Tipos de fallo

CWE-79 · XSS (CWE-79)28.832 CWE-89 · Unauthenticated SQL injection (CWE-89)12.964 CWE-862 · The software does not perform an authorization check when an actor attempts to access a resource or perform an action.8689 CWE-284 · The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.7111 CWE-352 · The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.6092 CWE-22 · The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.5950 CWE-20 · The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.5453 CWE-787 · OUT-OF-BOUNDS WRITE CWE-7875210 CWE-125 · OUT-OF-BOUNDS READ CWE-1255179 CWE-416 · USE AFTER FREE CWE-416 (CVE-2019-13510)5134 CWE-200 · The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.4959 CWE-74 · The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.4790 CWE-78 · The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.4664 CWE-94 · The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.4482 CWE-121 · Stack buffer overflow (CWE-121)3851 CWE-119 · Memory Corruption - Generic (CWE-119)3302 CWE-122 · Heap Overflow (CWE-122)3214 CWE-120 · Execute unauthorized code or commands3169 CWE-918 · The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.3133 CWE-863 · The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.3116 CWE-434 · UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-4343113 CWE-400 · UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-4003055 CWE-77 · The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.2840 CWE-502 · The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.2706 CWE-306 · The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.2663 CWE-639 · The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.2540 CWE-269 · The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.2535 CWE-287 · When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.2478 CWE-476 · Remote authenticated null dereference (CWE-476)2358 CWE-770 · The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.1897 CWE-190 · INTEGER OVERFLOW OR WRAPAROUND CWE-1901691 CWE-285 · The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.1622 CWE-98 · Remote File Inclusion (CWE-98)1311 CWE-601 · URL REDIRECTION TO UNTRUSTED SITE ('OPEN REDIRECT') CWE-6011199 CWE-266 · Incorrect Privilege Assignment1194 CWE-362 · The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.1099 CWE-798 · USE OF HARD-CODED CREDENTIALS CWE-798957 CWE-276 · INCORRECT DEFAULT PERMISSIONS CWE-276954 CWE-427 · Uncontrolled Search Path or Element897 CWE-295 · The software does not validate, or incorrectly validates, a certificate.880 CWE-532 · Sensitive Information in Log Files864 CWE-693 · PROTECTIONS MECHANISM FAILURE CWE-693848 CWE-59 · Link Following847 CWE-732 · The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.798 CWE-843 · Type Confusion708 CWE-404 · IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404702 CWE-522 · INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522701 CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)688 CWE-73 · Improper access control687 CWE-288 · Improper access control680 CWE-401 · Missing Release of Memory after Effective Lifetime670 CWE-347 · Information disclosure664 CWE-611 · XXE CWE-611654 CWE-290 · This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.617 CWE-346 · ORIGIN VALIDATION ERROR CWE-346607 CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)598 CWE-345 · Insufficient Verification of Data Authenticity (CWE-345)573 CWE-319 · The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.551 CWE-126 · Stack buffer over-read (CWE-126)533 CWE-23 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.515 CWE-307 · IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307490 CWE-613 · Session Expiration489 CWE-312 · The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.477 CWE-617 · Reachable Assertion (CWE-617)466 CWE-754 · The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.463 CWE-209 · Information Exposure Through Error Message440 CWE-835 · The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.435 CWE-1333 · The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.426 CWE-201 · Insertion of Sensitive Information Into Sent Data425 CWE-191 · INTEGER UNDERFLOW (WRAP OR WRAPAROUND) CWE-191408 CWE-497 · Information disclosure406 CWE-451 · User Interface (UI) Misrepresentation of Critical Information (CWE-451)406 CWE-327 · USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327404 CWE-1321 · Prototype Pollution391 CWE-250 · Privilege elevation379 CWE-116 · Improper output encoding378 CWE-321 · USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321372 CWE-552 · Files or Directories Accessible to External Parties (CWE-552)368 CWE-415 · use-after-free365 CWE-674 · UNCONTROLLED RECURSION CWE-674364 CWE-908 · Use of Uninitialized Resource (CWE-908)359 CWE-428 · UNQUOTED SEARCH PATH OR ELEMENT CWE-428356 CWE-203 · Observable Discrepancy354 CWE-1284 · Improper Validation of Specified Quantity in Input334 CWE-129 · memory-safety332 CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')330 CWE-426 · UNTRUSTED SEARCH PATH CWE-426327 CWE-88 · Information disclosure326 CWE-311 · MISSING ENCRYPTION OF SENSITIVE DATA CWE-311312 CWE-248 · UNCAUGHT EXCEPTION CWE-248304 CWE-264 · Privileges, and Access Control [CWE-264]300 CWE-922 · INSECURE STORAGE OF SENSITIVE INFORMATION CWE-922284 CWE-1336 · Information disclosure262 CWE-789 · Uncontrolled Memory Allocation259 CWE-384 · Session Fixiation257 CWE-707 · Improper Neutralization257 CWE-457 · Use of Uninitialized Variable255 CWE-822 · UNTRUSTED POINTER DEREFERENCE CWE-822254 CWE-829 · Inclusion of Functionality from Untrusted Control Sphere (CWE-829)251 CWE-755 · Improper handling of exceptional conditions CWE-755247 CWE-668 · Information disclosure238 CWE-281 · Improper Preservation of Permissions229 CWE-256 · Use of Hard-coded Password or Plaintext Storage of a Password225 CWE-640 · WEAK PASSWORD RECOVERY MECHANISM FOR FORGOTTEN PASSWORD CWE-640223 CWE-1188 · The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.221 CWE-294 · CWE-294: Exposure of Sensitive Information to an Unauthorized Actor219 CWE-93 · Information disclosure217 CWE-1021 · Information disclosure216 CWE-359 · Privacy Violation (CWE-359)215 CWE-259 · USE OF HARD-CODED PASSWORD CWE-259214 CWE-369 · dos210 CWE-184 · Incomplete List of Disallowed Inputs210 CWE-824 · Uninitialized Pointer210 CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)203 CWE-326 · INADEQUATE ENCRYPTION STRENGTH CWE-326196 CWE-208 · Observable Timing Discrepancy196 CWE-204 · The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.193 CWE-749 · Exposed Dangerous Routine193 CWE-1236 · IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236192 CWE-494 · Escalation of privilege192 CWE-35 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.187 CWE-407 · Inefficient Algorithmic Complexity183 CWE-330 · USE OF INSUFFICIENTLY RANDOM VALUES CWE-330180 CWE-61 · UNIX Symbolic Link (Symlink) Following177 CWE-602 · The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.176 CWE-703 · IMPROPER CHECK OR HANDLING OF EXCEPTIONAL CONDITIONS CWE-703174 CWE-305 · The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.172 CWE-280 · Improper Handling of Insufficient Permissions or Privileges (CWE-280)172 CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes171 CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')168 CWE-131 · Incorrect Calculation of Buffer Size (CWE-131)168 CWE-1287 · Improper Validation of Specified Type of Input161 CWE-399 · Resource Management Errors160 CWE-521 · WEAK PASSWORD REQUIREMENTS CWE-521159 CWE-134 · Use of Externally-Controlled Format String159 CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)158 CWE-667 · Improper Locking156 CWE-472 · Integer overflow155 CWE-665 · The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.154 CWE-788 · CWE-788: Access of Memory Location After End of Buffer147 CWE-36 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.144 CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)140 CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains136 CWE-193 · OFF-BY-ONE ERROR CWE-193131 CWE-425 · The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.127 CWE-117 · The software does not neutralize or incorrectly neutralizes output that is written to logs.124 CWE-354 · Improper Validation of Integrity Check Value122 CWE-24 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize ../ sequences that can resolve to a location that is outside of that directory.121 CWE-1392 · Use of Default Credentials119 CWE-459 · INCOMPLETE CLEANUP CWE-459119 CWE-130 · Improper Handling of Length Parameter Inconsistency (CWE-130)119 CWE-943 · The application generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.118 CWE-807 · Reliance on Untrusted Inputs in a Security Decision (CWE-807)117 CWE-252 · Unchecked Return Value117 CWE-1220 · Insufficient Granularity of Access Control115 CWE-436 · Interpretation Conflict115 CWE-358 · Security Check for Standard115 CWE-670 · input-validation113 CWE-680 · Integer Overflow to Buffer Overflow (CWE-680)112 CWE-303 · Incorrect Implementation of Authentication Algorithms (CWE-303)111 CWE-377 · Insecure Temporary File (CWE-377)109 CWE-772 · Missing Release of Resource after Effective Lifetime109 CWE-823 · Use of Out-of-range Pointer Offset (CWE-823)106 CWE-697 · Incorrect Comparison (CWE-697)106 CWE-113 · The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.104 CWE-506 · Embedded Malicious Code (CWE-506)102 CWE-489 · LEFTOVER DEBUG CODE CWE-489100 CWE-620 · Unverified Password Change (CWE-620)100 CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')100 CWE-840 · CWE-840: Business Logic Errors99 CWE-598 · Use of HTTP Request With Sensitive Query String98 CWE-1390 · Weak Authentication98 CWE-926 · Improper Export of Android Application Components98 CWE-610 · Improper access control98 CWE-1286 · Improper Validation of Syntactic Correctness of Input98 CWE-331 · Insufficient Entropy97 CWE-704 · INCORRECT TYPE VERSION OR CAST CWE-70494 CWE-328 · Use of Weak Hash93 CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory93 CWE-178 · Improper Handling of Case Sensitivity92 CWE-825 · memory-safety92 CWE-706 · Use of Incorrectly-Resolved Name or Reference (CWE-706)92 CWE-310 · Information disclosure91 CWE-91 · XML Injection (CWE-91)91 CWE-912 · HIDDEN FUNCTIONALITY CWE-91289 CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)86 CWE-913 · Improper resource control86 CWE-90 · The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.83 CWE-348 · Use of Less Trusted Source83 CWE-799 · Improper Control of Interaction Frequency83 CWE-15 · External Control of System or Configuration Setting82 CWE-916 · USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-91682 CWE-197 · Numeric Truncation Error81 CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints81 CWE-212 · Information disclosure80 CWE-297 · Information disclosure79 CWE-841 · Inappropriate implementation79 CWE-653 · The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.79 CWE-669 · Incorrect Resource Transfer Between Spheres78 CWE-681 · Incorrect Conversion between Numeric Types78 CWE-591 · CWE-591: Sensitive Data Storage in Improperly Locked Memory77 CWE-682 · INCORRECT CALCULATION CWE-68276 CWE-524 · Use of Cache Containing Sensitive Information73 CWE-277 · Insecure Inherited Permissions (CWE-277)71 CWE-267 · Privilege Defined With Unsafe Actions70 CWE-648 · Incorrect Use of Privileged APIs68 CWE-257 · STORING PASSWORDS IN A RECOVERABLE FORMAT CWE-25768 CWE-614 · Sensitive Cookie Without Secure Attribute67 CWE-379 · CWE-379: Creation of Temporary File in Directory with Insecure Permissions66 CWE-672 · Use of released resource65 CWE-29 · Path Traversal: '..filename'64 CWE-644 · IMPROPER NEUTRALIZATION OF HTTP HEADERS FOR SCRIPTING SYNTAX CWE-64464 CWE-325 · Missing Required Cryptographic Step (CWE-325)64 CWE-636 · When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.63 CWE-99 · Resource Injection (CWE-99)63 CWE-255 · CWE-255 Credentials Management Errors63 CWE-16 · Misconfiguration (CWE-16)62 CWE-940 · Improper Verification of Source of a Communication Channel62 CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')61 CWE-1285 · Improper Validation of Specified Index, Position, or Offset in Input61 CWE-548 · INFORMATION EXPOSURE THROUGH DIRECTORY LISTING CWE-54860 CWE-320 · Key Management Errors60 CWE-1391 · Use of Weak Credentials60 CWE-300 · Man-in-the-Middle (CWE-300)60 CWE-170 · Improper Null Termination (CWE-170)57 CWE-805 · CWE-805: Buffer Access with Incorrect Length Value57 CWE-87 · Improper Neutralization of Alternate XSS Syntax57 CWE-123 · WRITE-WHAT-WHERE CONDITION CWE-12357 CWE-340 · Generation of Predictable Numbers or Identifiers56 CWE-405 · CWE-405: Asymmetric Resource Consumption (Amplification)55 CWE-275 · Permission Issues (CWE-275)54 CWE-189 · Numeric Error53 CWE-776 · XML Entity Expansion (CWE-776)53 CWE-664 · Improper Control of Resource Through Lifetime52 CWE-1395 · Dependency on Vulnerable Third-Party Component (CWE-1395)52 CWE-183 · Permissive List of Allowed Inputs50 CWE-763 · Release of Invalid Pointer or Reference49 CWE-378 · CWE-378: Creation of Temporary File With Insecure Permissions49 CWE-353 · Missing Support for Integrity Check (CWE-353)49 CWE-782 · Exposed IOCTL with Insufficient Access Control (CWE-782)48 CWE-349 · CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data48 CWE-323 · Reusing a Nonce, Key Pair in Encryption48 CWE-289 · CWE-289: Authentication Bypass by Alternate Name47 CWE-696 · Incorrect Behavior Order46 CWE-834 · Excessive Iteration (CWE-834)46 CWE-1393 · Use of Default Password46 CWE-440 · CWE-440: Expected Behavior Violation46 CWE-606 · Unchecked Input for Loop Condition46 CWE-565 · Reliance on Cookies without Validation and Integrity Checking45 CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag45 CWE-488 · Exposure of Data Element to Wrong Session44 CWE-304 · The product implements an authentication technique, but it skips a step that weakens the technique.44 CWE-302 · CWE-302: Authentication Bypass by Assumed-Immutable Data44 CWE-791 · Incomplete Filtering of Special Elements44 CWE-261 · Weak Encoding for Password44 CWE-1289 · Improper Validation of Unsafe Equivalence in Input44 CWE-385 · CWE-385: Covert Timing Channel43 CWE-1385 · Missing Origin Validation in WebSockets42 CWE-274 · Privilege Escalation (CWE-274)42 CWE-202 · Exposure of Sensitive Information Through Data Queries41 CWE-471 · Modification of Assumed-Immutable Data (MAID) (CWE-471)41 CWE-316 · The product stores sensitive information in cleartext in memory.41 CWE-124 · Execute unauthorized code or commands41 CWE-272 · Least Privilege Violation41 CWE-420 · Unprotected Alternate Channel40 CWE-424 · Improper Protection of Alternate Path40 CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')37 CWE-540 · Inclusion of Sensitive Information in Source Code37 CWE-226 · Sensitive Information in Resource Not Removed Before Reuse37 CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).36 CWE-75 · Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)36 CWE-691 · Insufficient Control Flow Management (CWE-691)36 CWE-1300 · Side-channel information leakage36 CWE-778 · Insufficient Logging (CWE-778)36 CWE-176 · The software does not properly handle when an input contains Unicode encoding.35 CWE-241 · Improper Handling of Unexpected Data Type35 CWE-501 · Trust Boundary Violation35 CWE-214 · Invocation of Process Using Visible Sensitive Information35 CWE-1288 · Improper Validation of Consistency within Input35 CWE-92 · Improper conditions check34 CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)34 CWE-41 · Information disclosure33 CWE-690 · CWE-690: Unchecked Return Value to NULL Pointer Dereference33 CWE-356 · Product UI does not warn user of unsafe actions CWE-35633 CWE-213 · Exposure of Sensitive Information Due to Incompatible Policies33 CWE-313 · CWE-313: Cleartext Storage in a File or on Disk32 CWE-286 · Incorrect User Management32 CWE-283 · Unverified Ownership32 CWE-1275 · Sensitive Cookie with Improper SameSite Attribute31 CWE-185 · Incorrect Regular Expression31 CWE-115 · Misinterpretation of Input31 CWE-525 · CWE-525: Use of Web Browser Cache of Sensitive Information31 CWE-233 · Improper Handling of Parameters (CWE-233)31 CWE-83 · The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.30 CWE-282 · Improper Ownership Management30 CWE-1104 · Use of Unmaintained Third Party Components30 CWE-27 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize multiple internal ../ sequences that can resolve to a location that is outside of that directory.30 CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior29 CWE-195 · Signed to Unsigned Conversion Error29 CWE-158 · The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL characters or null bytes when they are sent to a downstream component.29 CWE-322 · Key Exchange without Entity Authentication29 CWE-684 · Incorrect Provision of Specified Functionality29 CWE-273 · Improper Check for Dropped Privileges29 CWE-1191 · On-Chip Debug and Test Interface With Improper Access Control29 CWE-924 · Improper Enforcement of Message Integrity During Transmission in a Communication Channel28 CWE-939 · Improper Authorization in Handler for Custom URL Scheme28 CWE-1327 · CWE-1327: Binding to an Unrestricted IP Address28 CWE-114 · Process Control27 CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization27 CWE-833 · dos27 CWE-96 · Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')26 CWE-391 · Unchecked Error Condition (CWE-391)26 CWE-460 · Improper cleanup on thrown exception CWE-46026 CWE-279 · Incorrect Execution-Assigned Permissions26 CWE-1230 · Inappropriate implementation26 CWE-270 · Privilege Context Switching Error26 CWE-603 · USE OF CLIENT-SIDE AUTHENTICATION CWE-60326 CWE-523 · UNPROTECTED TRANSPORT OF CREDENTIALS CWE-52326 CWE-260 · Password in Configuration File25 CWE-253 · Incorrect Check of Function Return Value25 CWE-592 · This weakness has been deprecated because it covered redundant concepts already described in CWE-287.24 CWE-390 · Detection of Error Condition Without Action24 CWE-215 · Insertion of Sensitive Information Into Debugging Code24 CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')23 CWE-1325 · Improperly Controlled Sequential Memory Allocation23 CWE-590 · Free of non-heap memory22 CWE-759 · USE OF A ONE-WAY HASH WITHOUT A SALT CWE-75922 CWE-324 · Use of a Key Past its Expiration Date22 CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation22 CWE-268 · Privilege Chaining22 CWE-84 · The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.22 CWE-1295 · Information disclosure22 CWE-410 · Insufficient Resource Pool21 CWE-1023 · Incomplete Comparison with Missing Factors21 CWE-406 · Insufficient Control of Network Message Volume (Network Amplification)21 CWE-779 · Logging of Excessive Data21 CWE-335 · CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)21 CWE-708 · Incorrect Ownership Assignment21 CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')21 CWE-229 · Improper Handling of Values21 CWE-228 · Improper Handling of Syntactically Invalid Structure21 CWE-783 · Operator Precedence Logic Error20 CWE-341 · PREDICTABLE FROM OBSERVABLE STATE CWE-34120 CWE-625 · Permissive Regular Expression (CWE-625)20 CWE-140 · Improper Neutralization of Delimiters20 CWE-453 · Insecure Default Variable Initialization20 CWE-526 · CWE-526: Exposure of Sensitive Information Through Environmental Variables20 CWE-364 · Signal Handler Race Condition20 CWE-642 · External Control of Critical State Data (CWE-642)20 CWE-1025 · CWE-1025: Comparison Using Wrong Factors20 CWE-366 · Race Condition within a Thread20 CWE-357 · INSUFFICIENT UI WARNING OF DANGEROUS OPERATIONS CWE-35720 CWE-657 · Violation of Secure Design Principles (CWE-657)19 CWE-155 · CWE-155: Improper Neutralization of Wildcards or Matching Symbols19 CWE-698 · Execution After Redirect (EAR)19 CWE-296 · Improper Following of a Certificate's Chain of Trust (CWE-296)19 CWE-911 · Improper Update of Reference Count19 CWE-804 · Guessable CAPTCHA18 CWE-1259 · Improper Restriction of Security Token Assignment18 CWE-837 · Improper Enforcement of a Single, Unique Action18 CWE-1394 · Use of Default Cryptographic Key18 CWE-1050 · Excessive Platform Resource Consumption within a Loop18 CWE-927 · CWE-927: Use of Implicit Intent for Sensitive Communication 18 CWE-26 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize /dir/../filename sequences that can resolve to a location that is outside of that directory.18 CWE-641 · Improper Restriction of Names for Files and Other Resources18 CWE-836 · Use of Password Hash Instead of Password for Authentication17 CWE-177 · Improper Handling of URL Encoding (Hex Encoding) (CWE-177)17 CWE-1260 · Improper Handling of Overlap Between Protected Memory Ranges17 CWE-662 · Improper Synchronization17 CWE-1427 · Improper Neutralization of Input Used for LLM Prompting17 CWE-308 · Use of Single-factor Authentication17 CWE-299 · Improper Check for Certificate Revocation17 CWE-395 · Use of NullPointerException Catch to Detect NULL Pointer Dereference17 CWE-820 · Missing Synchronization16 CWE-477 · USE OF OBSOLETE FUNCTION CWE-47716 CWE-475 · Undefined Behavior for Input to API16 CWE-187 · Partial String Comparison16 CWE-413 · Improper Resource Locking16 CWE-1258 · Exposure of Sensitive System Information Due to Uncleared Debug Information16 CWE-549 · Missing Password Field Masking16 CWE-394 · CWE-394: Unexpected Status Code or Return Value16 CWE-76 · Improper Neutralization of Equivalent Special Elements15 CWE-647 · Use of Non-Canonical URL Paths for Authorization Decisions15 CWE-1242 · Inclusion of undocumented features or chicken bits15 CWE-1386 · CWE-1386: Insecure Operation on Windows Junction / Mount Point15 CWE-790 · CWE-790: Improper Filtering of Special Elements15 CWE-909 · CWE-909: Missing Initialization of Resource15 CWE-351 · CWE-351: Insufficient Type Distinction15 CWE-643 · Improper Neutralization of Data within XPath Expressions ('XPath Injection')15 CWE-821 · Incorrect Synchronization14 CWE-1263 · Improper Physical Access Control14 CWE-599 · CWE-599: Missing Validation of OpenSSL Certificate14 CWE-337 · Predictable Seed in Pseudo-Random Number Generator (PRNG)14 CWE-334 · Small Space of Random Values14 CWE-474 · Use of Function with Inconsistent Implementations14 CWE-329 · NOT USING AN UNPREDICTABLE IV WITH CBC MODE (CWE-329)14 CWE-138 · Improper Neutralization of Special Elements14 CWE-449 · CWE-449: The UI Performs the Wrong Action14 CWE-19 · Data Handling13 CWE-564 · SQL Injection: Hibernate13