Weakness types

CWE-79 · XSS (CWE-79)30,791 CWE-89 · Unauthenticated SQL injection (CWE-89)13,720 CWE-862 · The software does not perform an authorization check when an actor attempts to access a resource or perform an action.10,349 CWE-284 · The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.7,989 CWE-22 · The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.6,664 CWE-416 · USE AFTER FREE CWE-416 (CVE-2019-13510)6,499 CWE-352 · The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.6,311 CWE-125 · OUT-OF-BOUNDS READ CWE-1256,183 CWE-20 · The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.5,901 CWE-787 · OUT-OF-BOUNDS WRITE CWE-7875,863 CWE-200 · The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.5,744 CWE-78 · The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.5,085 CWE-74 · The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.5,085 CWE-94 · The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.4,920 CWE-121 · Stack buffer overflow (CWE-121)4,205 CWE-122 · Heap Overflow (CWE-122)4,081 CWE-863 · The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.3,973 CWE-918 · The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.3,645 CWE-119 · Memory Corruption - Generic (CWE-119)3,568 CWE-400 · UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-4003,489 CWE-434 · UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-4343,279 CWE-639 · The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.3,274 CWE-120 · memory-safety3,267 CWE-306 · The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.3,127 CWE-502 · Unsafe Deserialization (CWE-502) in JavaNativeMessageDecoder3,063 CWE-77 · The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.2,972 CWE-287 · When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.2,871 CWE-269 · The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.2,851 CWE-476 · Remote authenticated null dereference (CWE-476)2,622 CWE-770 · The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.2,263 CWE-190 · INTEGER OVERFLOW OR WRAPAROUND CWE-1902,032 CWE-285 · The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.1,741 CWE-362 · The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.1,499 CWE-98 · Remote File Inclusion (CWE-98)1,358 CWE-266 · Incorrect Privilege Assignment1,314 CWE-601 · URL REDIRECTION TO UNTRUSTED SITE ('OPEN REDIRECT') CWE-6011,312 CWE-295 · The software does not validate, or incorrectly validates, a certificate.1,058 CWE-798 · USE OF HARD-CODED CREDENTIALS CWE-7981,038 CWE-59 · Security issue1,013 CWE-693 · The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.1,011 CWE-276 · INCORRECT DEFAULT PERMISSIONS CWE-276997 CWE-532 · Sensitive Information in Log Files968 CWE-427 · Uncontrolled Search Path or Element938 CWE-732 · The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.887 CWE-843 · Type Confusion844 CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)837 CWE-522 · INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522799 CWE-73 · Improper access control795 CWE-347 · Information disclosure787 CWE-401 · Missing Release of Memory after Effective Lifetime777 CWE-288 · Improper access control761 CWE-404 · IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404751 CWE-290 · This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.735 CWE-346 · ORIGIN VALIDATION ERROR CWE-346713 CWE-611 · XXE CWE-611712 CWE-345 · Insufficient Verification of Data Authenticity (CWE-345)695 CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)662 CWE-126 · Stack buffer over-read (CWE-126)603 CWE-319 · The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.586 CWE-617 · Reachable Assertion (CWE-617)570 CWE-613 · Session Expiration568 CWE-23 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.566 CWE-307 · IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307564 CWE-835 · The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.548 CWE-908 · Use of Uninitialized Resource (CWE-908)526 CWE-191 · INTEGER UNDERFLOW (WRAP OR WRAPAROUND) CWE-191520 CWE-754 · The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.515 CWE-201 · Insertion of Sensitive Information Into Sent Data514 CWE-312 · The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.511 CWE-451 · User Interface (UI) Misrepresentation of Critical Information (CWE-451)509 CWE-1333 · The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.499 CWE-209 · Information Exposure Through Error Message492 CWE-415 · use-after-free489 CWE-674 · UNCONTROLLED RECURSION CWE-674477 CWE-497 · Information disclosure464 CWE-1321 · Prototype Pollution445 CWE-116 · Improper output encoding443 CWE-321 · USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321439 CWE-327 · USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327421 CWE-250 · Privilege elevation409 CWE-203 · The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.402 CWE-552 · The product makes files or directories accessible to unauthorized actors, even though they should not be.400 CWE-1284 · Improper Validation of Specified Quantity in Input395 CWE-248 · UNCAUGHT EXCEPTION CWE-248393 CWE-88 · Information disclosure392 CWE-129 · memory-safety385 CWE-822 · UNTRUSTED POINTER DEREFERENCE CWE-822379 CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')366 CWE-426 · UNTRUSTED SEARCH PATH CWE-426362 CWE-428 · UNQUOTED SEARCH PATH OR ELEMENT CWE-428358 CWE-789 · Uncontrolled Memory Allocation347 CWE-829 · Inclusion of Functionality from Untrusted Control Sphere (CWE-829)325 CWE-311 · MISSING ENCRYPTION OF SENSITIVE DATA CWE-311323 CWE-264 · Privileges, and Access Control [CWE-264]309 CWE-1336 · Information disclosure306 CWE-457 · Use of Uninitialized Variable299 CWE-407 · Inefficient Algorithmic Complexity297 CWE-922 · INSECURE STORAGE OF SENSITIVE INFORMATION CWE-922294 CWE-384 · Session Fixiation280 CWE-755 · Improper handling of exceptional conditions CWE-755276 CWE-93 · Information disclosure268 CWE-1188 · The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.267 CWE-707 · The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties at met before being read from an upstream component or sent to a downstream component.264 CWE-184 · Incomplete List of Disallowed Inputs260 CWE-668 · Information disclosure258 CWE-640 · WEAK PASSWORD RECOVERY MECHANISM FOR FORGOTTEN PASSWORD CWE-640257 CWE-294 · CWE-294: Exposure of Sensitive Information to an Unauthorized Actor248 CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')244 CWE-1021 · Information disclosure238 CWE-256 · Use of Hard-coded Password or Plaintext Storage of a Password234 CWE-281 · Improper Preservation of Permissions232 CWE-369 · dos230 CWE-824 · Uninitialized Pointer230 CWE-259 · USE OF HARD-CODED PASSWORD CWE-259228 CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)227 CWE-359 · Privacy Violation (CWE-359)222 CWE-749 · Exposed Dangerous Routine221 CWE-204 · The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.220 CWE-494 · Escalation of privilege217 CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes214 CWE-208 · Observable Timing Discrepancy213 CWE-326 · INADEQUATE ENCRYPTION STRENGTH CWE-326211 CWE-1236 · IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236208 CWE-61 · UNIX Symbolic Link (Symlink) Following203 CWE-330 · USE OF INSUFFICIENTLY RANDOM VALUES CWE-330200 CWE-131 · Incorrect Calculation of Buffer Size (CWE-131)198 CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)195 CWE-35 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.194 CWE-602 · The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.189 CWE-667 · Improper Locking183 CWE-280 · Improper Handling of Insufficient Permissions or Privileges (CWE-280)182 CWE-305 · The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.181 CWE-703 · The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.181 CWE-1287 · Improper Validation of Specified Type of Input180 CWE-134 · Use of Externally-Controlled Format String177 CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)173 CWE-436 · Security issue173 CWE-665 · The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.169 CWE-472 · Integer overflow168 CWE-521 · WEAK PASSWORD REQUIREMENTS CWE-521163 CWE-459 · INCOMPLETE CLEANUP CWE-459163 CWE-193 · OFF-BY-ONE ERROR CWE-193162 CWE-399 · Resource Management Errors160 CWE-36 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.156 CWE-943 · The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.154 CWE-772 · Missing Release of Resource after Effective Lifetime152 CWE-354 · Improper Validation of Integrity Check Value152 CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains151 CWE-788 · CWE-788: Access of Memory Location After End of Buffer147 CWE-807 · Reliance on Untrusted Inputs in a Security Decision (CWE-807)146 CWE-117 · The software does not neutralize or incorrectly neutralizes output that is written to logs.146 CWE-130 · Improper Handling of Length Parameter Inconsistency (CWE-130)145 CWE-252 · Unchecked Return Value144 CWE-1392 · Use of Default Credentials143 CWE-1220 · Insufficient Granularity of Access Control142 CWE-425 · The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.138 CWE-1390 · Weak Authentication136 CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')136 CWE-24 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ../ sequences that can resolve to a location that is outside of that directory.129 CWE-706 · Use of Incorrectly-Resolved Name or Reference (CWE-706)126 CWE-377 · Insecure Temporary File (CWE-377)126 CWE-178 · Improper Handling of Case Sensitivity125 CWE-303 · Incorrect Implementation of Authentication Algorithms (CWE-303)123 CWE-358 · Security Check for Standard122 CWE-926 · Improper Export of Android Application Components121 CWE-670 · input-validation121 CWE-197 · Numeric Truncation Error117 CWE-680 · Integer Overflow to Buffer Overflow (CWE-680)115 CWE-113 · The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.115 CWE-697 · Incorrect Comparison (CWE-697)113 CWE-823 · Use of Out-of-range Pointer Offset (CWE-823)113 CWE-620 · Unverified Password Change (CWE-620)111 CWE-1286 · Improper Validation of Syntactic Correctness of Input111 CWE-840 · CWE-840: Business Logic Errors110 CWE-348 · Use of Less Trusted Source108 CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory107 CWE-489 · LEFTOVER DEBUG CODE CWE-489107 CWE-682 · INCORRECT CALCULATION CWE-682105 CWE-598 · Use of HTTP Request With Sensitive Query String105 CWE-704 · INCORRECT TYPE VERSION OR CAST CWE-704105 CWE-506 · Embedded Malicious Code (CWE-506)103 CWE-825 · memory-safety101 CWE-331 · Insufficient Entropy101 CWE-310 · Information disclosure101 CWE-91 · XML Injection (CWE-91)101 CWE-610 · Improper access control100 CWE-916 · USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-916100 CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)100 CWE-90 · The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.99 CWE-15 · External Control of System or Configuration Setting99 CWE-799 · Improper Control of Interaction Frequency99 CWE-524 · Use of Cache Containing Sensitive Information97 CWE-653 · The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.97 CWE-328 · Use of Weak Hash96 CWE-841 · Inappropriate implementation95 CWE-912 · HIDDEN FUNCTIONALITY CWE-91295 CWE-913 · Improper resource control95 CWE-297 · Information disclosure95 CWE-681 · Incorrect Conversion between Numeric Types94 CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints91 CWE-212 · Information disclosure90 CWE-669 · Incorrect Resource Transfer Between Spheres89 CWE-672 · Use of released resource89 CWE-636 · When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.84 CWE-405 · CWE-405: Asymmetric Resource Consumption (Amplification)78 CWE-267 · Privilege Defined With Unsafe Actions78 CWE-591 · CWE-591: Sensitive Data Storage in Improperly Locked Memory77 CWE-940 · Improper Verification of Source of a Communication Channel75 CWE-325 · Missing Required Cryptographic Step (CWE-325)73 CWE-379 · CWE-379: Creation of Temporary File in Directory with Insecure Permissions73 CWE-99 · Resource Injection (CWE-99)73 CWE-763 · Release of Invalid Pointer or Reference72 CWE-277 · Insecure Inherited Permissions (CWE-277)72 CWE-648 · Incorrect Use of Privileged APIs70 CWE-170 · Improper Null Termination (CWE-170)69 CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')69 CWE-257 · STORING PASSWORDS IN A RECOVERABLE FORMAT CWE-25769 CWE-614 · Sensitive Cookie Without Secure Attribute69 CWE-1285 · Improper Validation of Specified Index, Position, or Offset in Input68 CWE-1391 · Use of Weak Credentials67 CWE-644 · IMPROPER NEUTRALIZATION OF HTTP HEADERS FOR SCRIPTING SYNTAX CWE-64466 CWE-805 · CWE-805: Buffer Access with Incorrect Length Value65 CWE-664 · The software does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.65 CWE-29 · Path Traversal: '..filename'64 CWE-340 · Generation of Predictable Numbers or Identifiers64 CWE-320 · Key Management Errors64 CWE-548 · INFORMATION EXPOSURE THROUGH DIRECTORY LISTING CWE-54863 CWE-16 · Misconfiguration (CWE-16)63 CWE-776 · XML Entity Expansion (CWE-776)63 CWE-696 · Incorrect Behavior Order63 CWE-255 · CWE-255 Credentials Management Errors63 CWE-488 · Exposure of Data Element to Wrong Session62 CWE-300 · Man-in-the-Middle (CWE-300)61 CWE-183 · Permissive List of Allowed Inputs59 CWE-1395 · Dependency on Vulnerable Third-Party Component (CWE-1395)59 CWE-123 · WRITE-WHAT-WHERE CONDITION CWE-12359 CWE-87 · Improper Neutralization of Alternate XSS Syntax57 CWE-275 · Permission Issues (CWE-275)57 CWE-424 · The product does not sufficiently protect all possible paths that a user can take to access restricted functionality or resources.57 CWE-189 · Numeric Error56 CWE-349 · CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data56 CWE-782 · Exposed IOCTL with Insufficient Access Control (CWE-782)55 CWE-304 · The product implements an authentication technique, but it skips a step that weakens the technique.55 CWE-834 · Excessive Iteration (CWE-834)54 CWE-353 · Missing Support for Integrity Check (CWE-353)54 CWE-1289 · Improper Validation of Unsafe Equivalence in Input54 CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).53 CWE-440 · Expected Behavior Violation51 CWE-1385 · Missing Origin Validation in WebSockets51 CWE-606 · Unchecked Input for Loop Condition51 CWE-565 · Reliance on Cookies without Validation and Integrity Checking51 CWE-323 · Reusing a Nonce, Key Pair in Encryption50 CWE-378 · CWE-378: Creation of Temporary File With Insecure Permissions50 CWE-1393 · Use of Default Password50 CWE-289 · CWE-289: Authentication Bypass by Alternate Name50 CWE-124 · Execute unauthorized code or commands49 CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag49 CWE-202 · Exposure of Sensitive Information Through Data Queries49 CWE-302 · CWE-302: Authentication Bypass by Assumed-Immutable Data47 CWE-791 · Incomplete Filtering of Special Elements47 CWE-261 · Weak Encoding for Password46 CWE-272 · Least Privilege Violation45 CWE-471 · Modification of Assumed-Immutable Data (MAID) (CWE-471)45 CWE-226 · Sensitive Information in Resource Not Removed Before Reuse45 CWE-41 · Information disclosure44 CWE-176 · The software does not properly handle when an input contains Unicode encoding.44 CWE-214 · Invocation of Process Using Visible Sensitive Information44 CWE-385 · CWE-385: Covert Timing Channel44 CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')43 CWE-316 · The product stores sensitive information in cleartext in memory.43 CWE-274 · Privilege Escalation (CWE-274)42 CWE-691 · Insufficient Control Flow Management (CWE-691)42 CWE-420 · Unprotected Alternate Channel42 CWE-778 · Insufficient Logging (CWE-778)41 CWE-540 · Inclusion of Sensitive Information in Source Code40 CWE-283 · Unverified Ownership40 CWE-1288 · Improper Validation of Consistency within Input40 CWE-525 · CWE-525: Use of Web Browser Cache of Sensitive Information39 CWE-158 · The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.38 CWE-939 · Improper Authorization in Handler for Custom URL Scheme38 CWE-195 · Signed to Unsigned Conversion Error37 CWE-833 · dos37 CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)37 CWE-115 · Misinterpretation of Input36 CWE-75 · Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)36 CWE-501 · Trust Boundary Violation36 CWE-1327 · CWE-1327: Binding to an Unrestricted IP Address36 CWE-1300 · Side-channel information leakage36 CWE-690 · Unchecked Return Value to NULL Pointer Dereference36 CWE-213 · Exposure of Sensitive Information Due to Incompatible Policies36 CWE-83 · The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.35 CWE-322 · Key Exchange without Entity Authentication35 CWE-356 · Product UI does not warn user of unsafe actions CWE-35635 CWE-241 · Improper Handling of Unexpected Data Type35 CWE-185 · Incorrect Regular Expression34 CWE-1275 · Sensitive Cookie with Improper SameSite Attribute34 CWE-92 · Improper conditions check34 CWE-684 · Incorrect Provision of Specified Functionality33 CWE-313 · CWE-313: Cleartext Storage in a File or On-Disk33 CWE-273 · Improper Check for Dropped Privileges33 CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior32 CWE-390 · Detection of Error Condition Without Action32 CWE-286 · Incorrect User Management32 CWE-282 · Improper Ownership Management32 CWE-233 · Improper Handling of Parameters (CWE-233)32 CWE-460 · Improper cleanup on thrown exception CWE-46030 CWE-1104 · Use of Unmaintained Third Party Components30 CWE-27 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal ../ sequences that can resolve to a location that is outside of that directory.30 CWE-662 · Improper Synchronization30 CWE-1191 · On-Chip Debug and Test Interface With Improper Access Control30 CWE-1427 · Improper Neutralization of Input Used for LLM Prompting29 CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization28 CWE-114 · Process Control28 CWE-603 · USE OF CLIENT-SIDE AUTHENTICATION CWE-60328 CWE-391 · Unchecked Error Condition (CWE-391)28 CWE-1325 · Improperly Controlled Sequential Memory Allocation28 CWE-924 · Improper Enforcement of Message Integrity During Transmission in a Communication Channel28 CWE-96 · Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')28 CWE-215 · Insertion of Sensitive Information Into Debugging Code28 CWE-625 · Permissive Regular Expression (CWE-625)28 CWE-1394 · Use of Default Cryptographic Key27 CWE-270 · Privilege Context Switching Error27 CWE-523 · UNPROTECTED TRANSPORT OF CREDENTIALS CWE-52327 CWE-279 · Incorrect Execution-Assigned Permissions26 CWE-1230 · Inappropriate implementation26 CWE-253 · Incorrect Check of Function Return Value26 CWE-590 · Free of non-heap memory26 CWE-1023 · Incomplete Comparison with Missing Factors25 CWE-453 · Insecure Default Variable Initialization25 CWE-260 · Password in Configuration File25 CWE-357 · INSUFFICIENT UI WARNING OF DANGEROUS OPERATIONS CWE-35725 CWE-592 · This weakness has been deprecated because it covered redundant concepts already described in CWE-287.24 CWE-526 · CWE-526: Exposure of Sensitive Information Through Environmental Variables24 CWE-335 · CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)24 CWE-308 · Use of Single-factor Authentication24 CWE-1025 · CWE-1025: Comparison Using Wrong Factors24 CWE-759 · USE OF A ONE-WAY HASH WITHOUT A SALT CWE-75923 CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')23 CWE-140 · Improper Neutralization of Delimiters23 CWE-299 · Improper Check for Certificate Revocation23 CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation23 CWE-708 · Incorrect Ownership Assignment22 CWE-410 · Insufficient Resource Pool22 CWE-406 · Insufficient Control of Network Message Volume (Network Amplification)22 CWE-698 · Execution After Redirect (EAR)22 CWE-783 · Operator Precedence Logic Error22 CWE-324 · Use of a Key Past its Expiration Date22 CWE-268 · Privilege Chaining22 CWE-657 · Violation of Secure Design Principles (CWE-657)22 CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')22 CWE-228 · Improper Handling of Syntactically Invalid Structure22 CWE-84 · The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.22 CWE-1295 · Information disclosure22 CWE-413 · Improper Resource Locking22 CWE-804 · Guessable CAPTCHA21 CWE-642 · External Control of Critical State Data (CWE-642)21 CWE-911 · Improper Update of Reference Count21 CWE-779 · Logging of Excessive Data21 CWE-229 · Improper Handling of Values21 CWE-341 · PREDICTABLE FROM OBSERVABLE STATE CWE-34121 CWE-187 · Partial String Comparison20 CWE-177 · Improper Handling of URL Encoding (Hex Encoding) (CWE-177)20 CWE-155 · Improper Neutralization of Wildcards or Matching Symbols20 CWE-1259 · Improper Restriction of Security Token Assignment20 CWE-366 · Race Condition within a Thread20 CWE-364 · Signal Handler Race Condition20 CWE-26 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory.20 CWE-1050 · Excessive Platform Resource Consumption within a Loop20 CWE-837 · Improper Enforcement of a Single, Unique Action20 CWE-643 · Improper Neutralization of Data within XPath Expressions ('XPath Injection')19 CWE-1260 · Improper Handling of Overlap Between Protected Memory Ranges19 CWE-641 · Improper Restriction of Names for Files and Other Resources19 CWE-296 · Improper Following of a Certificate's Chain of Trust (CWE-296)19 CWE-836 · Use of Password Hash Instead of Password for Authentication19 CWE-394 · CWE-394: Unexpected Status Code or Return Value18 CWE-337 · Predictable Seed in Pseudo-Random Number Generator (PRNG)18 CWE-1386 · CWE-1386: Insecure Operation on Windows Junction / Mount Point18 CWE-694 · Use of Multiple Resources with Duplicate Identifier (CWE-694)18 CWE-927 · CWE-927: Use of Implicit Intent for Sensitive Communication 18 CWE-647 · Use of Non-Canonical URL Paths for Authorization Decisions17 CWE-395 · Use of NullPointerException Catch to Detect NULL Pointer Dereference17 CWE-475 · Undefined Behavior for Input to API17 CWE-820 · Missing Synchronization16 CWE-76 · Improper Neutralization of Equivalent Special Elements16 CWE-549 · Missing Password Field Masking16 CWE-172 · Encoding Error16 CWE-1258 · Exposure of Sensitive System Information Due to Uncleared Debug Information16 CWE-334 · Small Space of Random Values16 CWE-329 · NOT USING AN UNPREDICTABLE IV WITH CBC MODE (CWE-329)16 CWE-31 · CWE-31: Path Traversal: 'dir\..\..\filename'16 CWE-1242 · Inclusion of Undocumented Features or Chicken Bits16 CWE-363 · Race Condition Enabling Link Following (CWE-363)16 CWE-477 · USE OF OBSOLETE FUNCTION CWE-47716 CWE-909 · Missing Initialization of Resource16 CWE-19 · Data Handling15 CWE-393 · Return of Wrong Status Code15 CWE-650 · Trusting HTTP Permission Methods on the Server Side15 CWE-138 · Improper Neutralization of Special Elements15 CWE-790 · CWE-790: Improper Filtering of Special Elements15 CWE-265 · Sandbox Issue15