE-98)1,304 CWE-601 · URL REDIRECTION TO UNTRUSTED SITE ('OPEN REDIRECT') CWE-6011,188 CWE-266 · Incorrect Privilege Assignment1,170 CWE-362 · The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.1,089 CWE-276 · INCORRECT DEFAULT PERMISSIONS CWE-276953 CWE-798 · USE OF HARD-CODED CREDENTIALS CWE-798945 CWE-427 · Uncontrolled Search Path or Element897 CWE-295 · The software does not validate, or incorrectly validates, a certificate.859 CWE-532 · Sensitive Information in Log Files858 CWE-693 · PROTECTIONS MECHANISM FAILURE CWE-693836 CWE-59 · Link Following824 CWE-732 · The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.792 CWE-404 · IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404695 CWE-522 · INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522691 CWE-843 · Type Confusion686 CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)680 CWE-288 · Improper access control678 CWE-73 · Improper access control669 CWE-401 · Missing Release of Memory after Effective Lifetime664 CWE-611 · XXE CWE-611649 CWE-347 · Information disclosure644 CWE-290 · This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.607 CWE-346 · ORIGIN VALIDATION ERROR CWE-346592 CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)587 CWE-345 · Insufficient Verification of Data Authenticity (CWE-345)559 CWE-319 · The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.540 CWE-126 · Stack buffer over-read (CWE-126)527 CWE-23 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.509 CWE-307 · IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307484 CWE-613 · Session Expiration478 CWE-312 · The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.470 CWE-754 · The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.461 CWE-617 · Reachable Assertion (CWE-617)461 CWE-209 · Information Exposure Through Error Message433 CWE-835 · The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.426 CWE-1333 · The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.415 CWE-201 · Insertion of Sensitive Information Into Sent Data412 CWE-497 · Information disclosure406 CWE-327 · USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327403 CWE-191 · INTEGER UNDERFLOW (WRAP OR WRAPAROUND) CWE-191401 CWE-451 · User Interface (UI) Misrepresentation of Critical Information (CWE-451)389 CWE-1321 · Prototype Pollution381 CWE-250 · Privilege elevation373 CWE-116 · Improper Encoding or Escaping of Output (CWE-116), Improper Handling of Unicode Encoding (CWE-176)373 CWE-552 · Files or Directories Accessible to External Parties (CWE-552)366 CWE-415 · use-after-free364 CWE-321 · USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321364 CWE-428 · UNQUOTED SEARCH PATH OR ELEMENT CWE-428356 CWE-203 · Observable Discrepancy350 CWE-674 · UNCONTROLLED RECURSION CWE-674349 CWE-908 · Use of Uninitialized Resource (CWE-908)345 CWE-1284 · Improper Validation of Specified Quantity in Input327 CWE-129 · memory-safety324 CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')323 CWE-426 · UNTRUSTED SEARCH PATH CWE-426323 CWE-88 · Information disclosure317 CWE-311 · MISSING ENCRYPTION OF SENSITIVE DATA CWE-311312 CWE-264 · Privileges, and Access Control [CWE-264]299 CWE-248 · UNCAUGHT EXCEPTION CWE-248293 CWE-922 · INSECURE STORAGE OF SENSITIVE INFORMATION CWE-922284 CWE-707 · Improper Neutralization257 CWE-1336 · Information disclosure257 CWE-384 · Session Fixiation254 CWE-789 · Uncontrolled Memory Allocation252 CWE-822 · UNTRUSTED POINTER DEREFERENCE CWE-822250 CWE-457 · Use of Uninitialized Variable246 CWE-829 · Inclusion of Functionality from Untrusted Control Sphere (CWE-829)245 CWE-755 · Improper handling of exceptional conditions CWE-755243 CWE-668 · Information disclosure236 CWE-281 · Improper Preservation of Permissions225 CWE-256 · Use of Hard-coded Password or Plaintext Storage of a Password224 CWE-640 · WEAK PASSWORD RECOVERY MECHANISM FOR FORGOTTEN PASSWORD CWE-640219 CWE-1021 · Information disclosure216 CWE-1188 · The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.216 CWE-294 · CWE-294: Exposure of Sensitive Information to an Unauthorized Actor215 CWE-359 · Privacy Violation (CWE-359)213 CWE-259 · USE OF HARD-CODED PASSWORD CWE-259211 CWE-824 · Uninitialized Pointer208 CWE-369 · dos208 CWE-93 · Information disclosure208 CWE-184 · Incomplete List of Disallowed Inputs202 CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)196 CWE-326 · INADEQUATE ENCRYPTION STRENGTH CWE-326196 CWE-208 · Observable Timing Discrepancy193 CWE-204 · The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.191 CWE-749 · Exposed Dangerous Routine190 CWE-1236 · IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236190 CWE-494 · Escalation of privilege188 CWE-35 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.184 CWE-330 · USE OF INSUFFICIENTLY RANDOM VALUES CWE-330179 CWE-407 · Inefficient Algorithmic Complexity175 CWE-61 · UNIX Symbolic Link (Symlink) Following175 CWE-602 · The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.175 CWE-703 · IMPROPER CHECK OR HANDLING OF EXCEPTIONAL CONDITIONS CWE-703174 CWE-280 · Improper Handling of Insufficient Permissions or Privileges (CWE-280)170 CWE-305 · The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.169 CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes167 CWE-131 · Incorrect Calculation of Buffer Size (CWE-131)164 CWE-399 · Resource Management Errors160 CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')160 CWE-1287 · Improper Validation of Specified Type of Input160 CWE-521 · WEAK PASSWORD REQUIREMENTS CWE-521159 CWE-134 · Use of Externally-Controlled Format String155 CWE-472 · Integer overflow154 CWE-667 · Improper Locking154 CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)154 CWE-665 · The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.153 CWE-788 · CWE-788: Access of Memory Location After End of Buffer147 CWE-36 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.144 CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)136 CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains135 CWE-193 · OFF-BY-ONE ERROR CWE-193129 CWE-117 · The software does not neutralize or incorrectly neutralizes output that is written to logs.123 CWE-425 · The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.123 CWE-354 · Improper Validation of Integrity Check Value121 CWE-24 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ../ sequences that can resolve to a location that is outside of that directory.120 CWE-130 · Improper Handling of Length Parameter Inconsistency (CWE-130)118 CWE-1392 · Use of Default Credentials117 CWE-459 · INCOMPLETE CLEANUP CWE-459115 CWE-1220 · Insufficient Granularity of Access Control115 CWE-436 · Interpretation Conflict115 CWE-252 · Unchecked Return Value114 CWE-358 · Security Check for Standard114 CWE-680 · Integer Overflow to Buffer Overflow (CWE-680)112 CWE-807 · Reliance on Untrusted Inputs in a Security Decision (CWE-807)111 CWE-943 · The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.110 CWE-670 · input-validation110 CWE-303 · Incorrect Implementation of Authentication Algorithms (CWE-303)109 CWE-772 · Missing Release of Resource after Effective Lifetime108 CWE-377 · Insecure Temporary File (CWE-377)108 CWE-823 · Use of Out-of-range Pointer Offset (CWE-823)105 CWE-697 · Incorrect Comparison (CWE-697)103 CWE-113 · The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.103 CWE-506 · Embedded Malicious Code (CWE-506)102 CWE-620 · Unverified Password Change (CWE-620)100 CWE-840 · CWE-840: Business Logic Errors99 CWE-598 · Use of HTTP Request With Sensitive Query String98 CWE-926 · Improper Export of Android Application Components98 CWE-331 · Insufficient Entropy97 CWE-1390 · Weak Authentication97 CWE-1286 · Improper Validation of Syntactic Correctness of Input97 CWE-610 · Improper access control96 CWE-489 · LEFTOVER DEBUG CODE CWE-48995 CWE-704 · INCORRECT TYPE VERSION OR CAST CWE-70494 CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')94 CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory93 CWE-328 · Use of Weak Hash91 CWE-310 · Information disclosure91 CWE-825 · memory-safety91 CWE-706 · Use of Incorrectly-Resolved Name or Reference (CWE-706)90 CWE-91 · XML Injection (CWE-91)89 CWE-912 · HIDDEN FUNCTIONALITY CWE-91288 CWE-178 · Improper Handling of Case Sensitivity87 CWE-913 · Improper resource control86 CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)82 CWE-15 · External Control of System or Configuration Setting81 CWE-799 · Improper Control of Interaction Frequency81 CWE-916 · USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-91681 CWE-197 · Numeric Truncation Error79 CWE-212 · Information disclosure79 CWE-90 · The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.78 CWE-591 · CWE-591: Sensitive Data Storage in Improperly Locked Memory77 CWE-348 · Use of Less Trusted Source77 CWE-669 · Incorrect Resource Transfer Between Spheres76 CWE-297 · Information disclosure76 CWE-841 · Inappropriate implementation76 CWE-653 · The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.76 CWE-682 · INCORRECT CALCULATION CWE-68276 CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints75 CWE-681 · Incorrect Conversion between Numeric Types73 CWE-524 · Use of Cache Containing Sensitive Information72 CWE-277 · Insecure Inherited Permissions (CWE-277)71 CWE-267 · Privilege Defined With Unsafe Actions68 CWE-648 · Incorrect Use of Privileged APIs68 CWE-257 · STORING PASSWORDS IN A RECOVERABLE FORMAT CWE-25767 CWE-379 · CWE-379: Creation of Temporary File in Directory with Insecure Permissions66 CWE-614 · Sensitive Cookie Without Secure Attribute65 CWE-29 · Path Traversal: '..filename'64 CWE-672 · Use of released resource64 CWE-644 · IMPROPER NEUTRALIZATION OF HTTP HEADERS FOR SCRIPTING SYNTAX CWE-64464 CWE-325 · Missing Required Cryptographic Step (CWE-325)63 CWE-99 · Resource Injection (CWE-99)62 CWE-16 · Misconfiguration (CWE-16)62 CWE-255 · CWE-255 Credentials Management Errors62 CWE-636 · When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.61 CWE-1285 · Improper Validation of Specified Index, Position, or Offset in Input61 CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')60 CWE-940 · Improper Verification of Source of a Communication Channel60 CWE-548 · INFORMATION EXPOSURE THROUGH DIRECTORY LISTING CWE-54860 CWE-320 · Key Management Errors59 CWE-300 · Man-in-the-Middle (CWE-300)59 CWE-1391 · Use of Weak Credentials58 CWE-805 · CWE-805: Buffer Access with Incorrect Length Value57 CWE-170 · Improper Null Termination (CWE-170)57 CWE-123 · WRITE-WHAT-WHERE CONDITION CWE-12357 CWE-340 · Generation of Predictable Numbers or Identifiers56 CWE-87 · Improper Neutralization of Alternate XSS Syntax56 CWE-405 · CWE-405: Asymmetric Resource Consumption (Amplification)55 CWE-275 · Permission Issues (CWE-275)54 CWE-776 · XML Entity Expansion (CWE-776)53 CWE-664 · Improper Control of Resource Through Lifetime52 CWE-1395 · Dependency on Vulnerable Third-Party Component (CWE-1395)51 CWE-183 · Permissive List of Allowed Inputs49 CWE-353 · Missing Support for Integrity Check (CWE-353)49 CWE-323 · Reusing a Nonce, Key Pair in Encryption48 CWE-782 · Exposed IOCTL with Insufficient Access Control (CWE-782)48 CWE-349 · CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data47 CWE-763 · Release of Invalid Pointer or Reference47 CWE-378 · CWE-378: Creation of Temporary File With Insecure Permissions47 CWE-289 · CWE-289: Authentication Bypass by Alternate Name47 CWE-834 · Excessive Iteration (CWE-834)46 CWE-1393 · Use of Default Password46 CWE-189 · Numeric Error45 CWE-565 · Reliance on Cookies without Validation and Integrity Checking45 CWE-606 · Unchecked Input for Loop Condition45 CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag45 CWE-302 · CWE-302: Authentication Bypass by Assumed-Immutable Data44 CWE-440 · CWE-440: Expected Behavior Violation44 CWE-385 · CWE-385: Covert Timing Channel43 CWE-261 · Weak Encoding for Password43 CWE-488 · Exposure of Data Element to Wrong Session42 CWE-316 · The product stores sensitive information in cleartext in memory.42 CWE-1385 · Missing Origin Validation in WebSockets42 CWE-791 · Incomplete Filtering of Special Elements42 CWE-274 · Privilege Escalation (CWE-274)42 CWE-696 · Incorrect Behavior Order42 CWE-304 · The product implements an authentication technique, but it skips a step that weakens the technique.41 CWE-124 · Execute unauthorized code or commands41 CWE-272 · Least Privilege Violation41 CWE-202 · Exposure of Sensitive Information Through Data Queries40 CWE-471 · Modification of Assumed-Immutable Data (MAID) (CWE-471)40 CWE-1289 · Improper Validation of Unsafe Equivalence in Input40 CWE-424 · Improper Protection of Alternate Path40 CWE-420 · Unprotected Alternate Channel39 CWE-226 · Sensitive Information in Resource Not Removed Before Reuse37 CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')36 CWE-691 · Insufficient Control Flow Management (CWE-691)36 CWE-75 · Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)36 CWE-1300 · Side-channel information leakage36 CWE-778 · Insufficient Logging (CWE-778)36 CWE-241 · Improper Handling of Unexpected Data Type35 CWE-1288 · Improper Validation of Consistency within Input35 CWE-176 · The software does not properly handle when an input contains Unicode encoding.34 CWE-540 · Inclusion of Sensitive Information in Source Code34 CWE-92 · Improper conditions check34 CWE-214 · Invocation of Process Using Visible Sensitive Information34 CWE-41 · Information disclosure33 CWE-690 · CWE-690: Unchecked Return Value to NULL Pointer Dereference33 CWE-501 · Trust Boundary Violation33 CWE-356 · Product UI does not warn user of unsafe actions CWE-35633 CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)33 CWE-213 · Exposure of Sensitive Information Due to Incompatible Policies33 CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).32 CWE-313 · CWE-313: Cleartext Storage in a File or on Disk32 CWE-286 · Incorrect User Management32 CWE-1275 · Sensitive Cookie with Improper SameSite Attribute31 CWE-185 · Incorrect Regular Expression31 CWE-115 · Misinterpretation of Input31 CWE-283 · Unverified Ownership31 CWE-233 · Improper Handling of Parameters (CWE-233)31 CWE-525 · CWE-525: Use of Web Browser Cache of Sensitive Information31 CWE-83 · The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.30 CWE-282 · Improper Ownership Management30 CWE-27 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal ../ sequences that can resolve to a location that is outside of that directory.30 CWE-158 · The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.29 CWE-322 · Key Exchange without Entity Authentication29 CWE-1104 · Use of Unmaintained Third Party Components29 CWE-273 · Improper Check for Dropped Privileges29 CWE-684 · Incorrect Provision of Specified Functionality29 CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior28 CWE-924 · Improper Enforcement of Message Integrity During Transmission in a Communication Channel28 CWE-939 · Improper Authorization in Handler for Custom URL Scheme28 CWE-114 · Process Control27 CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization27 CWE-1327 · CWE-1327: Binding to an Unrestricted IP Address27 CWE-833 · dos27 CWE-195 · Signed to Unsigned Conversion Error26 CWE-96 · Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')26 CWE-460 · Improper cleanup on thrown exception CWE-46026 CWE-279 · Incorrect Execution-Assigned Permissions26 CWE-1230 · Inappropriate implementation26 CWE-270 · Privilege Context Switching Error26 CWE-523 · UNPROTECTED TRANSPORT OF CREDENTIALS CWE-52326 CWE-603 · USE OF CLIENT-SIDE AUTHENTICATION CWE-60326 CWE-391 · Unchecked Error Condition (CWE-391)25 CWE-253 · Incorrect Check of Function Return Value25 CWE-592 · This weakness has been deprecated because it covered redundant concepts already described in CWE-287.24 CWE-260 · Password in Configuration File24 CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')23 CWE-1191 · On-Chip Debug and Test Interface With Improper Access Control23 CWE-215 · Insertion of Sensitive Information Into Debugging Code23 CWE-759 · USE OF A ONE-WAY HASH WITHOUT A SALT CWE-75922 CWE-390 · Detection of Error Condition Without Action22 CWE-324 · Use of a Key Past its Expiration Date22 CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation22 CWE-268 · Privilege Chaining22 CWE-1325 · Improperly Controlled Sequential Memory Allocation22 CWE-84 · The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.22 CWE-1295 · Information disclosure22 CWE-590 · Free of Memory not on the Heap21 CWE-410 · Insufficient Resource Pool21 CWE-406 · Insufficient Control of Network Message Volume (Network Amplification)21 CWE-779 · Logging of Excessive Data21 CWE-708 · Incorrect Ownership Assignment21 CWE-335 · CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)21 CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')21 CWE-229 · Improper Handling of Values21 CWE-228 · Improper Handling of Syntactically Invalid Structure21 CWE-783 · Operator Precedence Logic Error20 CWE-1023 · Incomplete Comparison with Missing Factors20 CWE-341 · PREDICTABLE FROM OBSERVABLE STATE CWE-34120 CWE-140 · Improper Neutralization of Delimiters20 CWE-453 · Insecure Default Variable Initialization20 CWE-526 · CWE-526: Exposure of Sensitive Information Through Environmental Variables20 CWE-364 · Signal Handler Race Condition20 CWE-366 · Race Condition within a Thread20 CWE-642 · External Control of Critical State Data (CWE-642)20 CWE-357 · INSUFFICIENT UI WARNING OF DANGEROUS OPERATIONS CWE-35720 CWE-657 · Violation of Secure Design Principles (CWE-657)19 CWE-155 · CWE-155: Improper Neutralization of Wildcards or Matching Symbols19 CWE-698 · Execution After Redirect (EAR)19 CWE-625 · Permissive Regular Expression (CWE-625)19 CWE-296 · Improper Following of a Certificate's Chain of Trust (CWE-296)19 CWE-911 · Improper Update of Reference Count19 CWE-1025 · CWE-1025: Comparison Using Wrong Factors19 CWE-837 · Improper Enforcement of a Single, Unique Action18 CWE-1259 · Improper Restriction of Security Token Assignment18 CWE-641 · Improper Restriction of Names for Files and Other Resources18 CWE-804 · Guessable CAPTCHA18 CWE-927 · CWE-927: Use of Implicit Intent for Sensitive Communication 18 CWE-1394 · Use of Default Cryptographic Key18 CWE-26 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory.18 CWE-836 · Use of Password Hash Instead of Password for Authentication17 CWE-662 · Improper Synchronization17 CWE-1260 · Improper Handling of Overlap Between Protected Memory Ranges17 CWE-1427 · Improper Neutralization of Input Used for LLM Prompting17 CWE-308 · Use of Single-factor Authentication17 CWE-1050 · Excessive Platform Resource Consumption within a Loop17 CWE-395 · Use of NullPointerException Catch to Detect NULL Pointer Dereference17 CWE-820 · Missing Synchronization16 CWE-477 · USE OF OBSOLETE FUNCTION CWE-47716 CWE-413 · Improper Resource Locking16 CWE-177 · Improper Handling of URL Encoding (Hex Encoding) (CWE-177)16 CWE-475 · Undefined Behavior for Input to API16 CWE-1258 · Exposure of Sensitive System Information Due to Uncleared Debug Information16 CWE-549 · Missing Password Field Masking16 CWE-299 · Improper Check for Certificate Revocation16 CWE-394 · CWE-394: Unexpected Status Code or Return Value16 CWE-187 · Partial String Comparison15 CWE-76 · Improper Neutralization of Equivalent Special Elements15 CWE-909 · CWE-909: Missing Initialization of Resource15 CWE-1386 · CWE-1386: Insecure Operation on Windows Junction / Mount Point15 CWE-790 · CWE-790: Improper Filtering of Special Elements15 CWE-643 · Improper Neutralization of Data within XPath Expressions ('XPath Injection')15 CWE-351 · CWE-351: Insufficient Type Distinction15 CWE-821 · Incorrect Synchronization14 CWE-1263 · Improper Physical Access Control14 CWE-474 · Use of Function with Inconsistent Implementations14 CWE-599 · CWE-599: Missing Validation of OpenSSL Certificate14 CWE-337 · Predictable Seed in Pseudo-Random Number Generator (PRNG)14 CWE-334 · Small Space of Random Values14 CWE-329 · NOT USING AN UNPREDICTABLE IV WITH CBC MODE (CWE-329)14 CWE-1242 · Inclusion of undocumented features or chicken bits14 CWE-138 · Improper Neutralization of Special Elements14 CWE-449 · CWE-449: The UI Performs the Wrong Action14 CWE-647 · Use of Non-Canonical URL Paths for Authorization Decisions14 CWE-19 · Data Handling13 CWE-564 · SQL Injection: Hibernate13