The Synopsys Software Integrity Group is now Black Duck®. Learn More

At its core, Common Weakness Enumerations (CWEs) are software weaknesses. CWEs provide a taxonomy to categorize and describe software weaknesses, giving developers and security practitioners a common language for software security.

MITRE owns and maintains the project. To learn more about CWE, click here.

Search below to see Coverity's CWE support of languages in your codebase.

Interested in a specific language or platform?



Language/Platform CWE Description
Apex 17 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Apex 18 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Apex 19 Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Apex 20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Apex 74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Apex 77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Apex 79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Apex 89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
Apex 116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Apex 137 Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
Apex 171 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.
Apex 199 Weaknesses in this category are related to improper handling of sensitive information.
Apex 227 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
Apex 242 The product calls a function that can never be guaranteed to work safely.
Apex 254 Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Apex 255 Weaknesses in this category are related to the management of credentials.
Apex 259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Apex 264 Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Apex 265 Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
Apex 269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Apex 274 The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation, leading to resultant weaknesses.
Apex 284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Apex 287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Apex 310 Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Apex 311 The product does not encrypt sensitive or critical information before storage or transmission.
Apex 319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Apex 320 Weaknesses in this category are related to errors in the management of cryptographic keys.
Apex 321 The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Apex 330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
Apex 344 The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
Apex 345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
Apex 352 The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
Apex 361 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."
Apex 388 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
Apex 389 This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.
Apex 442 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Apex 601 A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
Apex 610 The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Apex 629 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex 632 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
Apex 635 CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.
Apex 657 The product violates well-established principles for secure design.
Apex 664 The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
Apex 671 The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
Apex 693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Apex 699 This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
Apex 700 This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.
Apex 703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
Apex 707 The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
Apex 710 The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
Apex 711 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex 712 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.
Apex 713 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.
Apex 716 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.
Apex 718 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.
Apex 719 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.
Apex 720 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.
Apex 722 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.
Apex 723 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.
Apex 724 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.
Apex 725 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.
Apex 727 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.
Apex 728 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.
Apex 729 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.
Apex 734 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.
Apex 738 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).
Apex 742 Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).
Apex 746 Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).
Apex 747 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).
Apex 748 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).
Apex 750 CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
Apex 751 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.
Apex 753 Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.
Apex 798 The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
Apex 800 CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
Apex 801 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.
Apex 803 Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.
Apex 808 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
Apex 809 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex 810 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.
Apex 811 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.
Apex 812 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.
Apex 814 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.
Apex 816 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.
Apex 818 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.
Apex 819 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.
Apex 844 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.
Apex 845 Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex 851 Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex 858 Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex 859 Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex 861 Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
Apex 864 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
Apex 866 Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
Apex 867 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
Apex 868 CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.
Apex 872 Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex 876 Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex 880 Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex 883 Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
Apex 884 This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.
Apex 887 This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).
Apex 888 CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).
Apex 889 This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).
Apex 892 This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).
Apex 893 This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).
Apex 895 This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).
Apex 896 This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).
Apex 898 This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).
Apex 899 This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).
Apex 900 CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
Apex 901 This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).
Apex 905 This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.
Apex 907 This category identifies Software Fault Patterns (SFPs) within the Other cluster.
Apex 917 The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Apex 928 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
Apex 929 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.
Apex 930 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.
Apex 931 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.
Apex 934 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.
Apex 935 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.
Apex 936 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.
Apex 938 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.
Apex 943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
Apex 944 This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.
Apex 947 This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.
Apex 949 This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).
Apex 950 This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).
Apex 961 This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).
Apex 963 This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).
Apex 975 This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.
Apex 978 This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.
Apex 980 This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).
Apex 984 This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.
Apex 990 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).
Apex 992 This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.
Apex 994 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).
Apex 1000 This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.
Apex 1001 This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).
Apex 1003 CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.
Apex 1005 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."
Apex 1006 Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.
Apex 1008 This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.
Apex 1010 Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
Apex 1011 Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
Apex 1012 Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.
Apex 1013 Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
Apex 1014 Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.
Apex 1015 Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
Apex 1019 Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
Apex 1020 Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.
Apex 1026 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.
Apex 1027 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.
Apex 1028 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.
Apex 1029 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.
Apex 1031 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.
Apex 1033 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.
Apex 1128 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.
Apex 1131 Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.
Apex 1133 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.
Apex 1134 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex 1141 Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex 1147 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex 1148 Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex 1152 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.
Apex 1154 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.
Apex 1163 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.
Apex 1169 Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.
Apex 1170 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.
Apex 1171 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.
Apex 1172 Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.
Apex 1178 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.
Apex 1179 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.
Apex 1194 This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
Apex 1200 CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.
Apex 1207 Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.
Apex 1213 Weaknesses in this category are related to a software system's random number generation.
Apex 1228 Weaknesses in this category are related to the use of built-in functions or external APIs.
Apex 1305 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.
Apex 1306 Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.
Apex 1308 Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.
Apex 1337 CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.
Apex 1340 This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.
Apex 1344 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.
Apex 1345 Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.
Apex 1346 Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.
Apex 1347 Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.
Apex 1348 Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.
Apex 1350 CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.
Apex 1353 Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.
Apex 1354 Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.
Apex 1358 CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1360 Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex 1361 Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex 1362 Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex 1363 Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
Apex 1368 Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1369 Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1370 Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1372 Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1373 Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1375 Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1382 Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1383 Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
Apex 1387 CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.
Apex 1396 Weaknesses in this category are related to access control.
Apex 1400 This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.
Apex 1402 Weaknesses in this category are related to encryption.
Apex 1405 Weaknesses in this category are related to improper check or handling of exceptional conditions.
Apex 1406 Weaknesses in this category are related to improper input validation.
Apex 1407 Weaknesses in this category are related to improper neutralization.
Apex 1409 Weaknesses in this category are related to injection.
Apex 1411 Weaknesses in this category are related to insufficient verification of data authenticity.
Apex 1412 Weaknesses in this category are related to poor coding practices.
Apex 1413 Weaknesses in this category are related to protection mechanism failure.
Apex 1414 Weaknesses in this category are related to randomness.
Apex 1416 Weaknesses in this category are related to resource lifecycle management.
Apex 1418 Weaknesses in this category are related to violation of secure design principles.
C# 2 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."
C# 4 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 5 Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
C# 10 This category has been deprecated. It added unnecessary depth and complexity to its associated views.
C# 11 Debugging messages help attackers learn about the system and plan a form of attack.
C# 16 Weaknesses in this category are typically introduced during the configuration of the software.
C# 17 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 18 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 19 Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
C# 20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
C# 21 This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).
C# 22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
C# 23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
C# 36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
C# 73 The product allows user input to control or influence paths or file names that are used in filesystem operations.
C# 74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
C# 77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
C# 78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
C# 79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
C# 80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
C# 82 The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
C# 83 The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
C# 85 The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
C# 86 The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
C# 87 The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
C# 88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
C# 89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
C# 90 The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
C# 91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
C# 94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
C# 95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
C# 116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
C# 117 The product does not neutralize or incorrectly neutralizes output that is written to logs.
C# 133 Weaknesses in this category are related to the creation and modification of strings.
C# 137 Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
C# 138 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
C# 140 The product does not neutralize or incorrectly neutralizes delimiters.
C# 141 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
C# 142 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
C# 143 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
C# 146 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
C# 149 Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
C# 150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
C# 157 The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
C# 171 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.
C# 183 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
C# 189 Weaknesses in this category are related to improper calculation or conversion of numbers.
C# 190 The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
C# 199 Weaknesses in this category are related to improper handling of sensitive information.
C# 200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
C# 201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
C# 209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
C# 210 The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
C# 211 The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
C# 215 The product inserts sensitive information into debugging code, which could expose this information if the debugging code is not disabled in production.
C# 221 The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
C# 223 The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
C# 226 The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
C# 227 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
C# 248 An exception is thrown from a function, but it is not caught.
C# 249 This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.
C# 252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
C# 254 Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
C# 255 Weaknesses in this category are related to the management of credentials.
C# 256 Storing a password in plaintext may result in a system compromise.
C# 257 The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
C# 258 Using an empty string as a password is insecure.
C# 259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
C# 260 The product stores a password in a configuration file that might be accessible to actors who do not know the password.
C# 264 Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
C# 265 Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
C# 275 Weaknesses in this category are related to improper assignment or handling of permissions.
C# 284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
C# 285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
C# 287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
C# 295 The product does not validate, or incorrectly validates, a certificate.
C# 296 The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
C# 299 The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a certificate that has been compromised.
C# 300 The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
C# 304 The product implements an authentication technique, but it skips a step that weakens the technique.
C# 306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
C# 310 Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
C# 311 The product does not encrypt sensitive or critical information before storage or transmission.
C# 312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
C# 313 The product stores sensitive information in cleartext in a file, or on disk.
C# 314 The product stores sensitive information in cleartext in the registry.
C# 315 The product stores sensitive information in cleartext in a cookie.
C# 317 The product stores sensitive information in cleartext within the GUI.
C# 318 The product stores sensitive information in cleartext in an executable.
C# 319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
C# 320 Weaknesses in this category are related to errors in the management of cryptographic keys.
C# 321 The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
C# 326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
C# 327 The product uses a broken or risky cryptographic algorithm or protocol.
C# 328 The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
C# 330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
C# 338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
C# 344 The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
C# 345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
C# 346 The product does not properly verify that the source of data or communication is valid.
C# 352 The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
C# 353 The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
C# 355 Weaknesses in this category are related to or introduced in the User Interface (UI).
C# 359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
C# 361 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."
C# 362 The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
C# 366 If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
C# 369 The product divides a value by zero.
C# 371 Weaknesses in this category are related to improper management of system state.
C# 376 This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219).
C# 377 Creating and using insecure temporary files can leave application and system data vulnerable to attack.
C# 379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
C# 380 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 381 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 384 Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
C# 388 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
C# 389 This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.
C# 390 The product detects a specific error, but takes no actions to handle the error.
C# 398 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."
C# 399 Weaknesses in this category are related to improper management of system resources.
C# 400 The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
C# 402 The product makes resources available to untrusted parties when those resources are only intended to be accessed by the product.
C# 403 A process does not close sensitive file descriptors before invoking a child process, which allows the child to perform unauthorized I/O operations using those descriptors.
C# 404 The product does not release or incorrectly releases a resource before it is made available for re-use.
C# 405 The product does not properly control situations in which an adversary can cause the product to consume or produce excessive resources without requiring the adversary to invest equivalent work or otherwise prove authorization, i.e., the adversary's influence is "asymmetric."
C# 409 The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
C# 411 Weaknesses in this category are related to improper handling of locks that are used to control access to resources.
C# 417 Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.
C# 427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
C# 435 An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
C# 436 Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
C# 438 Weaknesses in this category are related to unexpected behaviors from code that an application uses.
C# 442 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 452 Weaknesses in this category occur in behaviors that are used for initialization and breakdown.
C# 459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
C# 461 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 463 The accidental deletion of a data-structure sentinel can cause serious programming logic problems.
C# 465 Weaknesses in this category are related to improper handling of pointers.
C# 470 The product uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
C# 476 A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
C# 480 The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
C# 483 The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
C# 485 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."
C# 489 The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
C# 497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
C# 502 The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
C# 505 This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.
C# 519 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 521 The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
C# 522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
C# 523 Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
C# 526 The product uses an environment variable to store unencrypted sensitive information.
C# 532 Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
C# 536 A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.
C# 538 The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
C# 539 The web application uses persistent cookies, but the cookies contain sensitive information.
C# 540 Source code on a web server or repository often contains sensitive information and should generally not be accessible to users.
C# 543 The product uses the singleton pattern when creating a resource within a multithreaded environment.
C# 550 Certain conditions, such as network failure, will cause a server error message to be displayed.
C# 552 The product makes files or directories accessible to unauthorized actors, even though they should not be.
C# 557 Weaknesses in this category are related to concurrent use of shared resources.
C# 558 The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
C# 559 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C# 561 The product contains dead code, which can never be executed.
C# 563 The variable's value is assigned but never used, making it a dead store.
C# 566 The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
C# 567 The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
C# 569 Weaknesses in this category are related to incorrectly written expressions within code.
C# 570 The product contains an expression that will always evaluate to false.
C# 573 The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
C# 595 The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
C# 601 A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
C# 610 The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
C# 611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
C# 614 The Secure attribute for sensitive cookies in HTTPS sessions is not set, which could cause the user agent to send those cookies in plaintext over an HTTP session.
C# 615 While adding general comments is very useful, some programmers tend to leave important data, such as: filenames related to the web application, old links or links which were not meant to be browsed by users, old code fragments, etc.
C# 624 The product uses a regular expression that either (1) contains an executable component with user-controlled inputs, or (2) allows a user to enable execution by inserting pattern modifiers.
C# 628 The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.
C# 629 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C# 632 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C# 633 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C# 634 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C# 635 CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.
C# 639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
C# 642 The product stores security-critical state information about its users, or the product itself, in a location that is accessible to unauthorized actors.
C# 643 The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
C# 644 The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
C# 657 The product violates well-established principles for secure design.
C# 662 The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
C# 663 The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
C# 664 The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
C# 667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
C# 668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
C# 669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
C# 670 The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
C# 671 The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
C# 674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
C# 682 The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
C# 683 The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
C# 691 The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
C# 692 The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is incomplete, allowing XSS variants to succeed.
C# 693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
C# 697 The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
C# 699 This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
C# 700 This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.
C# 703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
C# 705 The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
C# 706 The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
C# 707 The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
C# 710 The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
C# 711 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C# 712 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2007.
C# 713 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.
C# 714 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.
C# 715 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.
C# 716 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2007.
C# 717 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.
C# 718 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.
C# 719 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.
C# 720 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.
C# 721 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.
C# 722 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.
C# 723 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.
C# 724 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.
C# 725 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.
C# 727 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.
C# 728 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.
C# 729 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.
C# 730 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.
C# 731 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.
C# 732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
C# 734 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.
C# 736 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).
C# 737 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).
C# 738 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).
C# 739 Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).
C# 741 Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).
C# 742 Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).
C# 743 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).
C# 744 Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).
C# 745 Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).
C# 746 Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).
C# 747 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).
C# 748 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).
C# 749 The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
C# 750 CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
C# 751 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.
C# 752 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.
C# 753 Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.
C# 754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
C# 755 The product does not handle or incorrectly handles an exceptional condition.
C# 759 The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
C# 760 The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
C# 776 The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
C# 778 When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
C# 780 The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which might weaken the encryption.
C# 783 The product uses an expression in which operator precedence causes incorrect logic to be used.
C# 798 The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
C# 800 CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
C# 801 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.
C# 802 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.
C# 803 Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.
C# 808 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
C# 809 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C# 810 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.
C# 811 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2010.
C# 812 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.
C# 813 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.
C# 814 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2010.
C# 815 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.
C# 816 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.
C# 817 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.
C# 818 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.
C# 819 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2010.
C# 820 The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
C# 827 The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This might allow attackers to reference arbitrary DTDs, possibly causing the product to expose files, consume excessive system resources, or execute arbitrary http requests on behalf of the attacker.
C# 829 The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
C# 833 The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
C# 834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
C# 835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
C# 840 Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
C# 844 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.
C# 845 Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 847 Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 848 Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 850 Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 851 Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 852 Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 853 Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 854 Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 855 Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 857 Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 858 Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 859 Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 860 Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 861 Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C# 862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
C# 863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
C# 864 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C# 865 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C# 866 Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C# 867 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
C# 868 CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.
C# 871 Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 872 Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 873 Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 875 Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 876 Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 877 Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 878 Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 879 Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 880 Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 881 Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 882 Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 883 Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C# 884 This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.
C# 885 This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).
C# 886 This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).
C# 887 This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).
C# 888 CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).
C# 889 This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).
C# 890 This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).
C# 892 This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).
C# 893 This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).
C# 894 This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).
C# 895 This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).
C# 896 This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).
C# 897 This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).
C# 898 This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).
C# 899 This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).
C# 900 CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C# 902 This category identifies Software Fault Patterns (SFPs) within the Channel cluster.
C# 903 This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.
C# 905 This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.
C# 906 This category identifies Software Fault Patterns (SFPs) within the UI cluster.
C# 907 This category identifies Software Fault Patterns (SFPs) within the Other cluster.
C# 913 The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
C# 915 The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated in an object, but it does not properly control which attributes can be modified.
C# 916 The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
C# 922 The product stores sensitive information without properly limiting read or write access by unauthorized actors.
C# 923 The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
C# 928 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C# 929 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.
C# 930 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.
C# 931 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2013.
C# 932 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.
C# 933 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.
C# 934 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.
C# 935 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.
C# 936 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2013.
C# 938 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2013.
C# 942 The product uses a cross-domain policy file that includes domains that should not be trusted.
C# 943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
C# 944 This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.
C# 945 This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).
C# 946 This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.
C# 947 This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.
C# 948 This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster.
C# 949 This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).
C# 950 This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).
C# 951 This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster.
C# 952 This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster.
C# 956 This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.
C# 957 This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.
C# 958 This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.
C# 959 This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.
C# 961 This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).
C# 962 This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).
C# 963 This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).
C# 964 This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster.
C# 966 This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.
C# 971 This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).
C# 975 This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.
C# 977 This category identifies Software Fault Patterns (SFPs) within the Design cluster.
C# 978 This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.
C# 980 This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).
C# 981 This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).
C# 982 This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).
C# 984 This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.
C# 985 This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).
C# 986 This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).
C# 988 This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).
C# 990 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).
C# 991 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).
C# 992 This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.
C# 994 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).
C# 997 This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.
C# 998 This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).
C# 1000 This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.
C# 1001 This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).
C# 1002 This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.
C# 1003 CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.
C# 1004 The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
C# 1005 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."
C# 1006 Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.
C# 1008 This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.
C# 1009 Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.
C# 1010 Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
C# 1011 Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
C# 1012 Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.
C# 1013 Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
C# 1014 Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.
C# 1015 Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
C# 1016 Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.
C# 1018 Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture.
C# 1019 Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
C# 1020 Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.
C# 1025 The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
C# 1026 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.
C# 1027 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.
C# 1028 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.
C# 1029 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.
C# 1030 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2017.
C# 1031 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.
C# 1032 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.
C# 1033 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2017.
C# 1034 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2017.
C# 1036 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2017.
C# 1041 The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
C# 1078 The source code does not follow desired style or formatting for indentation, white space, comments, etc.
C# 1114 The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.
C# 1128 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.
C# 1129 Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.
C# 1130 Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.
C# 1131 Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.
C# 1133 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.
C# 1134 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1136 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1137 Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1140 Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1141 Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1142 Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1143 Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1145 Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1147 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1148 Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1149 Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1150 Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1152 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.
C# 1154 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.
C# 1157 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.
C# 1158 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.
C# 1159 Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.
C# 1162 Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.
C# 1163 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.
C# 1164 The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.
C# 1165 Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.
C# 1166 Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.
C# 1167 Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.
C# 1169 Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.
C# 1170 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.
C# 1171 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.
C# 1172 Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.
C# 1178 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.
C# 1179 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.
C# 1180 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.
C# 1181 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.
C# 1182 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.
C# 1186 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.
C# 1194 This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
C# 1200 CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.
C# 1202 Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).
C# 1204 The product uses a cryptographic primitive that uses an Initialization Vector (IV), but the product does not generate IVs that are sufficiently unpredictable or unique according to the expected cryptographic requirements for that primitive.
C# 1207 Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.
C# 1210 Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.
C# 1211 Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.
C# 1212 Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.
C# 1213 Weaknesses in this category are related to a software system's random number generation.
C# 1214 Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.
C# 1215 Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.
C# 1219 Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.
C# 1228 Weaknesses in this category are related to the use of built-in functions or external APIs.
C# 1305 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.
C# 1306 Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.
C# 1307 Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.
C# 1308 Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.
C# 1309 Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.
C# 1337 CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.
C# 1340 This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.
C# 1344 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.
C# 1345 Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.
C# 1346 Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.
C# 1347 Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.
C# 1348 Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.
C# 1349 Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.
C# 1350 CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.
C# 1353 Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.
C# 1354 Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.
C# 1355 Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.
C# 1358 CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1359 Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C# 1360 Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C# 1361 Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C# 1362 Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C# 1363 Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C# 1364 Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1366 Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1368 Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1369 Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1370 Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1371 Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1372 Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1375 Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1376 Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1382 Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1383 Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C# 1387 CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.
C# 1396 Weaknesses in this category are related to access control.
C# 1397 Weaknesses in this category are related to comparison.
C# 1398 Weaknesses in this category are related to component interaction.
C# 1400 This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.
C# 1401 Weaknesses in this category are related to concurrency.
C# 1402 Weaknesses in this category are related to encryption.
C# 1403 Weaknesses in this category are related to exposed resource.
C# 1404 Weaknesses in this category are related to file handling.
C# 1405 Weaknesses in this category are related to improper check or handling of exceptional conditions.
C# 1406 Weaknesses in this category are related to improper input validation.
C# 1407 Weaknesses in this category are related to improper neutralization.
C# 1408 Weaknesses in this category are related to incorrect calculation.
C# 1409 Weaknesses in this category are related to injection.
C# 1410 Weaknesses in this category are related to insufficient control flow management.
C# 1411 Weaknesses in this category are related to insufficient verification of data authenticity.
C# 1412 Weaknesses in this category are related to poor coding practices.
C# 1413 Weaknesses in this category are related to protection mechanism failure.
C# 1414 Weaknesses in this category are related to randomness.
C# 1415 Weaknesses in this category are related to resource control.
C# 1416 Weaknesses in this category are related to resource lifecycle management.
C# 1417 Weaknesses in this category are related to sensitive information exposure.
C# 1418 Weaknesses in this category are related to violation of secure design principles.
C/C++ 2 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."
C/C++ 4 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 5 Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
C/C++ 14 Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."
C/C++ 16 Weaknesses in this category are typically introduced during the configuration of the software.
C/C++ 17 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 18 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 19 Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
C/C++ 20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
C/C++ 21 This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).
C/C++ 22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
C/C++ 23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
C/C++ 36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
C/C++ 59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
C/C++ 66 The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.
C/C++ 67 The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
C/C++ 68 This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships.
C/C++ 74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
C/C++ 77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
C/C++ 78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
C/C++ 88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
C/C++ 89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
C/C++ 91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
C/C++ 93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
C/C++ 94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
C/C++ 99 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
C/C++ 113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
C/C++ 116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
C/C++ 117 The product does not neutralize or incorrectly neutralizes output that is written to logs.
C/C++ 118 The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
C/C++ 119 The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
C/C++ 120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
C/C++ 121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
C/C++ 122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
C/C++ 123 Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
C/C++ 124 The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
C/C++ 125 The product reads data past the end, or before the beginning, of the intended buffer.
C/C++ 126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
C/C++ 127 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
C/C++ 128 Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.
C/C++ 129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
C/C++ 130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
C/C++ 131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
C/C++ 133 Weaknesses in this category are related to the creation and modification of strings.
C/C++ 134 The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
C/C++ 135 The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
C/C++ 136 Weaknesses in this category are caused by improper data type transformation or improper handling of multiple data types.
C/C++ 137 Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
C/C++ 138 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
C/C++ 140 The product does not neutralize or incorrectly neutralizes delimiters.
C/C++ 141 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
C/C++ 142 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
C/C++ 143 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
C/C++ 146 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
C/C++ 149 Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
C/C++ 150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
C/C++ 157 The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
C/C++ 169 This category has been deprecated. It was originally intended as a "catch-all" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy.
C/C++ 170 The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
C/C++ 171 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.
C/C++ 187 The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
C/C++ 188 The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
C/C++ 189 Weaknesses in this category are related to improper calculation or conversion of numbers.
C/C++ 190 The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
C/C++ 191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
C/C++ 192 Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
C/C++ 193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
C/C++ 194 The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
C/C++ 195 The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
C/C++ 197 Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
C/C++ 198 The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.
C/C++ 199 Weaknesses in this category are related to improper handling of sensitive information.
C/C++ 200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
C/C++ 201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
C/C++ 209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
C/C++ 210 The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
C/C++ 211 The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
C/C++ 216 This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since the "container" term is widely understood by developers in different ways than originally intended by PLOVER, the original source for this entry.
C/C++ 221 The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
C/C++ 226 The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
C/C++ 227 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
C/C++ 228 The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
C/C++ 237 The product does not handle or incorrectly handles inputs that are related to complex structures.
C/C++ 240 The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
C/C++ 241 The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
C/C++ 242 The product calls a function that can never be guaranteed to work safely.
C/C++ 243 The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
C/C++ 244 Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
C/C++ 247 This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.
C/C++ 248 An exception is thrown from a function, but it is not caught.
C/C++ 249 This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.
C/C++ 252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
C/C++ 253 The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
C/C++ 254 Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
C/C++ 255 Weaknesses in this category are related to the management of credentials.
C/C++ 256 Storing a password in plaintext may result in a system compromise.
C/C++ 257 The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
C/C++ 259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
C/C++ 264 Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
C/C++ 265 Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
C/C++ 269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
C/C++ 271 The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
C/C++ 272 The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
C/C++ 273 The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
C/C++ 275 Weaknesses in this category are related to improper assignment or handling of permissions.
C/C++ 276 During installation, installed file permissions are set to allow anyone to modify those files.
C/C++ 282 The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
C/C++ 284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
C/C++ 285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
C/C++ 287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
C/C++ 290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
C/C++ 291 The product uses an IP address for authentication.
C/C++ 293 The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
C/C++ 300 The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
C/C++ 310 Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
C/C++ 311 The product does not encrypt sensitive or critical information before storage or transmission.
C/C++ 312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
C/C++ 313 The product stores sensitive information in cleartext in a file, or on disk.
C/C++ 314 The product stores sensitive information in cleartext in the registry.
C/C++ 315 The product stores sensitive information in cleartext in a cookie.
C/C++ 317 The product stores sensitive information in cleartext within the GUI.
C/C++ 318 The product stores sensitive information in cleartext in an executable.
C/C++ 319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
C/C++ 320 Weaknesses in this category are related to errors in the management of cryptographic keys.
C/C++ 321 The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
C/C++ 326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
C/C++ 327 The product uses a broken or risky cryptographic algorithm or protocol.
C/C++ 328 The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
C/C++ 330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
C/C++ 335 The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
C/C++ 336 A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
C/C++ 337 A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
C/C++ 338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
C/C++ 344 The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
C/C++ 345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
C/C++ 350 The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
C/C++ 353 The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
C/C++ 355 Weaknesses in this category are related to or introduced in the User Interface (UI).
C/C++ 359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
C/C++ 361 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."
C/C++ 362 The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
C/C++ 363 The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
C/C++ 364 The product uses a signal handler that introduces a race condition.
C/C++ 366 If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
C/C++ 367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
C/C++ 369 The product divides a value by zero.
C/C++ 376 This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219).
C/C++ 377 Creating and using insecure temporary files can leave application and system data vulnerable to attack.
C/C++ 379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
C/C++ 380 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 381 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 387 Weaknesses in this category are related to the improper handling of signals.
C/C++ 388 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
C/C++ 389 This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.
C/C++ 391 [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
C/C++ 393 A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.
C/C++ 394 The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
C/C++ 396 Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
C/C++ 397 Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
C/C++ 398 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."
C/C++ 399 Weaknesses in this category are related to improper management of system resources.
C/C++ 400 The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
C/C++ 401 The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
C/C++ 404 The product does not release or incorrectly releases a resource before it is made available for re-use.
C/C++ 411 Weaknesses in this category are related to improper handling of locks that are used to control access to resources.
C/C++ 415 The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
C/C++ 416 Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
C/C++ 417 Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.
C/C++ 427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
C/C++ 429 Weaknesses in this category are related to improper management of handlers.
C/C++ 435 An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
C/C++ 438 Weaknesses in this category are related to unexpected behaviors from code that an application uses.
C/C++ 441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
C/C++ 442 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 452 Weaknesses in this category occur in behaviors that are used for initialization and breakdown.
C/C++ 456 The product does not initialize critical variables, which causes the execution environment to use unexpected values.
C/C++ 457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
C/C++ 459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
C/C++ 460 The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
C/C++ 461 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 464 The accidental addition of a data-structure sentinel can cause serious programming logic problems.
C/C++ 465 Weaknesses in this category are related to improper handling of pointers.
C/C++ 467 The code calls sizeof() on a malloced pointer type, which always returns the wordsize/8. This can produce an unexpected result if the programmer intended to determine how much memory has been allocated.
C/C++ 468 In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
C/C++ 469 The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
C/C++ 471 The product does not properly protect an assumed-immutable element from being modified by an attacker.
C/C++ 475 The behavior of this function is undefined unless its control parameter is set to a specific value.
C/C++ 476 A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
C/C++ 477 The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
C/C++ 478 The code does not have a default case in an expression with multiple conditions, such as a switch statement.
C/C++ 479 The product defines a signal handler that calls a non-reentrant function.
C/C++ 480 The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
C/C++ 481 The code uses an operator for assignment when the intention was to perform a comparison.
C/C++ 482 The code uses an operator for comparison when the intention was to perform an assignment.
C/C++ 483 The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
C/C++ 484 The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
C/C++ 485 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."
C/C++ 489 The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
C/C++ 490 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 493 The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
C/C++ 497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
C/C++ 500 An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
C/C++ 505 This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
C/C++ 523 Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
C/C++ 526 The product uses an environment variable to store unencrypted sensitive information.
C/C++ 528 The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
C/C++ 532 Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
C/C++ 535 A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.
C/C++ 536 A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.
C/C++ 538 The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
C/C++ 539 The web application uses persistent cookies, but the cookies contain sensitive information.
C/C++ 543 The product uses the singleton pattern when creating a resource within a multithreaded environment.
C/C++ 547 The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
C/C++ 550 Certain conditions, such as network failure, will cause a server error message to be displayed.
C/C++ 552 The product makes files or directories accessible to unauthorized actors, even though they should not be.
C/C++ 557 Weaknesses in this category are related to concurrent use of shared resources.
C/C++ 558 The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
C/C++ 559 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
C/C++ 561 The product contains dead code, which can never be executed.
C/C++ 562 A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
C/C++ 563 The variable's value is assigned but never used, making it a dead store.
C/C++ 566 The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
C/C++ 567 The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
C/C++ 569 Weaknesses in this category are related to incorrectly written expressions within code.
C/C++ 570 The product contains an expression that will always evaluate to false.
C/C++ 571 The product contains an expression that will always evaluate to true.
C/C++ 573 The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
C/C++ 590 The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
C/C++ 592 This weakness has been deprecated because it covered redundant concepts already described in CWE-287.
C/C++ 595 The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
C/C++ 597 The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
C/C++ 606 The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
C/C++ 610 The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
C/C++ 617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
C/C++ 628 The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.
C/C++ 629 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C/C++ 632 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C/C++ 633 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C/C++ 634 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
C/C++ 635 CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.
C/C++ 637 The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.
C/C++ 639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
C/C++ 643 The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
C/C++ 644 The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
C/C++ 655 The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
C/C++ 657 The product violates well-established principles for secure design.
C/C++ 662 The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
C/C++ 663 The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
C/C++ 664 The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
C/C++ 665 The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
C/C++ 666 The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
C/C++ 667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
C/C++ 668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
C/C++ 669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
C/C++ 670 The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
C/C++ 671 The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
C/C++ 672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
C/C++ 674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
C/C++ 675 The product performs the same operation on a resource two or more times, when the operation should only be applied once.
C/C++ 676 The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
C/C++ 680 The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
C/C++ 681 When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
C/C++ 682 The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
C/C++ 683 The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
C/C++ 684 The code does not function according to its published specifications, potentially leading to incorrect usage.
C/C++ 685 The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
C/C++ 686 The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.
C/C++ 687 The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.
C/C++ 691 The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
C/C++ 693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
C/C++ 694 The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
C/C++ 696 The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.
C/C++ 697 The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
C/C++ 699 This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
C/C++ 700 This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.
C/C++ 703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
C/C++ 704 The product does not correctly convert an object, resource, or structure from one type to a different type.
C/C++ 705 The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
C/C++ 706 The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
C/C++ 707 The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
C/C++ 710 The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
C/C++ 711 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C/C++ 713 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.
C/C++ 714 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.
C/C++ 715 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.
C/C++ 717 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.
C/C++ 718 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.
C/C++ 719 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.
C/C++ 720 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.
C/C++ 721 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.
C/C++ 722 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.
C/C++ 723 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.
C/C++ 724 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.
C/C++ 725 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.
C/C++ 726 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2004.
C/C++ 727 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.
C/C++ 728 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.
C/C++ 729 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.
C/C++ 730 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.
C/C++ 731 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.
C/C++ 732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
C/C++ 733 The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.
C/C++ 734 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.
C/C++ 735 Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 736 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 737 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 738 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 739 Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 740 Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 741 Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 742 Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 743 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 744 Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 745 Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 746 Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 747 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).
C/C++ 748 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).
C/C++ 750 CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
C/C++ 751 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.
C/C++ 752 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.
C/C++ 753 Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.
C/C++ 754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
C/C++ 755 The product does not handle or incorrectly handles an exceptional condition.
C/C++ 758 The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
C/C++ 759 The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
C/C++ 760 The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
C/C++ 762 The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
C/C++ 763 The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
C/C++ 764 The product locks a critical resource more times than intended, leading to an unexpected state in the system.
C/C++ 765 The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.
C/C++ 769 This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774.
C/C++ 770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
C/C++ 771 The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.
C/C++ 772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
C/C++ 775 The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.
C/C++ 783 The product uses an expression in which operator precedence causes incorrect logic to be used.
C/C++ 786 The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
C/C++ 787 The product writes data past the end, or before the beginning, of the intended buffer.
C/C++ 788 The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
C/C++ 789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
C/C++ 798 The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
C/C++ 800 CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
C/C++ 801 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.
C/C++ 802 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.
C/C++ 803 Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.
C/C++ 805 The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
C/C++ 806 The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.
C/C++ 807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
C/C++ 808 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
C/C++ 809 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C/C++ 810 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.
C/C++ 812 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.
C/C++ 813 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.
C/C++ 815 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.
C/C++ 816 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.
C/C++ 817 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.
C/C++ 818 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.
C/C++ 820 The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
C/C++ 823 The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
C/C++ 824 The product accesses or uses a pointer that has not been initialized.
C/C++ 825 The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
C/C++ 828 The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.
C/C++ 833 The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
C/C++ 834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
C/C++ 835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
C/C++ 839 The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
C/C++ 840 Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
C/C++ 843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
C/C++ 844 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.
C/C++ 845 Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 846 Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 847 Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 848 Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 849 Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 850 Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 851 Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 852 Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 853 Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 854 Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 857 Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 858 Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 859 Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 860 Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 861 Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
C/C++ 862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
C/C++ 864 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C/C++ 865 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C/C++ 866 Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C/C++ 867 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
C/C++ 868 CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.
C/C++ 871 Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 872 Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 873 Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 874 Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 875 Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 876 Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 877 Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 878 Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 879 Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 880 Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 881 Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 882 Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 883 Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
C/C++ 884 This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.
C/C++ 885 This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).
C/C++ 886 This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).
C/C++ 887 This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).
C/C++ 888 CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).
C/C++ 889 This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).
C/C++ 890 This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).
C/C++ 891 This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38).
C/C++ 892 This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).
C/C++ 893 This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).
C/C++ 894 This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).
C/C++ 895 This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).
C/C++ 896 This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).
C/C++ 897 This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).
C/C++ 898 This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).
C/C++ 899 This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).
C/C++ 900 CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
C/C++ 901 This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).
C/C++ 902 This category identifies Software Fault Patterns (SFPs) within the Channel cluster.
C/C++ 903 This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.
C/C++ 905 This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.
C/C++ 906 This category identifies Software Fault Patterns (SFPs) within the UI cluster.
C/C++ 907 This category identifies Software Fault Patterns (SFPs) within the Other cluster.
C/C++ 908 The product uses or accesses a resource that has not been initialized.
C/C++ 909 The product does not initialize a critical resource.
C/C++ 910 The product uses or accesses a file descriptor after it has been closed.
C/C++ 913 The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
C/C++ 916 The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
C/C++ 918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
C/C++ 922 The product stores sensitive information without properly limiting read or write access by unauthorized actors.
C/C++ 923 The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
C/C++ 928 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
C/C++ 929 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.
C/C++ 930 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.
C/C++ 932 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.
C/C++ 933 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.
C/C++ 934 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.
C/C++ 935 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.
C/C++ 943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
C/C++ 944 This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.
C/C++ 945 This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).
C/C++ 946 This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.
C/C++ 947 This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.
C/C++ 949 This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).
C/C++ 950 This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).
C/C++ 956 This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.
C/C++ 957 This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.
C/C++ 958 This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.
C/C++ 959 This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.
C/C++ 960 This category identifies Software Fault Patterns (SFPs) within the Ambiguous Exception Type cluster (SFP5).
C/C++ 961 This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).
C/C++ 962 This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).
C/C++ 963 This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).
C/C++ 964 This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster.
C/C++ 966 This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.
C/C++ 969 This category identifies Software Fault Patterns (SFPs) within the Faulty Memory Release cluster (SFP12).
C/C++ 970 This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8).
C/C++ 971 This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).
C/C++ 973 This category identifies Software Fault Patterns (SFPs) within the Improper NULL Termination cluster (SFP11).
C/C++ 974 This category identifies Software Fault Patterns (SFPs) within the Incorrect Buffer Length Computation cluster (SFP10).
C/C++ 975 This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.
C/C++ 976 This category identifies Software Fault Patterns (SFPs) within the Compiler cluster.
C/C++ 977 This category identifies Software Fault Patterns (SFPs) within the Design cluster.
C/C++ 978 This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.
C/C++ 979 This category identifies Software Fault Patterns (SFPs) within the Failed Chroot Jail cluster (SFP17).
C/C++ 980 This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).
C/C++ 981 This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).
C/C++ 982 This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).
C/C++ 983 This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).
C/C++ 984 This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.
C/C++ 985 This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).
C/C++ 986 This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).
C/C++ 987 This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21).
C/C++ 988 This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).
C/C++ 990 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).
C/C++ 991 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).
C/C++ 992 This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.
C/C++ 993 This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster.
C/C++ 994 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).
C/C++ 995 This category identifies Software Fault Patterns (SFPs) within the Feature cluster.
C/C++ 997 This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.
C/C++ 998 This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).
C/C++ 1000 This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.
C/C++ 1001 This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).
C/C++ 1002 This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.
C/C++ 1003 CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.
C/C++ 1005 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."
C/C++ 1006 Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.
C/C++ 1008 This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.
C/C++ 1009 Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.
C/C++ 1010 Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
C/C++ 1011 Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
C/C++ 1012 Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.
C/C++ 1013 Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
C/C++ 1014 Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.
C/C++ 1015 Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
C/C++ 1016 Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.
C/C++ 1019 Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
C/C++ 1020 Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.
C/C++ 1025 The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
C/C++ 1026 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.
C/C++ 1027 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.
C/C++ 1028 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.
C/C++ 1029 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.
C/C++ 1031 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.
C/C++ 1032 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.
C/C++ 1037 The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.
C/C++ 1041 The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
C/C++ 1045 A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.
C/C++ 1055 The product contains a class with inheritance from more than one concrete class.
C/C++ 1059 The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.
C/C++ 1061 The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.
C/C++ 1076 The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.
C/C++ 1077 The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.
C/C++ 1078 The source code does not follow desired style or formatting for indentation, white space, comments, etc.
C/C++ 1079 A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
C/C++ 1095 The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.
C/C++ 1108 The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.
C/C++ 1109 The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
C/C++ 1113 The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.
C/C++ 1114 The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.
C/C++ 1126 The source code declares a variable in one scope, but the variable is only used within a narrower scope.
C/C++ 1128 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.
C/C++ 1129 Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.
C/C++ 1130 Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.
C/C++ 1131 Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.
C/C++ 1133 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.
C/C++ 1134 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1135 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1136 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1137 Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1139 Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1140 Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1141 Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1142 Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1143 Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1147 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1148 Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1149 Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1150 Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1152 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.
C/C++ 1154 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.
C/C++ 1156 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT C Coding Standard.
C/C++ 1157 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.
C/C++ 1158 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.
C/C++ 1159 Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.
C/C++ 1160 Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard.
C/C++ 1161 Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.
C/C++ 1162 Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.
C/C++ 1163 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.
C/C++ 1164 The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.
C/C++ 1165 Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.
C/C++ 1166 Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.
C/C++ 1167 Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.
C/C++ 1168 Weaknesses in this category are related to the rules and recommendations in the Application Programming Interfaces (API) section of the SEI CERT C Coding Standard.
C/C++ 1169 Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.
C/C++ 1170 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.
C/C++ 1171 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.
C/C++ 1172 Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.
C/C++ 1177 The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.
C/C++ 1178 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.
C/C++ 1179 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.
C/C++ 1180 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.
C/C++ 1181 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.
C/C++ 1182 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.
C/C++ 1185 Weaknesses in this category are related to the rules and recommendations in the File Input and Output (FIO) section of the SEI CERT Perl Coding Standard.
C/C++ 1186 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.
C/C++ 1194 This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
C/C++ 1195 Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain.
C/C++ 1198 Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.
C/C++ 1200 CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.
C/C++ 1202 Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).
C/C++ 1205 Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs).
C/C++ 1207 Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.
C/C++ 1208 Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.
C/C++ 1210 Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.
C/C++ 1211 Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.
C/C++ 1212 Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.
C/C++ 1213 Weaknesses in this category are related to a software system's random number generation.
C/C++ 1214 Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.
C/C++ 1215 Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.
C/C++ 1218 Weaknesses in this category are related to the handling of memory buffers within a software system.
C/C++ 1219 Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.
C/C++ 1226 Weaknesses in this category are associated with things being overly complex.
C/C++ 1228 Weaknesses in this category are related to the use of built-in functions or external APIs.
C/C++ 1237 This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37).
C/C++ 1238 This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38).
C/C++ 1241 The device uses an algorithm that is predictable and generates a pseudo-random number.
C/C++ 1305 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.
C/C++ 1306 Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.
C/C++ 1307 Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.
C/C++ 1308 Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.
C/C++ 1309 Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.
C/C++ 1337 CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.
C/C++ 1340 This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.
C/C++ 1341 The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
C/C++ 1344 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.
C/C++ 1345 Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.
C/C++ 1346 Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.
C/C++ 1347 Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.
C/C++ 1348 Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.
C/C++ 1349 Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.
C/C++ 1350 CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.
C/C++ 1353 Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.
C/C++ 1354 Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.
C/C++ 1355 Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.
C/C++ 1356 Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.
C/C++ 1358 CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1359 Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C/C++ 1360 Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C/C++ 1361 Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C/C++ 1362 Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C/C++ 1363 Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
C/C++ 1364 Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1366 Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1368 Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1369 Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1370 Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1371 Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1372 Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1373 Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1375 Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1376 Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1379 Weaknesses in this category are related to the "Human factors in ICS environments" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Environmental factors in ICS including physical duress, system complexities, and isolation may result in security gaps or inadequacies in the performance of individual duties and responsibilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1382 Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1383 Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
C/C++ 1387 CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.
C/C++ 1396 Weaknesses in this category are related to access control.
C/C++ 1397 Weaknesses in this category are related to comparison.
C/C++ 1398 Weaknesses in this category are related to component interaction.
C/C++ 1399 Weaknesses in this category are related to memory safety.
C/C++ 1400 This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.
C/C++ 1401 Weaknesses in this category are related to concurrency.
C/C++ 1402 Weaknesses in this category are related to encryption.
C/C++ 1403 Weaknesses in this category are related to exposed resource.
C/C++ 1404 Weaknesses in this category are related to file handling.
C/C++ 1405 Weaknesses in this category are related to improper check or handling of exceptional conditions.
C/C++ 1406 Weaknesses in this category are related to improper input validation.
C/C++ 1407 Weaknesses in this category are related to improper neutralization.
C/C++ 1408 Weaknesses in this category are related to incorrect calculation.
C/C++ 1409 Weaknesses in this category are related to injection.
C/C++ 1410 Weaknesses in this category are related to insufficient control flow management.
C/C++ 1411 Weaknesses in this category are related to insufficient verification of data authenticity.
C/C++ 1412 Weaknesses in this category are related to poor coding practices.
C/C++ 1413 Weaknesses in this category are related to protection mechanism failure.
C/C++ 1414 Weaknesses in this category are related to randomness.
C/C++ 1415 Weaknesses in this category are related to resource control.
C/C++ 1416 Weaknesses in this category are related to resource lifecycle management.
C/C++ 1417 Weaknesses in this category are related to sensitive information exposure.
C/C++ 1418 Weaknesses in this category are related to violation of secure design principles.
CUDA 2 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."
CUDA 4 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 5 Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
CUDA 14 Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when it is not read from again, aka "dead store removal."
CUDA 16 Weaknesses in this category are typically introduced during the configuration of the software.
CUDA 17 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 18 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 19 Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
CUDA 20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CUDA 21 This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).
CUDA 22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CUDA 23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CUDA 36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
CUDA 59 The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CUDA 66 The product does not handle or incorrectly handles a file name that identifies a "virtual" resource that is not directly specified within the directory that is associated with the file name, causing the product to perform file-based operations on a resource that is not a file.
CUDA 67 The product constructs pathnames from user input, but it does not handle or incorrectly handles a pathname containing a Windows device name such as AUX or CON. This typically leads to denial of service or an information exposure when the application attempts to process the pathname as a regular file.
CUDA 68 This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships.
CUDA 74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CUDA 77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CUDA 78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CUDA 88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CUDA 89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CUDA 91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CUDA 93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CUDA 94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CUDA 99 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
CUDA 113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
CUDA 116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CUDA 117 The product does not neutralize or incorrectly neutralizes output that is written to logs.
CUDA 118 The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
CUDA 119 The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CUDA 120 The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CUDA 121 A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CUDA 122 A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CUDA 123 Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
CUDA 124 The product writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
CUDA 125 The product reads data past the end, or before the beginning, of the intended buffer.
CUDA 126 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CUDA 127 The product reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
CUDA 128 Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.
CUDA 129 The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CUDA 130 The product parses a formatted message or structure, but it does not handle or incorrectly handles a length field that is inconsistent with the actual length of the associated data.
CUDA 131 The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CUDA 133 Weaknesses in this category are related to the creation and modification of strings.
CUDA 134 The product uses a function that accepts a format string as an argument, but the format string originates from an external source.
CUDA 135 The product does not correctly calculate the length of strings that can contain wide or multi-byte characters.
CUDA 136 Weaknesses in this category are caused by improper data type transformation or improper handling of multiple data types.
CUDA 137 Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
CUDA 138 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
CUDA 140 The product does not neutralize or incorrectly neutralizes delimiters.
CUDA 141 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
CUDA 142 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
CUDA 143 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
CUDA 146 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
CUDA 149 Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
CUDA 150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
CUDA 157 The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
CUDA 169 This category has been deprecated. It was originally intended as a "catch-all" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy.
CUDA 170 The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
CUDA 171 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.
CUDA 187 The product performs a comparison that only examines a portion of a factor before determining whether there is a match, such as a substring, leading to resultant weaknesses.
CUDA 188 The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in unintended program behavior.
CUDA 189 Weaknesses in this category are related to improper calculation or conversion of numbers.
CUDA 190 The product performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
CUDA 191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CUDA 192 Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
CUDA 193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CUDA 194 The product performs an operation on a number that causes it to be sign extended when it is transformed into a larger data type. When the original number is negative, this can produce unexpected values that lead to resultant weaknesses.
CUDA 195 The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected value if the value of the signed primitive can not be represented using an unsigned primitive.
CUDA 197 Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
CUDA 198 The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian and little-endian) when processing the input, causing an incorrect number or value to be used.
CUDA 199 Weaknesses in this category are related to improper handling of sensitive information.
CUDA 200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CUDA 201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
CUDA 209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
CUDA 210 The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
CUDA 211 The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
CUDA 216 This entry has been deprecated, as it was not effective as a weakness and was structured more like a category. In addition, the name is inappropriate, since the "container" term is widely understood by developers in different ways than originally intended by PLOVER, the original source for this entry.
CUDA 221 The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
CUDA 226 The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
CUDA 227 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
CUDA 228 The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the associated specification.
CUDA 237 The product does not handle or incorrectly handles inputs that are related to complex structures.
CUDA 240 The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
CUDA 241 The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it expects a digit (0-9) but is provided with a letter (A-Z).
CUDA 242 The product calls a function that can never be guaranteed to work safely.
CUDA 243 The product uses the chroot() system call to create a jail, but does not change the working directory afterward. This does not prevent access to files outside of the jail.
CUDA 244 Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to attack, because it is not removed from memory.
CUDA 247 This entry has been deprecated because it was a duplicate of CWE-350. All content has been transferred to CWE-350.
CUDA 248 An exception is thrown from a function, but it is not caught.
CUDA 249 This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.
CUDA 252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CUDA 253 The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
CUDA 254 Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
CUDA 255 Weaknesses in this category are related to the management of credentials.
CUDA 256 Storing a password in plaintext may result in a system compromise.
CUDA 257 The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
CUDA 259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CUDA 264 Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
CUDA 265 Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
CUDA 269 The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CUDA 271 The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
CUDA 272 The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the operation is performed.
CUDA 273 The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
CUDA 275 Weaknesses in this category are related to improper assignment or handling of permissions.
CUDA 276 During installation, installed file permissions are set to allow anyone to modify those files.
CUDA 282 The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
CUDA 284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CUDA 285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CUDA 287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CUDA 290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.
CUDA 291 The product uses an IP address for authentication.
CUDA 293 The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
CUDA 300 The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
CUDA 310 Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
CUDA 311 The product does not encrypt sensitive or critical information before storage or transmission.
CUDA 312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CUDA 313 The product stores sensitive information in cleartext in a file, or on disk.
CUDA 314 The product stores sensitive information in cleartext in the registry.
CUDA 315 The product stores sensitive information in cleartext in a cookie.
CUDA 317 The product stores sensitive information in cleartext within the GUI.
CUDA 318 The product stores sensitive information in cleartext in an executable.
CUDA 319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CUDA 320 Weaknesses in this category are related to errors in the management of cryptographic keys.
CUDA 321 The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
CUDA 326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CUDA 327 The product uses a broken or risky cryptographic algorithm or protocol.
CUDA 328 The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).
CUDA 330 The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CUDA 335 The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
CUDA 336 A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
CUDA 337 A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CUDA 338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CUDA 344 The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
CUDA 345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CUDA 350 The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
CUDA 353 The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data during transmission, such as a checksum.
CUDA 355 Weaknesses in this category are related to or introduced in the User Interface (UI).
CUDA 359 The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
CUDA 361 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."
CUDA 362 The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CUDA 363 The product checks the status of a file or directory before accessing it, which produces a race condition in which the file can be replaced with a link before the access is performed, causing the product to access the wrong file.
CUDA 364 The product uses a signal handler that introduces a race condition.
CUDA 366 If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used while invalid, in turn making the state of execution undefined.
CUDA 367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the product to perform invalid actions when the resource is in an unexpected state.
CUDA 369 The product divides a value by zero.
CUDA 376 This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219).
CUDA 377 Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CUDA 379 The product creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.
CUDA 380 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 381 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 387 Weaknesses in this category are related to the improper handling of signals.
CUDA 388 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."
CUDA 389 This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions.
CUDA 391 [PLANNED FOR DEPRECATION. SEE MAINTENANCE NOTES AND CONSIDER CWE-252, CWE-248, OR CWE-1069.] Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
CUDA 393 A function or operation returns an incorrect return value or status code that does not indicate an error, but causes the product to modify its behavior based on the incorrect result.
CUDA 394 The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.
CUDA 396 Catching overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
CUDA 397 Throwing overly broad exceptions promotes complex error handling code that is more likely to contain security vulnerabilities.
CUDA 398 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."
CUDA 399 Weaknesses in this category are related to improper management of system resources.
CUDA 400 The product does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CUDA 401 The product does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CUDA 404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CUDA 411 Weaknesses in this category are related to improper handling of locks that are used to control access to resources.
CUDA 415 The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CUDA 416 Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CUDA 417 Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in "bypass" attacks, such as those that exploit authentication errors.
CUDA 427 The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CUDA 429 Weaknesses in this category are related to improper management of handlers.
CUDA 435 An interaction error occurs when two entities have correct behavior when running independently of each other, but when they are integrated as components in a larger system or process, they introduce incorrect behaviors that may cause resultant weaknesses.
CUDA 438 Weaknesses in this category are related to unexpected behaviors from code that an application uses.
CUDA 441 The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
CUDA 442 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 452 Weaknesses in this category occur in behaviors that are used for initialization and breakdown.
CUDA 456 The product does not initialize critical variables, which causes the execution environment to use unexpected values.
CUDA 457 The code uses a variable that has not been initialized, leading to unpredictable or unintended results.
CUDA 459 The product does not properly "clean up" and remove temporary or supporting resources after they have been used.
CUDA 460 The product does not clean up its state or incorrectly cleans up its state when an exception is thrown, leading to unexpected state or control flow.
CUDA 461 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 464 The accidental addition of a data-structure sentinel can cause serious programming logic problems.
CUDA 465 Weaknesses in this category are related to improper handling of pointers.
CUDA 467 The code calls sizeof() on a malloced pointer type, which always returns the wordsize/8. This can produce an unexpected result if the programmer intended to determine how much memory has been allocated.
CUDA 468 In C and C++, one may often accidentally refer to the wrong memory due to the semantics of when math operations are implicitly scaled.
CUDA 469 The product subtracts one pointer from another in order to determine size, but this calculation can be incorrect if the pointers do not exist in the same memory chunk.
CUDA 471 The product does not properly protect an assumed-immutable element from being modified by an attacker.
CUDA 475 The behavior of this function is undefined unless its control parameter is set to a specific value.
CUDA 476 A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
CUDA 477 The code uses deprecated or obsolete functions, which suggests that the code has not been actively reviewed or maintained.
CUDA 478 The code does not have a default case in an expression with multiple conditions, such as a switch statement.
CUDA 479 The product defines a signal handler that calls a non-reentrant function.
CUDA 480 The product accidentally uses the wrong operator, which changes the logic in security-relevant ways.
CUDA 481 The code uses an operator for assignment when the intention was to perform a comparison.
CUDA 482 The code uses an operator for comparison when the intention was to perform an assignment.
CUDA 483 The code does not explicitly delimit a block that is intended to contain 2 or more statements, creating a logic error.
CUDA 484 The product omits a break statement within a switch or similar construct, causing code associated with multiple conditions to execute. This can cause problems when the programmer only intended to execute code associated with one condition.
CUDA 485 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."
CUDA 489 The product is deployed to unauthorized actors with debugging code still enabled or active, which can create unintended entry points or expose sensitive information.
CUDA 490 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 493 The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.
CUDA 497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.
CUDA 500 An object contains a public static field that is not marked final, which might allow it to be modified in unexpected ways.
CUDA 505 This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 522 The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CUDA 523 Login pages do not use adequate measures to protect the user name and password while they are in transit from the client to the server.
CUDA 526 The product uses an environment variable to store unencrypted sensitive information.
CUDA 528 The product generates a core dump file in a directory, archive, or other resource that is stored, transferred, or otherwise made accessible to unauthorized actors.
CUDA 532 Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CUDA 535 A command shell error message indicates that there exists an unhandled exception in the web application code. In many cases, an attacker can leverage the conditions that cause these errors in order to gain unauthorized access to the system.
CUDA 536 A servlet error message indicates that there exists an unhandled exception in your web application code and may provide useful information to an attacker.
CUDA 538 The product places sensitive information into files or directories that are accessible to actors who are allowed to have access to the files, but not to the sensitive information.
CUDA 539 The web application uses persistent cookies, but the cookies contain sensitive information.
CUDA 543 The product uses the singleton pattern when creating a resource within a multithreaded environment.
CUDA 547 The product uses hard-coded constants instead of symbolic names for security-critical values, which increases the likelihood of mistakes during code maintenance or security policy change.
CUDA 550 Certain conditions, such as network failure, will cause a server error message to be displayed.
CUDA 552 The product makes files or directories accessible to unauthorized actors, even though they should not be.
CUDA 557 Weaknesses in this category are related to concurrent use of shared resources.
CUDA 558 The product uses the getlogin() function in a multithreaded context, potentially causing it to return incorrect values.
CUDA 559 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
CUDA 561 The product contains dead code, which can never be executed.
CUDA 562 A function returns the address of a stack variable, which will cause unintended program behavior, typically in the form of a crash.
CUDA 563 The variable's value is assigned but never used, making it a dead store.
CUDA 566 The product uses a database table that includes records that should not be accessible to an actor, but it executes a SQL statement with a primary key that can be controlled by that actor.
CUDA 567 The product does not properly synchronize shared data, such as static variables across threads, which can lead to undefined behavior and unpredictable data changes.
CUDA 569 Weaknesses in this category are related to incorrectly written expressions within code.
CUDA 570 The product contains an expression that will always evaluate to false.
CUDA 571 The product contains an expression that will always evaluate to true.
CUDA 573 The product does not follow or incorrectly follows the specifications as required by the implementation language, environment, framework, protocol, or platform.
CUDA 590 The product calls free() on a pointer to memory that was not allocated using associated heap allocation functions such as malloc(), calloc(), or realloc().
CUDA 592 This weakness has been deprecated because it covered redundant concepts already described in CWE-287.
CUDA 595 The product compares object references instead of the contents of the objects themselves, preventing it from detecting equivalent objects.
CUDA 597 The product uses the wrong operator when comparing a string, such as using "==" when the .equals() method should be used instead.
CUDA 606 The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
CUDA 610 The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CUDA 617 The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CUDA 628 The product calls a function, procedure, or routine with arguments that are not correctly specified, leading to always-incorrect behavior and resultant weaknesses.
CUDA 629 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
CUDA 632 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
CUDA 633 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
CUDA 634 This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE.
CUDA 635 CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.
CUDA 637 The product uses a more complex mechanism than necessary, which could lead to resultant weaknesses when the mechanism is not correctly understood, modeled, configured, implemented, or used.
CUDA 639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CUDA 643 The product uses external input to dynamically construct an XPath expression used to retrieve data from an XML database, but it does not neutralize or incorrectly neutralizes that input. This allows an attacker to control the structure of the query.
CUDA 644 The product does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
CUDA 655 The product has a protection mechanism that is too difficult or inconvenient to use, encouraging non-malicious users to disable or bypass the mechanism, whether by accident or on purpose.
CUDA 657 The product violates well-established principles for secure design.
CUDA 662 The product utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
CUDA 663 The product calls a non-reentrant function in a concurrent context in which a competing code sequence (e.g. thread or signal handler) may have an opportunity to call the same function or otherwise influence its state.
CUDA 664 The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.
CUDA 665 The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
CUDA 666 The product performs an operation on a resource at the wrong phase of the resource's lifecycle, which can lead to unexpected behaviors.
CUDA 667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CUDA 668 The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CUDA 669 The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
CUDA 670 The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CUDA 671 The product uses security features in a way that prevents the product's administrator from tailoring security settings to reflect the environment in which the product is being used. This introduces resultant weaknesses or prevents it from operating at a level of security that is desired by the administrator.
CUDA 672 The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CUDA 674 The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.
CUDA 675 The product performs the same operation on a resource two or more times, when the operation should only be applied once.
CUDA 676 The product invokes a potentially dangerous function that could introduce a vulnerability if it is used incorrectly, but the function can also be used safely.
CUDA 680 The product performs a calculation to determine how much memory to allocate, but an integer overflow can occur that causes less memory to be allocated than expected, leading to a buffer overflow.
CUDA 681 When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CUDA 682 The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
CUDA 683 The product calls a function, procedure, or routine, but the caller specifies the arguments in an incorrect order, leading to resultant weaknesses.
CUDA 684 The code does not function according to its published specifications, potentially leading to incorrect usage.
CUDA 685 The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few arguments, which may lead to undefined behavior and resultant weaknesses.
CUDA 686 The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data type, which may lead to resultant weaknesses.
CUDA 687 The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong value, which may lead to resultant weaknesses.
CUDA 691 The code does not sufficiently manage its control flow during execution, creating conditions in which the control flow can be modified in unexpected ways.
CUDA 693 The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
CUDA 694 The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
CUDA 696 The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways which may produce resultant weaknesses.
CUDA 697 The product compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CUDA 699 This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
CUDA 700 This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.
CUDA 703 The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.
CUDA 704 The product does not correctly convert an object, resource, or structure from one type to a different type.
CUDA 705 The product does not properly return control flow to the proper location after it has completed a task or detected an unusual condition.
CUDA 706 The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CUDA 707 The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain security properties are met before being read from an upstream component or sent to a downstream component.
CUDA 710 The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase the severity of the associated vulnerabilities.
CUDA 711 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
CUDA 713 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2007.
CUDA 714 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2007.
CUDA 715 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2007.
CUDA 717 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2007.
CUDA 718 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2007.
CUDA 719 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2007.
CUDA 720 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2007.
CUDA 721 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2007.
CUDA 722 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2004.
CUDA 723 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2004.
CUDA 724 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2004.
CUDA 725 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2004.
CUDA 726 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2004.
CUDA 727 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2004.
CUDA 728 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2004.
CUDA 729 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2004.
CUDA 730 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2004.
CUDA 731 Weaknesses in this category are related to the A10 category in the OWASP Top 10 2004.
CUDA 732 The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CUDA 733 The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the program such that the mechanism is removed or modified.
CUDA 734 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT C Secure Coding Standard" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.
CUDA 735 Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) chapter of the CERT C Secure Coding Standard (2008).
CUDA 736 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008).
CUDA 737 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008).
CUDA 738 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008).
CUDA 739 Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008).
CUDA 740 Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008).
CUDA 741 Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008).
CUDA 742 Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008).
CUDA 743 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008).
CUDA 744 Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008).
CUDA 745 Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008).
CUDA 746 Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008).
CUDA 747 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008).
CUDA 748 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008).
CUDA 750 CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
CUDA 751 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2009 CWE/SANS Top 25 Programming Errors.
CUDA 752 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2009 CWE/SANS Top 25 Programming Errors.
CUDA 753 Weaknesses in this category are listed in the "Porous Defenses" section of the 2009 CWE/SANS Top 25 Programming Errors.
CUDA 754 The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the product.
CUDA 755 The product does not handle or incorrectly handles an exceptional condition.
CUDA 758 The product uses an API function, data structure, or other entity in a way that relies on properties that are not always guaranteed to hold for that entity.
CUDA 759 The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
CUDA 760 The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product uses a predictable salt as part of the input.
CUDA 762 The product attempts to return a memory resource to the system, but it calls a release function that is not compatible with the function that was originally used to allocate that resource.
CUDA 763 The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the appropriate release function incorrectly.
CUDA 764 The product locks a critical resource more times than intended, leading to an unexpected state in the system.
CUDA 765 The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.
CUDA 769 This entry has been deprecated because it was a duplicate of CWE-774. All content has been transferred to CWE-774.
CUDA 770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CUDA 771 The product does not properly maintain a reference to a resource that has been allocated, which prevents the resource from being reclaimed.
CUDA 772 The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CUDA 775 The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the file descriptor/handle is no longer needed.
CUDA 783 The product uses an expression in which operator precedence causes incorrect logic to be used.
CUDA 786 The product reads or writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
CUDA 787 The product writes data past the end, or before the beginning, of the intended buffer.
CUDA 788 The product reads or writes to a buffer using an index or pointer that references a memory location after the end of the buffer.
CUDA 789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CUDA 798 The product contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
CUDA 800 CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.
CUDA 801 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2010 CWE/SANS Top 25 Programming Errors.
CUDA 802 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2010 CWE/SANS Top 25 Programming Errors.
CUDA 803 Weaknesses in this category are listed in the "Porous Defenses" section of the 2010 CWE/SANS Top 25 Programming Errors.
CUDA 805 The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes it to access memory that is outside of the bounds of the buffer.
CUDA 806 The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause it to access memory that is outside of the bounds of the buffer.
CUDA 807 The product uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CUDA 808 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
CUDA 809 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
CUDA 810 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2010.
CUDA 812 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2010.
CUDA 813 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2010.
CUDA 815 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2010.
CUDA 816 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2010.
CUDA 817 Weaknesses in this category are related to the A8 category in the OWASP Top 10 2010.
CUDA 818 Weaknesses in this category are related to the A9 category in the OWASP Top 10 2010.
CUDA 820 The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
CUDA 823 The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the intended range of valid memory locations for the resulting pointer.
CUDA 824 The product accesses or uses a pointer that has not been initialized.
CUDA 825 The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
CUDA 828 The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the functionality is not reentrant, or it can be interrupted.
CUDA 833 The product contains multiple threads or executable segments that are waiting for each other to release a necessary lock, resulting in deadlock.
CUDA 834 The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CUDA 835 The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CUDA 839 The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that the value is greater than or equal to the minimum.
CUDA 840 Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses.
CUDA 843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CUDA 844 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.
CUDA 845 Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 846 Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 847 Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 848 Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 849 Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 850 Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 851 Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 852 Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 853 Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 854 Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 857 Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 858 Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 859 Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 860 Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 861 Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).
CUDA 862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CUDA 864 Weaknesses in this category are listed in the "Insecure Interaction Between Components" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
CUDA 865 Weaknesses in this category are listed in the "Risky Resource Management" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
CUDA 866 Weaknesses in this category are listed in the "Porous Defenses" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
CUDA 867 Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn.
CUDA 868 CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.
CUDA 871 Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 872 Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 873 Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 874 Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 875 Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 876 Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 877 Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 878 Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 879 Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 880 Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 881 Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 882 Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 883 Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CUDA 884 This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.
CUDA 885 This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1).
CUDA 886 This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2).
CUDA 887 This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3).
CUDA 888 CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).
CUDA 889 This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6).
CUDA 890 This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8).
CUDA 891 This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38).
CUDA 892 This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37).
CUDA 893 This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18).
CUDA 894 This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22).
CUDA 895 This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23).
CUDA 896 This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27).
CUDA 897 This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28).
CUDA 898 This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34).
CUDA 899 This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35).
CUDA 900 CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.
CUDA 901 This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36).
CUDA 902 This category identifies Software Fault Patterns (SFPs) within the Channel cluster.
CUDA 903 This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster.
CUDA 905 This category identifies Software Fault Patterns (SFPs) within the Predictability cluster.
CUDA 906 This category identifies Software Fault Patterns (SFPs) within the UI cluster.
CUDA 907 This category identifies Software Fault Patterns (SFPs) within the Other cluster.
CUDA 908 The product uses or accesses a resource that has not been initialized.
CUDA 909 The product does not initialize a critical resource.
CUDA 910 The product uses or accesses a file descriptor after it has been closed.
CUDA 913 The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CUDA 916 The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
CUDA 918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CUDA 922 The product stores sensitive information without properly limiting read or write access by unauthorized actors.
CUDA 923 The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.
CUDA 928 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top 10 is available.
CUDA 929 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2013.
CUDA 930 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2013.
CUDA 932 Weaknesses in this category are related to the A4 category in the OWASP Top 10 2013.
CUDA 933 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2013.
CUDA 934 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2013.
CUDA 935 Weaknesses in this category are related to the A7 category in the OWASP Top 10 2013.
CUDA 943 The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neutralizes special elements that can modify the intended logic of the query.
CUDA 944 This category identifies Software Fault Patterns (SFPs) within the Access Management cluster.
CUDA 945 This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35).
CUDA 946 This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster.
CUDA 947 This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster.
CUDA 949 This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29).
CUDA 950 This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33).
CUDA 956 This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster.
CUDA 957 This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster.
CUDA 958 This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster.
CUDA 959 This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster.
CUDA 960 This category identifies Software Fault Patterns (SFPs) within the Ambiguous Exception Type cluster (SFP5).
CUDA 961 This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6).
CUDA 962 This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4).
CUDA 963 This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23).
CUDA 964 This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster.
CUDA 966 This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster.
CUDA 969 This category identifies Software Fault Patterns (SFPs) within the Faulty Memory Release cluster (SFP12).
CUDA 970 This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8).
CUDA 971 This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7).
CUDA 973 This category identifies Software Fault Patterns (SFPs) within the Improper NULL Termination cluster (SFP11).
CUDA 974 This category identifies Software Fault Patterns (SFPs) within the Incorrect Buffer Length Computation cluster (SFP10).
CUDA 975 This category identifies Software Fault Patterns (SFPs) within the Architecture cluster.
CUDA 976 This category identifies Software Fault Patterns (SFPs) within the Compiler cluster.
CUDA 977 This category identifies Software Fault Patterns (SFPs) within the Design cluster.
CUDA 978 This category identifies Software Fault Patterns (SFPs) within the Implementation cluster.
CUDA 979 This category identifies Software Fault Patterns (SFPs) within the Failed Chroot Jail cluster (SFP17).
CUDA 980 This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18).
CUDA 981 This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16).
CUDA 982 This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14).
CUDA 983 This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15).
CUDA 984 This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster.
CUDA 985 This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13).
CUDA 986 This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19).
CUDA 987 This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21).
CUDA 988 This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20).
CUDA 990 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).
CUDA 991 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27).
CUDA 992 This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster.
CUDA 993 This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster.
CUDA 994 This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25).
CUDA 995 This category identifies Software Fault Patterns (SFPs) within the Feature cluster.
CUDA 997 This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster.
CUDA 998 This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1).
CUDA 1000 This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.
CUDA 1001 This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3).
CUDA 1002 This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster.
CUDA 1003 CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete; it is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex, category-oriented navigation of the entire CWE corpus.
CUDA 1005 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."
CUDA 1006 Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.
CUDA 1008 This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.
CUDA 1009 Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture.
CUDA 1010 Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CUDA 1011 Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture.
CUDA 1012 Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture.
CUDA 1013 Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.
CUDA 1014 Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture.
CUDA 1015 Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture.
CUDA 1016 Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture.
CUDA 1019 Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture.
CUDA 1020 Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture.
CUDA 1025 The code performs a comparison between two entities, but the comparison examines the wrong factors or characteristics of the entities, which can lead to incorrect results and resultant weaknesses.
CUDA 1026 CWE nodes in this view (graph) are associated with the OWASP Top 10, as released in 2017.
CUDA 1027 Weaknesses in this category are related to the A1 category in the OWASP Top 10 2017.
CUDA 1028 Weaknesses in this category are related to the A2 category in the OWASP Top 10 2017.
CUDA 1029 Weaknesses in this category are related to the A3 category in the OWASP Top 10 2017.
CUDA 1031 Weaknesses in this category are related to the A5 category in the OWASP Top 10 2017.
CUDA 1032 Weaknesses in this category are related to the A6 category in the OWASP Top 10 2017.
CUDA 1037 The developer builds a security-critical protection mechanism into the software, but the processor optimizes the execution of the program such that the mechanism is removed or modified.
CUDA 1041 The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
CUDA 1045 A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.
CUDA 1055 The product contains a class with inheritance from more than one concrete class.
CUDA 1059 The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic form) that contains descriptions of all the relevant software/hardware elements of the product, such as its usage, structure, architectural components, interfaces, design, implementation, configuration, operation, etc.
CUDA 1061 The product does not sufficiently hide the internal representation and implementation details of data or methods, which might allow external components or modules to modify data unexpectedly, invoke unexpected functionality, or introduce dependencies that the programmer did not intend.
CUDA 1076 The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.
CUDA 1077 The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators that do not account for the possibility of loss of precision.
CUDA 1078 The source code does not follow desired style or formatting for indentation, white space, comments, etc.
CUDA 1079 A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
CUDA 1095 The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.
CUDA 1108 The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of preserving the associated information in a narrower, more local context.
CUDA 1109 The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store more than one instance of data.
CUDA 1113 The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.
CUDA 1114 The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.
CUDA 1126 The source code declares a variable in one scope, but the variable is only used within a narrower scope.
CUDA 1128 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.
CUDA 1129 Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software.
CUDA 1130 Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software.
CUDA 1131 Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.
CUDA 1133 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.
CUDA 1134 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1135 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1136 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1137 Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1139 Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1140 Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1141 Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1142 Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1143 Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1147 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1148 Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1149 Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1150 Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1152 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.
CUDA 1154 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.
CUDA 1156 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT C Coding Standard.
CUDA 1157 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard.
CUDA 1158 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard.
CUDA 1159 Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard.
CUDA 1160 Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard.
CUDA 1161 Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard.
CUDA 1162 Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard.
CUDA 1163 Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard.
CUDA 1164 The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects that alter data or control flow, such that removal of the code would have no impact to functionality or correctness.
CUDA 1165 Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard.
CUDA 1166 Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard.
CUDA 1167 Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard.
CUDA 1168 Weaknesses in this category are related to the rules and recommendations in the Application Programming Interfaces (API) section of the SEI CERT C Coding Standard.
CUDA 1169 Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard.
CUDA 1170 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard.
CUDA 1171 Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard.
CUDA 1172 Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard.
CUDA 1177 The product uses a function, library, or third party component that has been explicitly prohibited, whether by the developer or the customer.
CUDA 1178 CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.
CUDA 1179 Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard.
CUDA 1180 Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard.
CUDA 1181 Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard.
CUDA 1182 Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard.
CUDA 1185 Weaknesses in this category are related to the rules and recommendations in the File Input and Output (FIO) section of the SEI CERT Perl Coding Standard.
CUDA 1186 Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard.
CUDA 1194 This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
CUDA 1195 Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain.
CUDA 1198 Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses.
CUDA 1200 CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.
CUDA 1202 Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC).
CUDA 1205 Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs).
CUDA 1207 Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain.
CUDA 1208 Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components.
CUDA 1210 Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed.
CUDA 1211 Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability.
CUDA 1212 Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability.
CUDA 1213 Weaknesses in this category are related to a software system's random number generation.
CUDA 1214 Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed.
CUDA 1215 Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.
CUDA 1218 Weaknesses in this category are related to the handling of memory buffers within a software system.
CUDA 1219 Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered.
CUDA 1226 Weaknesses in this category are associated with things being overly complex.
CUDA 1228 Weaknesses in this category are related to the use of built-in functions or external APIs.
CUDA 1237 This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37).
CUDA 1238 This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38).
CUDA 1241 The device uses an algorithm that is predictable and generates a pseudo-random number.
CUDA 1305 This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.
CUDA 1306 Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.
CUDA 1307 Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.
CUDA 1308 Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.
CUDA 1309 Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software.
CUDA 1337 CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.
CUDA 1340 This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.
CUDA 1341 The product attempts to close or release a resource or handle more than once, without any successful open between the close operations.
CUDA 1344 CWE entries in this view (graph) are associated with the OWASP Top 10, as released in 2021.
CUDA 1345 Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top 10 2021.
CUDA 1346 Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top 10 2021.
CUDA 1347 Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top 10 2021.
CUDA 1348 Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top 10 2021.
CUDA 1349 Weaknesses in this category are related to the A05 category "Security Misconfiguration" in the OWASP Top 10 2021.
CUDA 1350 CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.
CUDA 1353 Weaknesses in this category are related to the A07 category "Identification and Authentication Failures" in the OWASP Top 10 2021.
CUDA 1354 Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures" in the OWASP Top 10 2021.
CUDA 1355 Weaknesses in this category are related to the A09 category "Security Logging and Monitoring Failures" in the OWASP Top 10 2021.
CUDA 1356 Weaknesses in this category are related to the A10 category "Server-Side Request Forgery (SSRF)" in the OWASP Top 10 2021.
CUDA 1358 CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on "Nearest IT Neighbor" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1359 Weaknesses in this category are related to the "ICS Communications" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
CUDA 1360 Weaknesses in this category are related to the "ICS Dependencies (& Architecture)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
CUDA 1361 Weaknesses in this category are related to the "ICS Supply Chain" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
CUDA 1362 Weaknesses in this category are related to the "ICS Engineering (Constructions/Deployment)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
CUDA 1363 Weaknesses in this category are related to the "ICS Operations (& Maintenance)" super category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022.
CUDA 1364 Weaknesses in this category are related to the "Zone Boundary Failures" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1366 Weaknesses in this category are related to the "Frail Security in Protocols" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1368 Weaknesses in this category are related to the "External Digital Systems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1369 Weaknesses in this category are related to the "IT/OT Convergence/Expansion" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1370 Weaknesses in this category are related to the "Common Mode Frailties" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1371 Weaknesses in this category are related to the "Poorly Documented or Undocumented Features" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1372 Weaknesses in this category are related to the "OT Counterfeit and Malicious Corruption" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1373 Weaknesses in this category are related to the "Trust Model Problems" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1375 Weaknesses in this category are related to the "Gaps in Details/Data" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1376 Weaknesses in this category are related to the "Security Gaps in Commissioning" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1379 Weaknesses in this category are related to the "Human factors in ICS environments" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "Environmental factors in ICS including physical duress, system complexities, and isolation may result in security gaps or inadequacies in the performance of individual duties and responsibilities." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1382 Weaknesses in this category are related to the "Emerging Energy Technologies" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1383 Weaknesses in this category are related to the "Compliance/Conformance with Regulatory Requirements" category from the SEI ETF "Categories of Security Vulnerabilities in ICS" as published in March 2022: "The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements." Note: members of this category include "Nearest IT Neighbor" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions.
CUDA 1387 CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.
CUDA 1396 Weaknesses in this category are related to access control.
CUDA 1397 Weaknesses in this category are related to comparison.
CUDA 1398 Weaknesses in this category are related to component interaction.
CUDA 1399 Weaknesses in this category are related to memory safety.
CUDA 1400 This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.
CUDA 1401 Weaknesses in this category are related to concurrency.
CUDA 1402 Weaknesses in this category are related to encryption.
CUDA 1403 Weaknesses in this category are related to exposed resource.
CUDA 1404 Weaknesses in this category are related to file handling.
CUDA 1405 Weaknesses in this category are related to improper check or handling of exceptional conditions.
CUDA 1406 Weaknesses in this category are related to improper input validation.
CUDA 1407 Weaknesses in this category are related to improper neutralization.
CUDA 1408 Weaknesses in this category are related to incorrect calculation.
CUDA 1409 Weaknesses in this category are related to injection.
CUDA 1410 Weaknesses in this category are related to insufficient control flow management.
CUDA 1411 Weaknesses in this category are related to insufficient verification of data authenticity.
CUDA 1412 Weaknesses in this category are related to poor coding practices.
CUDA 1413 Weaknesses in this category are related to protection mechanism failure.
CUDA 1414 Weaknesses in this category are related to randomness.
CUDA 1415 Weaknesses in this category are related to resource control.
CUDA 1416 Weaknesses in this category are related to resource lifecycle management.
CUDA 1417 Weaknesses in this category are related to sensitive information exposure.
CUDA 1418 Weaknesses in this category are related to violation of secure design principles.
Go 2 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."
Go 4 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Go 5 Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
Go 16 Weaknesses in this category are typically introduced during the configuration of the software.
Go 17 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Go 18 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree.
Go 19 Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information.
Go 20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
Go 21 This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706).
Go 22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
Go 23 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
Go 36 The product uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as "/abs/path" that can resolve to a location that is outside of that directory.
Go 74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
Go 77 The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Go 78 The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
Go 79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
Go 80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
Go 82 The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG tags, such as the src attribute.
Go 83 The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.
Go 85 The web application does not filter user-controlled input for executable script disguised using doubling of the involved characters.
Go 86 The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag names, URI schemes, and other identifiers.
Go 87 The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
Go 88 The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
Go 89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
Go 91 The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Go 93 The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
Go 94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
Go 95 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").
Go 113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
Go 116 The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
Go 117 The product does not neutralize or incorrectly neutralizes output that is written to logs.
Go 118 The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is accessed using an index or pointer, such as memory or files.
Go 119 The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
Go 133 Weaknesses in this category are related to the creation and modification of strings.
Go 137 Weaknesses in this category are related to the creation or neutralization of data using an incorrect format.
Go 138 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as control elements or syntactic markers when they are sent to a downstream component.
Go 140 The product does not neutralize or incorrectly neutralizes delimiters.
Go 141 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as parameter or argument delimiters when they are sent to a downstream component.
Go 142 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as value delimiters when they are sent to a downstream component.
Go 143 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as record delimiters when they are sent to a downstream component.
Go 146 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as expression or command delimiters when they are sent to a downstream component.
Go 149 Quotes injected into a product can be used to compromise a system. As data are parsed, an injected/absent/duplicate/malformed use of quotes may cause the process to take unexpected actions.
Go 150 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
Go 157 The product does not properly handle the characters that are used to mark the beginning and ending of a group of entities, such as parentheses, brackets, and braces.
Go 171 This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories.
Go 183 The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are explicitly allowed by policy because the inputs are assumed to be safe, but the list is too permissive - that is, it allows an input that is unsafe, leading to resultant weaknesses.
Go 189 Weaknesses in this category are related to improper calculation or conversion of numbers.
Go 199 Weaknesses in this category are related to improper handling of sensitive information.
Go 200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Go 201 The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.
Go 209 The product generates an error message that includes sensitive information about its environment, users, or associated data.
Go 210 The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive information.
Go 211 The product performs an operation that triggers an external diagnostic or error message that is not directly generated or controlled by the product, such as an error generated by the programming language interpreter that a software application uses. The error can contain sensitive system information.
Go 221 The product does not record, or improperly records, security-relevant information that leads to an incorrect decision or hampers later analysis.
Go 223 The product does not record or display information that would be important for identifying the source or nature of an attack, or determining if an action is safe.
Go 226 The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not clear or "zeroize" the information contained in the resource before the product performs a critical state transition or makes the resource available for reuse by other entities.
Go 227 This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
Go 249 This entry has been deprecated because of name confusion and an accidental combination of multiple weaknesses. Most of its content has been transferred to CWE-785.
Go 252 The product does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
Go 253 The product incorrectly checks a return value from a function, which prevents it from detecting errors or exceptional conditions.
Go 254 Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.
Go 255 Weaknesses in this category are related to the management of credentials.
Go 256 Storing a password in plaintext may result in a system compromise.
Go 257 The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
Go 259 The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
Go 264 Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.
Go 265 Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer.
Go 275 Weaknesses in this category are related to improper assignment or handling of permissions.
Go 284 The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Go 285 The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
Go 287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Go 295 The product does not validate, or incorrectly validates, a certificate.
Go 300 The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
Go 304 The product implements an authentication technique, but it skips a step that weakens the technique.
Go 306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
Go 310 Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed.
Go 311 The product does not encrypt sensitive or critical information before storage or transmission.
Go 312 The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
Go 313 The product stores sensitive information in cleartext in a file, or on disk.
Go 314 The product stores sensitive information in cleartext in the registry.
Go 315 The product stores sensitive information in cleartext in a cookie.
Go 317 The product stores sensitive information in cleartext within the GUI.
Go 318 The product stores sensitive information in cleartext in an executable.
Go 319 The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Go 320 Weaknesses in this category are related to errors in the management of cryptographic keys.
Go 321 The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
Go 326 The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
Go 327 The product uses a broken or risky cryptographic algorithm or protocol.
Go 328 The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a hash function that allows an adversary to reasonably determine the original input (preimage attack), find another input that can produce the same hash (2nd preimage attack), or find multiple inputs that evaluate to the same hash (birthday attack).