Tipos de fallo

CWE-79 · XSS (CWE-79)27.099 CWE-89 · Unauthenticated SQL injection (CWE-89)12.118 CWE-862 · The software does not perform an authorization check when an actor attempts to access a resource or perform an action.7413 CWE-352 · The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.5860 CWE-284 · The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.5368 CWE-22 · The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.5197 CWE-20 · The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.5022 CWE-787 · OUT-OF-BOUNDS WRITE CWE-7874711 CWE-125 · OUT-OF-BOUNDS READ CWE-1254573 CWE-416 · USE AFTER FREE CWE-416 (CVE-2019-13510)4479 CWE-74 · Injection4376 CWE-200 · The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.4314 CWE-78 · The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.4095 CWE-94 · Script injection3994 CWE-121 · Stack buffer overflow (CWE-121)3570 CWE-119 · Memory Corruption - Generic (CWE-119)3047 CWE-120 · Execute unauthorized code or commands3024 CWE-434 · UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-4342918 CWE-400 · UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-4002642 CWE-77 · The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.2638 CWE-122 · Heap Overflow (CWE-122)2565 CWE-918 · The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.2509 CWE-863 · The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.2400 CWE-502 · The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.2395 CWE-476 · Remote authenticated null dereference (CWE-476)2191 CWE-306 · The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.2144 CWE-287 · When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.2077 CWE-269 · The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.2059 CWE-639 · The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.1883 CWE-770 · The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.1550 CWE-285 · The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.1434 CWE-190 · INTEGER OVERFLOW OR WRAPAROUND CWE-1901426 CWE-98 · Remote File Inclusion (CWE-98)1272 CWE-601 · URL REDIRECTION TO UNTRUSTED SITE ('OPEN REDIRECT') CWE-6011092 CWE-266 · Incorrect Privilege Assignment1046 CWE-362 · Race Condition (CWE-362), Classic Buffer Overflow (CWE-120)948 CWE-276 · INCORRECT DEFAULT PERMISSIONS CWE-276924 CWE-427 · Uncontrolled Search Path or Element865 CWE-798 · USE OF HARD-CODED CREDENTIALS CWE-798859 CWE-532 · Sensitive Information in Log Files779 CWE-295 · Information disclosure739 CWE-732 · The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.734 CWE-59 · Link Following714 CWE-693 · PROTECTIONS MECHANISM FAILURE CWE-693670 CWE-404 · IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404626 CWE-288 · Improper access control624 CWE-401 · Missing Release of Memory after Effective Lifetime621 CWE-843 · Type Confusion607 CWE-611 · XXE CWE-611598 CWE-522 · INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522597 CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)568 CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)564 CWE-347 · Information disclosure541 CWE-73 · Improper access control530 CWE-346 · ORIGIN VALIDATION ERROR CWE-346521 CWE-290 · This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.515 CWE-319 · The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.501 CWE-126 · Stack buffer over-read (CWE-126)480 CWE-23 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.466 CWE-345 · Insufficient Verification of Data Authenticity (CWE-345)451 CWE-307 · IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307435 CWE-613 · Session Expiration432 CWE-754 · The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.429 CWE-312 · Information disclosure424 CWE-617 · Reachable Assertion (CWE-617)405 CWE-209 · Information Exposure Through Error Message394 CWE-201 · Insertion of Sensitive Information Into Sent Data379 CWE-327 · USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327377 CWE-497 · Information disclosure374 CWE-835 · The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.372 CWE-1333 · The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.371 CWE-428 · UNQUOTED SEARCH PATH OR ELEMENT CWE-428352 CWE-451 · User Interface (UI) Misrepresentation of Critical Information (CWE-451)346 CWE-250 · EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250346 CWE-1321 · Prototype Pollution343 CWE-552 · Files or Directories Accessible to External Parties (CWE-552)334 CWE-191 · INTEGER UNDERFLOW (WRAP OR WRAPAROUND) CWE-191331 CWE-321 · USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321320 CWE-415 · use-after-free312 CWE-116 · Improper Encoding or Escaping of Output (CWE-116), Improper Handling of Unicode Encoding (CWE-176)310 CWE-203 · Observable Discrepancy309 CWE-311 · MISSING ENCRYPTION OF SENSITIVE DATA CWE-311304 CWE-426 · UNTRUSTED SEARCH PATH CWE-426299 CWE-129 · IMPROPER VALIDATION OF ARRAY INDEX CWE-129289 CWE-264 · Privileges, and Access Control [CWE-264]288 CWE-674 · UNCONTROLLED RECURSION CWE-674282 CWE-922 · INSECURE STORAGE OF SENSITIVE INFORMATION CWE-922279 CWE-1284 · Improper Validation of Specified Quantity in Input275 CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')271 CWE-908 · Use of Uninitialized Resource (CWE-908)270 CWE-88 · Information disclosure252 CWE-707 · Improper Neutralization251 CWE-248 · UNCAUGHT EXCEPTION CWE-248243 CWE-755 · Improper handling of exceptional conditions CWE-755232 CWE-384 · Session Fixiation232 CWE-457 · Use of Uninitialized Variable231 CWE-281 · Improper Preservation of Permissions219 CWE-668 · Information disclosure217 CWE-822 · UNTRUSTED POINTER DEREFERENCE CWE-822216 CWE-256 · Use of Hard-coded Password or Plaintext Storage of a Password215 CWE-829 · Inclusion of Functionality from Untrusted Control Sphere (CWE-829)210 CWE-789 · Uncontrolled Memory Allocation205 CWE-824 · Uninitialized Pointer205 CWE-1336 · Information disclosure203 CWE-1021 · Inappropriate implementation199 CWE-359 · Privacy Violation (CWE-359)198 CWE-640 · WEAK PASSWORD RECOVERY MECHANISM FOR FORGOTTEN PASSWORD CWE-640197 CWE-259 · USE OF HARD-CODED PASSWORD CWE-259195 CWE-369 · dos195 CWE-1188 · The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.190 CWE-326 · INADEQUATE ENCRYPTION STRENGTH CWE-326186 CWE-1236 · IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236178 CWE-749 · Exposed Dangerous Routine175 CWE-35 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.174 CWE-204 · The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.172 CWE-294 · CWE-294: Exposure of Sensitive Information to an Unauthorized Actor171 CWE-93 · Information disclosure171 CWE-208 · Observable Timing Discrepancy165 CWE-494 · Escalation of privilege163 CWE-61 · UNIX Symbolic Link (Symlink) Following160 CWE-399 · Resource Management Errors160 CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)159 CWE-602 · The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.159 CWE-184 · Incomplete List of Disallowed Inputs159 CWE-330 · USE OF INSUFFICIENTLY RANDOM VALUES CWE-330156 CWE-521 · WEAK PASSWORD REQUIREMENTS CWE-521156 CWE-703 · IMPROPER CHECK OR HANDLING OF EXCEPTIONAL CONDITIONS CWE-703155 CWE-280 · Improper Handling of Insufficient Permissions or Privileges (CWE-280)155 CWE-305 · The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.154 CWE-667 · Improper Locking151 CWE-1287 · Improper Validation of Specified Type of Input149 CWE-665 · The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.148 CWE-131 · Incorrect Calculation of Buffer Size (CWE-131)147 CWE-788 · CWE-788: Access of Memory Location After End of Buffer147 CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)146 CWE-472 · Integer overflow144 CWE-134 · Use of Externally-Controlled Format String144 CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes141 CWE-36 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.133 CWE-407 · Inefficient Algorithmic Complexity119 CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains117 CWE-425 · The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.117 CWE-358 · Security Check for Standard114 CWE-24 · Path Traversal: '../filedir'114 CWE-193 · OFF-BY-ONE ERROR CWE-193110 CWE-1392 · Use of Default Credentials109 CWE-354 · Improper Validation of Integrity Check Value108 CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')108 CWE-680 · Integer Overflow to Buffer Overflow (CWE-680)106 CWE-130 · Improper Handling of Length Parameter Inconsistency (CWE-130)106 CWE-117 · The software does not neutralize or incorrectly neutralizes output that is written to logs.103 CWE-252 · Unchecked Return Value101 CWE-823 · Use of Out-of-range Pointer Offset (CWE-823)101 CWE-670 · input-validation101 CWE-1220 · Insufficient Granularity of Access Control100 CWE-303 · Incorrect Implementation of Authentication Algorithms (CWE-303)99 CWE-377 · Insecure Temporary File (CWE-377)98 CWE-506 · Embedded Malicious Code (CWE-506)93 CWE-840 · CWE-840: Business Logic Errors92 CWE-436 · Interpretation Conflict92 CWE-1286 · Improper Validation of Syntactic Correctness of Input91 CWE-772 · Missing Release of Resource after Effective Lifetime91 CWE-113 · The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.90 CWE-926 · Improper Export of Android Application Components90 CWE-620 · Unverified Password Change (CWE-620)90 CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)90 CWE-328 · Use of Weak Hash90 CWE-610 · Improper access control90 CWE-598 · Use of HTTP Request With Sensitive Query String88 CWE-489 · LEFTOVER DEBUG CODE CWE-48988 CWE-331 · Insufficient Entropy88 CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory88 CWE-459 · INCOMPLETE CLEANUP CWE-45987 CWE-807 · Reliance on Untrusted Inputs in a Security Decision (CWE-807)87 CWE-825 · memory-safety86 CWE-1390 · Weak Authentication86 CWE-912 · HIDDEN FUNCTIONALITY CWE-91285 CWE-310 · Information disclosure81 CWE-704 · INCORRECT TYPE VERSION OR CAST CWE-70481 CWE-697 · Incorrect Comparison (CWE-697)80 CWE-591 · CWE-591: Sensitive Data Storage in Improperly Locked Memory77 CWE-91 · XML Injection (CWE-91)75 CWE-653 · The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.72 CWE-15 · External Control of System or Configuration Setting72 CWE-277 · Insecure Inherited Permissions (CWE-277)71 CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)71 CWE-916 · USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-91671 CWE-799 · Improper Control of Interaction Frequency71 CWE-913 · Improper Control of Dynamically-Managed Code Resources69 CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints68 CWE-212 · Information disclosure68 CWE-943 · Improper Neutralization of Special Elements in Data Query Logic67 CWE-648 · Incorrect Use of Privileged APIs67 CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')67 CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')65 CWE-257 · STORING PASSWORDS IN A RECOVERABLE FORMAT CWE-25765 CWE-267 · Privilege Defined With Unsafe Actions65 CWE-682 · INCORRECT CALCULATION CWE-68265 CWE-348 · Use of Less Trusted Source65 CWE-706 · Use of Incorrectly-Resolved Name or Reference (CWE-706)64 CWE-178 · Improper Handling of Case Sensitivity64 CWE-614 · Sensitive Cookie Without Secure Attribute64 CWE-681 · Incorrect Conversion between Numeric Types63 CWE-29 · Path Traversal: '..filename'63 CWE-524 · Use of Cache Containing Sensitive Information63 CWE-16 · Misconfiguration (CWE-16)62 CWE-255 · CWE-255 Credentials Management Errors61 CWE-644 · IMPROPER NEUTRALIZATION OF HTTP HEADERS FOR SCRIPTING SYNTAX CWE-64461 CWE-297 · Information disclosure60 CWE-841 · Enforcement of Behavioral Workflow59 CWE-669 · Incorrect resource transfer between spheres59 CWE-325 · Missing Required Cryptographic Step (CWE-325)59 CWE-379 · CWE-379: Creation of Temporary File in Directory with Insecure Permissions59 CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')59 CWE-1285 · Improper Validation of Specified Index, Position, or Offset in Input58 CWE-320 · Key Management Errors57 CWE-548 · INFORMATION EXPOSURE THROUGH DIRECTORY LISTING CWE-54857 CWE-99 · Resource Injection (CWE-99)56 CWE-300 · Man-in-the-Middle (CWE-300)55 CWE-672 · OPERATION ON A RESOURCE AFTER EXPIRATION OR RELEASE CWE-67255 CWE-1391 · Use of Weak Credentials55 CWE-805 · CWE-805: Buffer Access with Incorrect Length Value55 CWE-87 · Improper Neutralization of Alternate XSS Syntax55 CWE-940 · Improper Verification of Source of a Communication Channel55 CWE-197 · Execute unauthorized code or commands52 CWE-275 · Permission Issues (CWE-275)52 CWE-170 · Improper Null Termination (CWE-170)52 CWE-123 · WRITE-WHAT-WHERE CONDITION CWE-12350 CWE-340 · Generation of Predictable Numbers or Identifiers50 CWE-1395 · Dependency on Vulnerable Third-Party Component (CWE-1395)48 CWE-405 · CWE-405: Asymmetric Resource Consumption (Amplification)46 CWE-776 · XML Entity Expansion (CWE-776)46 CWE-378 · CWE-378: Creation of Temporary File With Insecure Permissions46 CWE-664 · Improper Control of Resource Through Lifetime44 CWE-183 · Permissive List of Allowed Inputs44 CWE-353 · Missing Support for Integrity Check (CWE-353)43 CWE-323 · Reusing a Nonce, Key Pair in Encryption43 CWE-1393 · Use of Default Password43 CWE-636 · When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.42 CWE-274 · Privilege Escalation (CWE-274)42 CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag42 CWE-302 · CWE-302: Authentication Bypass by Assumed-Immutable Data41 CWE-261 · Weak Encoding for Password41 CWE-440 · CWE-440: Expected Behavior Violation41 CWE-385 · CWE-385: Covert Timing Channel41 CWE-696 · Incorrect Behavior Order40 CWE-782 · Exposed IOCTL with Insufficient Access Control (CWE-782)40 CWE-565 · Reliance on Cookies without Validation and Integrity Checking40 CWE-606 · Unchecked Input for Loop Condition39 CWE-763 · Release of Invalid Pointer or Reference39 CWE-349 · CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data39 CWE-124 · Execute unauthorized code or commands39 CWE-289 · CWE-289: Authentication Bypass by Alternate Name38 CWE-791 · Incomplete Filtering of Special Elements38 CWE-834 · Excessive Iteration (CWE-834)37 CWE-471 · Modification of Assumed-Immutable Data (MAID) (CWE-471)37 CWE-202 · Exposure of Sensitive Information Through Data Queries37 CWE-420 · Unprotected Alternate Channel37 CWE-75 · Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)36 CWE-316 · The product stores sensitive information in cleartext in memory.36 CWE-304 · The product implements an authentication technique, but it skips a step that weakens the technique.36 CWE-272 · Least Privilege Violation35 CWE-1300 · Side-channel information leakage35 CWE-92 · Improper conditions check34 CWE-1289 · Improper Validation of Unsafe Equivalence in Input34 CWE-424 · Improper Protection of Alternate Path34 CWE-1385 · Missing Origin Validation in WebSockets34 CWE-488 · Exposure of Data Element to Wrong Session34 CWE-241 · Improper Handling of Unexpected Data Type33 CWE-226 · Sensitive Information in Resource Not Removed Before Reuse33 CWE-690 · CWE-690: Unchecked Return Value to NULL Pointer Dereference33 CWE-691 · Insufficient Control Flow Management (CWE-691)33 CWE-213 · Exposure of Sensitive Information Due to Incompatible Policies32 CWE-356 · Product UI does not warn user of unsafe actions CWE-35632 CWE-501 · Trust Boundary Violation32 CWE-286 · Incorrect User Management32 CWE-540 · Inclusion of Sensitive Information in Source Code31 CWE-189 · Numeric Error31 CWE-525 · CWE-525: Use of Web Browser Cache of Sensitive Information31 CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')31 CWE-233 · Improper Handling of Parameters (CWE-233)31 CWE-115 · Misinterpretation of Input30 CWE-176 · The software does not properly handle when an input contains Unicode encoding.30 CWE-1288 · Improper Validation of Consistency within Input30 CWE-313 · CWE-313: Cleartext Storage in a File or on Disk30 CWE-282 · Improper Ownership Management29 CWE-158 · IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-15828 CWE-41 · Information disclosure28 CWE-185 · Incorrect Regular Expression28 CWE-27 · Path Traversal: 'dir/../../filename'28 CWE-939 · Improper Authorization in Handler for Custom URL Scheme27 CWE-684 · Incorrect Provision of Specified Functionality27 CWE-83 · The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.27 CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior27 CWE-778 · Insufficient Logging (CWE-778)26 CWE-114 · CWE-114: Process Control26 CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)26 CWE-1230 · Inappropriate implementation26 CWE-322 · Key Exchange without Entity Authentication26 CWE-270 · Privilege Context Switching Error26 CWE-279 · Incorrect Execution-Assigned Permissions26 CWE-1275 · Sensitive Cookie with Improper SameSite Attribute25 CWE-214 · Invocation of Process Using Visible Sensitive Information25 CWE-523 · UNPROTECTED TRANSPORT OF CREDENTIALS CWE-52325 CWE-833 · dos25 CWE-260 · Password in Configuration File24 CWE-924 · CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel24 CWE-1104 · Use of Unmaintained Third Party Components24 CWE-592 · This weakness has been deprecated because it covered redundant concepts already described in CWE-287.24 CWE-283 · Unverified Ownership24 CWE-391 · Unchecked Error Condition (CWE-391)24 CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')23 CWE-253 · Incorrect Check of Function Return Value23 CWE-273 · Improper Check for Dropped Privileges23 CWE-460 · Improper cleanup on thrown exception CWE-46023 CWE-96 · CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')23 CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization23 CWE-195 · CWE-195: Signed to Unsigned Conversion Error22 CWE-268 · Privilege Chaining22 CWE-324 · Use of a Key Past its Expiration Date22 CWE-603 · USE OF CLIENT-SIDE AUTHENTICATION CWE-60322 CWE-1295 · Information disclosure22 CWE-1191 · On-Chip Debug and Test Interface With Improper Access Control22 CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).22 CWE-1327 · CWE-1327: Binding to an Unrestricted IP Address21 CWE-1325 · Improperly Controlled Sequential Memory Allocation21 CWE-410 · Insufficient Resource Pool21 CWE-335 · CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)21 CWE-357 · INSUFFICIENT UI WARNING OF DANGEROUS OPERATIONS CWE-35720 CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation20 CWE-140 · Improper Neutralization of Delimiters20 CWE-228 · Improper Handling of Syntactically Invalid Structure20 CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')20 CWE-364 · Signal Handler Race Condition20 CWE-590 · Free of Memory not on the Heap20 CWE-708 · Incorrect Ownership Assignment20 CWE-779 · Logging of Excessive Data20 CWE-783 · Operator Precedence Logic Error20 CWE-84 · The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.20 CWE-453 · Insecure Default Variable Initialization19 CWE-657 · Violation of Secure Design Principles (CWE-657)19 CWE-390 · Detection of Error Condition Without Action19 CWE-406 · CWE-406: Insufficient Control of Network Message Volume (Network Amplification)19 CWE-804 · Guessable CAPTCHA18 CWE-526 · CWE-526: Exposure of Sensitive Information Through Environmental Variables18 CWE-366 · Race Condition within a Thread18 CWE-229 · Improper Handling of Values18 CWE-927 · CWE-927: Use of Implicit Intent for Sensitive Communication 18 CWE-759 · USE OF A ONE-WAY HASH WITHOUT A SALT CWE-75918 CWE-215 · Insertion of Sensitive Information Into Debugging Code18 CWE-641 · Improper Restriction of Names for Files and Other Resources17 CWE-296 · Improper Following of a Certificate's Chain of Trust (CWE-296)17 CWE-662 · Improper Synchronization17 CWE-26 · Path Traversal17 CWE-1394 · Use of Default Cryptographic Key17 CWE-395 · NULL pointer dereference17 CWE-911 · Improper Update of Reference Count17 CWE-698 · Execution After Redirect (EAR)17 CWE-836 · Use of Password Hash Instead of Password for Authentication16 CWE-837 · Improper Enforcement of a Single, Unique Action16 CWE-549 · Missing Password Field Masking16 CWE-477 · USE OF OBSOLETE FUNCTION CWE-47716 CWE-642 · External Control of Critical State Data (CWE-642)16 CWE-1259 · CWE-1259: Improper Restriction of Security Token Assignment16 CWE-1050 · Excessive Platform Resource Consumption within a Loop15 CWE-820 · Missing Synchronization15 CWE-475 · Undefined Behavior for Input to API15 CWE-413 · Improper Resource Locking15 CWE-909 · CWE-909: Missing Initialization of Resource15 CWE-155 · CWE-155: Improper Neutralization of Wildcards or Matching Symbols15 CWE-341 · PREDICTABLE FROM OBSERVABLE STATE CWE-34115 CWE-1260 · Improper Handling of Overlap Between Protected Memory Ranges15 CWE-790 · CWE-790: Improper Filtering of Special Elements15 CWE-1386 · CWE-1386: Insecure Operation on Windows Junction / Mount Point15 CWE-351 · CWE-351: Insufficient Type Distinction15 CWE-308 · Use of Single-factor Authentication14 CWE-394 · CWE-394: Unexpected Status Code or Return Value14 CWE-1242 · Inclusion of undocumented features or chicken bits14 CWE-334 · Small Space of Random Values14 CWE-449 · CWE-449: The UI Performs the Wrong Action14 CWE-643 · Improper Neutralization of Data within XPath Expressions ('XPath Injection')14 CWE-599 · CWE-599: Missing Validation of OpenSSL Certificate14 CWE-762 · Mismatched Memory Management Routines13 CWE-1427 · CWE-1427: Improper Neutralization of Input Used for LLM Prompting13 CWE-1022 · CWE-1022: Use of Web Link to Untrusted Target with window.opener Access13 CWE-159 · CWE-159: Improper Handling of Invalid Use of Special Elements13 CWE-821 · Incorrect Synchronization13 CWE-329 · NOT USING AN UNPREDICTABLE IV WITH CBC MODE (CWE-329)13 CWE-19 · Data Handling13 CWE-138 · Improper Neutralization of Special Elements13 CWE-1244 · Improper Authorization on Physical Debug and Test Interfaces13 CWE-1023 · Incomplete Comparison with Missing Factors13 CWE-474 · Use of Function with Inconsistent Implementations13 CWE-337 · Predictable Seed in Pseudo-Random Number Generator (PRNG)13 CWE-1263 · Improper Physical Access Control13 CWE-76 · Improper Neutralization of Equivalent Special Elements13 CWE-392 · Missing Report of Error Condition12 CWE-701 · CWE-701: Weakness Introduced During Design12 CWE-419 · CWE-419: Unprotected Primary Channel12 CWE-25 · Path Traversal: '/../filedir'12