CWE 417 Mapping

CWE-6

J2EE Misconfiguration: Insufficient Session-ID Length

• CWE.6.SLID

CWE-7

J2EE Misconfiguration: Missing Custom Error Page

• CWE.7.SEP

CWE-8

J2EE Misconfiguration: Entity Bean Declared Remote

• CWE.8.RR

CWE-9

J2EE Misconfiguration: Weak Access Permissions for EJB Methods

• CWE.9.DPANY

CWE-15

External Control of System or Configuration Setting

• CWE.15.SYSP
• CWE.15.UCO

CWE-20

Improper Input Validation

• CWE-111.NATV
• CWE-111.NATIW
• CWE-109.EV
• CWE-106.PLUGIN
• CWE-104.AEAF
• CWE-102.DFV
• CWE-103.CSVFV
• CWE-134.TDINPUT
• CWE-113.TDRESP
• CWE-470.TDRFL
• CWE-470.APIBS
• CWE-190.INTWRAP
• CWE-190.BSA
• CWE-190.CACO
• CWE-190.CLP
• CWE-190.ICO
• CWE-190.IOF
• CWE-114.TDLIB
• CWE-114.APIBS
• CWE-117.TDLOG
• CWE-129.ARRAY
• CWE-129.ARRAYSEC
• CWE-129.CAI
• CWE-15.SYSP
• CWE-15.UCO

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

• CWE.22.TDFNAMES

CWE-59

Improper Link Resolution Before File Access ('Link Following')

• CWE-64.LNK
• CWE-61.FOLLOW

CWE-61

UNIX Symbolic Link (Symlink) Following

• CWE.61.FOLLOW

CWE-64

Windows Shortcut Following (.LNK)

• CWE.64.LNK

CWE-73

External Control of File Name or Path

• CWE-114.TDLIB
• CWE-114.APIBS

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

• CWE-89.TDSQL
• CWE-89.UPS
• CWE-99.TDNET
• CWE-94.DCEMSL
• CWE-94.ASAPI
• CWE-79.EACM
• CWE-79.TDRESP
• CWE-79.TDXSS
• CWE-79.VPPD
• CWE-78.TDCMD
• CWE-91.TDXML

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

• CWE-78.TDCMD

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

• CWE.78.TDCMD

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

• CWE.79.EACM
• CWE.79.TDRESP
• CWE.79.TDXSS
• CWE.79.VPPD
• CWE-83.ARXML
• CWE-80.TDDIG
• CWE-80.TDXML
• CWE-80.ARXML
• CWE-81.ARXML

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

• CWE.80.TDDIG
• CWE.80.TDXML
• CWE.80.ARXML

CWE-81

Improper Neutralization of Script in an Error Message Web Page

• CWE.81.ARXML

CWE-83

Improper Neutralization of Script in Attributes in a Web Page

• CWE.83.ARXML

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

• CWE.89.TDSQL
• CWE.89.UPS

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

• CWE.90.TDLDAP

CWE-91

XML Injection (aka Blind XPath Injection)

• CWE.91.TDXML
• CWE-652.TDXPATH
• CWE-652.XPIJ
• CWE-643.TDJXPATH
• CWE-643.TDXPATH

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

• CWE-113.TDRESP

CWE-94

Improper Control of Generation of Code ('Code Injection')

• CWE.94.DCEMSL
• CWE.94.ASAPI
• CWE-95.TDCODE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

• CWE.95.TDCODE

CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

• CWE.99.TDNET

CWE-102

Struts: Duplicate Validation Forms

• CWE.102.DFV

CWE-103

Struts: Incomplete validate() Method Definition

• CWE.103.CSVFV

CWE-104

Struts: Form Bean Does Not Extend Validation Class

• CWE.104.AEAF

CWE-106

Struts: Plug-in Framework not in Use

• CWE.106.PLUGIN

CWE-109

Struts: Validator Turned Off

• CWE.109.EV

CWE-111

Direct Use of Unsafe JNI

• CWE.111.NATV
• CWE.111.NATIW

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

• CWE.113.TDRESP

CWE-114

Process Control

• CWE.114.TDLIB
• CWE.114.APIBS

CWE-116

Improper Encoding or Escaping of Output

• CWE-644.TDRESP
• CWE-838.SEO
• CWE-117.TDLOG

CWE-117

Improper Output Neutralization for Logs

• CWE.117.TDLOG

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

• CWE-125.ARRAY
• CWE-125.ARRAYSEC
• CWE-787.ARRAY
• CWE-787.ARRAYSEC

CWE-125

Out-of-bounds Read

• CWE.125.ARRAY
• CWE.125.ARRAYSEC

CWE-128

Wrap-around Error

• CWE.128.CACO

CWE-129

Improper Validation of Array Index

• CWE.129.ARRAY
• CWE.129.ARRAYSEC
• CWE.129.CAI

CWE-131

Incorrect Calculation of Buffer Size

• CWE.131.ARRAY

CWE-134

Use of Externally-Controlled Format String

• CWE.134.TDINPUT

CWE-172

Encoding Error

• CWE-173.SEO
• CWE-176.NCUCP

CWE-173

Improper Handling of Alternate Encoding

• CWE.173.SEO

CWE-176

Improper Handling of Unicode Encoding

• CWE.176.NCUCP

CWE-185

Incorrect Regular Expression

• CWE.185.REP

CWE-188

Reliance on Data/Memory Layout

• CWE-198.PMRWLED

CWE-190

Integer Overflow or Wraparound

• CWE.190.INTWRAP
• CWE.190.BSA
• CWE.190.CACO
• CWE.190.CLP
• CWE.190.ICO
• CWE.190.IOF
• CWE-680.BSA

CWE-191

Integer Underflow (Wrap or Wraparound)

• CWE.191.INTWRAP
• CWE.191.BSA

CWE-193

Off-by-one Error

• CWE.193.AOBO

CWE-197

Numeric Truncation Error

• CWE.197.INTDL

CWE-198

Use of Incorrect Byte Ordering

• CWE.198.PMRWLED

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

• CWE-532.SENSLOG
• CWE-532.CONSEN
• CWE-359.CONSEN
• CWE-497.SENS
• CWE-497.PEO
• CWE-213.CONSEN
• CWE-215.EWSSEC
• CWE-209.SENS
• CWE-209.PEO
• CWE-209.SIO
• CWE-209.ACPST

CWE-209

Generation of Error Message Containing Sensitive Information

• CWE.209.SENS
• CWE.209.PEO
• CWE.209.SIO
• CWE.209.ACPST

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

• CWE.212.FT

CWE-213

Exposure of Sensitive Information Due to Incompatible Policies

• CWE.213.CONSEN

CWE-215

Insertion of Sensitive Information Into Debugging Code

• CWE.215.EWSSEC

CWE-221

Information Loss or Omission

• CWE-397.NTX
• CWE-397.NTERR
• CWE-396.NCE

CWE-223

Omission of Security-relevant Information

• CWE-778.ENFL

CWE-245

J2EE Bad Practices: Direct Management of Connections

• CWE.245.JDBCTEMPLATE

CWE-246

J2EE Bad Practices: Direct Use of Sockets

• CWE.246.AUS
• CWE.246.NSF
• CWE.246.SS

CWE-248

Uncaught Exception

• CWE-600.CETS

CWE-250

Execution with Unnecessary Privileges

• CWE.250.LDP
• CWE.250.PCL

CWE-252

Unchecked Return Value

• CWE.252.CHECKRET
• CWE.252.CRRV

CWE-256

Plaintext Storage of a Password

• CWE.256.TDPASSWD
• CWE.256.UPWD
• CWE.256.PLAIN
• CWE.256.PCCF
• CWE.256.PTPT
• CWE.256.PWDPROP
• CWE.256.PWDXML
• CWE.256.UTAX
• CWE.256.WCPWD
• CWE.256.WPWD

CWE-258

Empty Password in Configuration File

• CWE.258.PWDPROP

CWE-260

Password in Configuration File

• CWE.260.UTAX
• CWE-555.PWDXML
• CWE-258.PWDPROP

CWE-261

Weak Encoding for Password

• CWE.261.CKTS

CWE-266

Incorrect Privilege Assignment

• CWE-9.DPANY

CWE-269

Improper Privilege Management

• CWE-250.LDP
• CWE-250.PCL

CWE-276

Incorrect Default Permissions

• CWE.276.ASNF
• CWE.276.CFAP

CWE-279

Incorrect Execution-Assigned Permissions

• CWE.279.IDP

CWE-284

Improper Access Control

• CWE-863.DSR
• CWE-863.SRCD
• CWE-862.PERMIT
• CWE-862.LCA
• CWE-749.DPAM
• CWE-749.DPPM
• CWE-749.SPAM
• CWE-346.JXCORS

CWE-285

Improper Authorization

• CWE-863.DSR
• CWE-863.SRCD
• CWE-862.PERMIT
• CWE-862.LCA

CWE-287

Improper Authentication

• CWE-521.MLVP
• CWE-798.HCCS
• CWE-290.HTTPRHA
• CWE-295.HV
• CWE-306.SSM
• CWE-307.PBFA

CWE-290

Authentication Bypass by Spoofing

• CWE.290.HTTPRHA
• CWE-350.DNSL

CWE-295

Improper Certificate Validation

• CWE.295.HV
• CWE-297.VSI

CWE-297

Improper Validation of Certificate with Host Mismatch

• CWE.297.VSI

CWE-306

Missing Authentication for Critical Function

• CWE.306.SSM

CWE-307

Improper Restriction of Excessive Authentication Attempts

• CWE.307.PBFA

CWE-311

Missing Encryption of Sensitive Data

• CWE.311.SENS
• CWE.311.PWDXML
• CWE-312.PWDPROP
• CWE-319.HTTPS
• CWE-319.USC

CWE-312

Cleartext Storage of Sensitive Information

• CWE.312.PWDPROP
• CWE-315.PLC
• CWE-313.PLAIN

CWE-313

Cleartext Storage in a File or on Disk

• CWE.313.PLAIN

CWE-315

Cleartext Storage of Sensitive Information in a Cookie

• CWE.315.PLC

CWE-319

Cleartext Transmission of Sensitive Information

• CWE.319.HTTPS
• CWE.319.USC
• CWE-614.UOSC
• CWE-1428.UHTTPS

CWE-321

Use of Hard-coded Cryptographic Key

• CWE.321.HCCK

CWE-325

Missing Cryptographic Step

• CWE.325.MCMDU
• CWE.325.SIKG

CWE-326

Inadequate Encryption Strength

• CWE-328.AISSAJAVA
• CWE-328.AISSAXML
• CWE-328.AUNC
• CWE-328.ICA
• CWE-328.MDSALT
• CWE-328.SRD

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

• CWE.327.ACMD
• CWE-328.AISSAJAVA
• CWE-328.AISSAXML
• CWE-328.AUNC
• CWE-328.ICA
• CWE-328.MDSALT
• CWE-328.SRD

CWE-328

Use of Weak Hash

• CWE.328.AISSAJAVA
• CWE.328.AISSAXML
• CWE.328.AUNC
• CWE.328.ICA
• CWE.328.MDSALT
• CWE.328.SRD

CWE-329

Generation of Predictable IV with CBC Mode

• CWE.329.ENPP
• CWE.329.IVR

CWE-330

Use of Insufficiently Random Values

• CWE-338.SRD

CWE-334

Small Space of Random Values

• CWE-6.SLID

CWE-335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

• CWE-337.ENPP
• CWE-336.ENPP

CWE-336

Same Seed in Pseudo-Random Number Generator (PRNG)

• CWE.336.ENPP

CWE-337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

• CWE.337.ENPP

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

• CWE.338.SRD

CWE-344

Use of Invariant Value in Dynamically Changing Context

• CWE-798.HCCS

CWE-345

Insufficient Verification of Data Authenticity

• CWE-352.EACM
• CWE-352.TDRESP
• CWE-352.TDXSS
• CWE-352.VPPD
• CWE-352.UOSC
• CWE-352.DCSRFJAVA
• CWE-352.DCSRFXML
• CWE-352.REQMAP
• CWE-346.JXCORS
• CWE-347.VJFS

CWE-346

Origin Validation Error

• CWE.346.JXCORS
• CWE-1385.WS

CWE-347

Improper Verification of Cryptographic Signature

• CWE.347.VJFS

CWE-350

Reliance on Reverse DNS Resolution for a Security-Critical Action

• CWE.350.DNSL

CWE-352

Cross-Site Request Forgery (CSRF)

• CWE.352.EACM
• CWE.352.TDRESP
• CWE.352.TDXSS
• CWE.352.VPPD
• CWE.352.UOSC
• CWE.352.DCSRFJAVA
• CWE.352.DCSRFXML
• CWE.352.REQMAP

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

• CWE.359.CONSEN

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

• CWE.362.DCL
• CWE-367.TOCTOU

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

• CWE.367.TOCTOU

CWE-369

Divide By Zero

• CWE.369.ZERO

CWE-375

Returning a Mutable Object to an Untrusted Caller

• CWE.375.RA

CWE-377

Insecure Temporary File

• CWE.377.ATF

CWE-382

J2EE Bad Practices: Use of System.exit()

• CWE.382.EXIT
• CWE.382.JVM

CWE-383

J2EE Bad Practices: Direct Use of Threads

• CWE.383.THR

CWE-384

Session Fixation

• CWE.384.ISL

CWE-390

Detection of Error Condition Without Action

• CWE.390.LGE

CWE-391

Unchecked Error Condition

• CWE.391.AECB

CWE-395

Use of NullPointerException Catch to Detect NULL Pointer Dereference

• CWE.395.NCNPE

CWE-396

Declaration of Catch for Generic Exception

• CWE.396.NCE

CWE-397

Declaration of Throws for Generic Exception

• CWE.397.NTX
• CWE.397.NTERR

CWE-400

Uncontrolled Resource Consumption

• CWE.400.DMDS
• CWE-771.LEAKS
• CWE-770.ISTART

CWE-404

Improper Resource Shutdown or Release

• CWE.404.COCO
• CWE.404.ODBIL
• CWE.404.CRWD
• CWE-772.LEAKS
• CWE-772.CLOSE
• CWE-459.LEAKS

CWE-413

Improper Resource Locking

• CWE.413.LORD

CWE-416

Use After Free

• CWE.416.FREE

CWE-426

Untrusted Search Path

• CWE.426.PBRTE

CWE-427

Uncontrolled Search Path Element

• CWE.427.PBRTE

CWE-434

Unrestricted Upload of File with Dangerous Type

• CWE.434.TDFNAMES

CWE-436

Interpretation Conflict

• CWE-113.TDRESP

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

• CWE-918.TDNET

CWE-456

Missing Initialization of a Variable

• CWE.456.LV

CWE-457

Use of Uninitialized Variable

• CWE.457.NP
• CWE.457.NOTEXPLINIT
• CWE.457.NOTINITCTOR
• CWE.457.UIRC

CWE-459

Incomplete Cleanup

• CWE.459.LEAKS
• CWE-568.FCF

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

• CWE.470.TDRFL
• CWE.470.APIBS

CWE-471

Modification of Assumed-Immutable Data (MAID)

• CWE-607.IMM
• CWE-607.RMO

CWE-476

NULL Pointer Dereference

• CWE.476.NP

CWE-477

Use of Obsolete Function

• CWE.477.DPRAPI

CWE-478

Missing Default Case in Multiple Condition Expression

• CWE.478.PDS

CWE-480

Use of Incorrect Operator

• CWE-481.ASI

CWE-481

Assigning instead of Comparing

• CWE.481.ASI

CWE-483

Incorrect Block Delimitation

• CWE.483.BLK
• CWE.483.EBI
• CWE.483.EB

CWE-484

Omitted Break Statement in Switch

• CWE.484.SBC
• CWE.484.DAV

CWE-486

Comparison of Classes by Name

• CWE.486.AUG
• CWE.486.CMP

CWE-487

Reliance on Package-level Scope

• CWE.487.AF

CWE-491

Public cloneable() Method Without Final ('Object Hijack')

• CWE.491.CLONE

CWE-492

Use of Inner Class Containing Sensitive Data

• CWE.492.INNER

CWE-493

Critical Public Variable Without Final Modifier

• CWE-500.SPFF

CWE-495

Private Data Structure Returned From A Public Method

• CWE.495.RA

CWE-496

Public Data Assigned to Private Array-Typed Field

• CWE.496.CAP

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

• CWE.497.SENS
• CWE.497.PEO

CWE-499

Serializable Class Containing Sensitive Data

• CWE.499.SIF
• CWE.499.SER

CWE-500

Public Static Field Not Marked Final

• CWE.500.SPFF

CWE-501

Trust Boundary Violation

• CWE.501.TDSESSION

CWE-502

Deserialization of Untrusted Data

• CWE.502.SSSD
• CWE.502.MASP
• CWE.502.AUXD
• CWE.502.SC
• CWE.502.RWAF
• CWE.502.VOBD

CWE-506

Embedded Malicious Code

• CWE.506.HCCK
• CWE-511.RDM

CWE-511

Logic/Time Bomb

• CWE.511.RDM

CWE-521

Weak Password Requirements

• CWE.521.MLVP
• CWE-258.PWDPROP

CWE-522

Insufficiently Protected Credentials

• CWE-523.USC
• CWE-261.CKTS
• CWE-260.UTAX
• CWE-256.TDPASSWD
• CWE-256.UPWD
• CWE-256.PLAIN
• CWE-256.PCCF
• CWE-256.PTPT
• CWE-256.PWDPROP
• CWE-256.PWDXML
• CWE-256.UTAX
• CWE-256.WCPWD
• CWE-256.WPWD

CWE-523

Unprotected Transport of Credentials

• CWE.523.USC

CWE-532

Insertion of Sensitive Information into Log File

• CWE.532.SENSLOG
• CWE.532.CONSEN

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

• CWE-532.SENSLOG
• CWE-532.CONSEN

CWE-543

Use of Singleton Pattern Without Synchronization in a Multithreaded Context

• CWE.543.IASF
• CWE.543.ILI

CWE-546

Suspicious Comment

• CWE.546.TODOJAVA
• CWE.546.TODOPROP
• CWE.546.TODOXML

CWE-555

J2EE Misconfiguration: Plaintext Password in Configuration File

• CWE.555.PWDXML

CWE-561

Dead Code

• CWE.561.CC
• CWE.561.SWITCH
• CWE.561.PM

CWE-563

Assignment to Variable without Use

• CWE.563.VOVR
• CWE.563.UPPF
• CWE.563.AURV
• CWE.563.PF
• CWE.563.UP

CWE-568

finalize() Method Without super.finalize()

• CWE.568.FCF

CWE-570

Expression is Always False

• CWE.570.CC
• CWE.570.UCIF

CWE-571

Expression is Always True

• CWE.571.CC
• CWE.571.UCIF

CWE-572

Call to Thread run() instead of start()

• CWE.572.IRUN

CWE-573

Improper Following of Specification by Caller

• CWE-581.OVERRIDE
• CWE-104.AEAF
• CWE-103.CSVFV
• CWE-577.AUS
• CWE-580.SCLONE
• CWE-325.MCMDU
• CWE-325.SIKG
• CWE-568.FCF
• CWE-579.ONS
• CWE-579.SNSO
• CWE-578.ACL
• CWE-329.ENPP
• CWE-329.IVR

CWE-576

EJB Bad Practices: Use of Java I/O

• CWE.576.JIO

CWE-577

EJB Bad Practices: Use of Sockets

• CWE.577.AUS

CWE-578

EJB Bad Practices: Use of Class Loader

• CWE.578.ACL

CWE-579

J2EE Bad Practices: Non-serializable Object Stored in Session

• CWE.579.ONS
• CWE.579.SNSO

CWE-580

clone() Method Without super.clone()

• CWE.580.SCLONE

CWE-581

Object Model Violation: Just One of Equals and Hashcode Defined

• CWE.581.OVERRIDE

CWE-582

Array Declared Public, Final, and Static

• CWE.582.IMM
• CWE.582.PSFA

CWE-583

finalize() Method Declared Public

• CWE.583.MFP

CWE-584

Return Inside Finally Block

• CWE.584.ARCF

CWE-585

Empty Synchronized Block

• CWE.585.SNE

CWE-586

Explicit Call to Finalize()

• CWE.586.NCF

CWE-594

J2EE Framework: Saving Unserializable Objects to Disk

• CWE.594.SIVS

CWE-595

Comparison of Object References Instead of Object Contents

• CWE.595.UEIC

CWE-600

Uncaught Exception in Servlet

• CWE.600.CETS

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

• CWE.601.TDNET
• CWE.601.TDRESP
• CWE.601.VRD
• CWE.601.UCO

CWE-605

Multiple Binds to the Same Port

• CWE.605.HCNA

CWE-607

Public Static Final Field References Mutable Object

• CWE.607.IMM
• CWE.607.RMO

CWE-609

Double-Checked Locking

• CWE.609.DCL

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

• CWE-601.TDNET
• CWE-601.TDRESP
• CWE-601.VRD
• CWE-601.UCO
• CWE-470.TDRFL
• CWE-470.APIBS
• CWE-918.TDNET
• CWE-15.SYSP
• CWE-15.UCO
• CWE-384.ISL
• CWE-611.XMLVAL
• CWE-611.DXXE

CWE-611

Improper Restriction of XML External Entity Reference

• CWE.611.XMLVAL
• CWE.611.DXXE

CWE-613

Insufficient Session Expiration

• CWE.613.RUIM
• CWE.613.STTL

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

• CWE.614.UOSC

CWE-617

Reachable Assertion

• CWE.617.ASSERT

CWE-642

External Control of Critical State Data

• CWE-15.SYSP
• CWE-15.UCO
• CWE-426.PBRTE

CWE-643

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

• CWE.643.TDJXPATH
• CWE.643.TDXPATH

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

• CWE.644.TDRESP

CWE-652

Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

• CWE.652.TDXPATH
• CWE.652.XPIJ

CWE-657

Violation of Secure Design Principles

• CWE-250.LDP
• CWE-250.PCL

CWE-662

Improper Synchronization

• CWE.662.DIFCS
• CWE-543.IASF
• CWE-543.ILI
• CWE-833.ORDER
• CWE-833.TSHL
• CWE-833.CSFS
• CWE-833.RLF
• CWE-833.STR
• CWE-833.UWNA
• CWE-764.DLOCK
• CWE-667.LOCK
• CWE-667.CLOSE

CWE-664

Improper Control of a Resource Through its Lifetime

• CWE-487.AF
• CWE-580.SCLONE
• CWE-662.DIFCS
• CWE-704.AGBPT
• CWE-704.CPTS
• CWE-495.RA
• CWE-496.CAP
• CWE-400.DMDS
• CWE-404.COCO
• CWE-404.ODBIL
• CWE-404.CRWD
• CWE-501.TDSESSION

CWE-665

Improper Initialization

• CWE-456.LV
• CWE-770.ISTART
• CWE-457.NP
• CWE-457.NOTEXPLINIT
• CWE-457.NOTINITCTOR
• CWE-457.UIRC

CWE-666

Operation on Resource in Wrong Phase of Lifetime

• CWE-605.HCNA

CWE-667

Improper Locking

• CWE.667.LOCK
• CWE.667.CLOSE
• CWE-413.LORD
• CWE-832.LORD
• CWE-833.ORDER
• CWE-833.TSHL
• CWE-833.CSFS
• CWE-833.RLF
• CWE-833.STR
• CWE-833.UWNA
• CWE-609.DCL
• CWE-764.DLOCK

CWE-668

Exposure of Resource to Wrong Sphere

• CWE-375.RA
• CWE-377.ATF
• CWE-499.SIF
• CWE-499.SER
• CWE-134.TDINPUT
• CWE-491.CLONE
• CWE-492.INNER
• CWE-427.PBRTE
• CWE-426.PBRTE
• CWE-8.RR
• CWE-582.IMM
• CWE-582.PSFA
• CWE-583.MFP

CWE-669

Incorrect Resource Transfer Between Spheres

• CWE-829.TDFILES
• CWE-829.TDFNAMES
• CWE-829.TDLIB
• CWE-829.TDXPATH
• CWE-434.TDFNAMES
• CWE-212.FT

CWE-670

Always-Incorrect Control Flow Implementation

• CWE-483.BLK
• CWE-483.EBI
• CWE-483.EB
• CWE-484.SBC
• CWE-484.DAV
• CWE-617.ASSERT

CWE-671

Lack of Administrator Control over Security

• CWE-798.HCCS

CWE-672

Operation on a Resource after Expiration or Release

• CWE-416.FREE
• CWE-613.RUIM
• CWE-613.STTL

CWE-673

External Influence of Sphere Definition

• CWE-426.PBRTE

CWE-674

Uncontrolled Recursion

• CWE.674.FLRC

CWE-675

Multiple Operations on Resource in Single-Operation Context

• CWE-764.DLOCK
• CWE-605.HCNA

CWE-676

Use of Potentially Dangerous Function

• CWE.676.SRD

CWE-680

Integer Overflow to Buffer Overflow

• CWE.680.BSA

CWE-681

Incorrect Conversion between Numeric Types

• CWE.681.INTVC
• CWE.681.CLP
• CWE.681.IDCD
• CWE-197.INTDL

CWE-682

Incorrect Calculation

• CWE-369.ZERO
• CWE-131.ARRAY
• CWE-128.CACO
• CWE-191.INTWRAP
• CWE-191.BSA
• CWE-190.INTWRAP
• CWE-190.BSA
• CWE-190.CACO
• CWE-190.CLP
• CWE-190.ICO
• CWE-190.IOF
• CWE-193.AOBO

CWE-691

Insufficient Control Flow Management

• CWE.691.ANL
• CWE-362.DCL
• CWE-841.PERMIT
• CWE-662.DIFCS

CWE-693

Protection Mechanism Failure

• CWE-807.PLC
• CWE-807.HGRSI
• CWE-807.UOSC
• CWE-311.SENS
• CWE-311.PWDXML
• CWE-327.ACMD

CWE-694

Use of Multiple Resources with Duplicate Identifier

• CWE-102.DFV

CWE-695

Use of Low-Level Functionality

• CWE-111.NATV
• CWE-111.NATIW
• CWE-245.JDBCTEMPLATE
• CWE-383.THR
• CWE-246.AUS
• CWE-246.NSF
• CWE-246.SS
• CWE-576.JIO

CWE-697

Incorrect Comparison

• CWE-185.REP
• CWE-581.OVERRIDE
• CWE-1077.DCF

CWE-703

Improper Check or Handling of Exceptional Conditions

• CWE-397.NTX
• CWE-397.NTERR
• CWE-391.AECB
• CWE-755.CIET

CWE-704

Incorrect Type Conversion or Cast

• CWE.704.AGBPT
• CWE.704.CPTS
• CWE-681.INTVC
• CWE-681.CLP
• CWE-681.IDCD
• CWE-843.EQUS

CWE-705

Incorrect Control Flow Scoping

• CWE-397.NTX
• CWE-397.NTERR
• CWE-396.NCE
• CWE-395.NCNPE
• CWE-382.EXIT
• CWE-382.JVM
• CWE-584.ARCF

CWE-706

Use of Incorrectly-Resolved Name or Reference

• CWE-22.TDFNAMES

CWE-710

Improper Adherence to Coding Standards

• CWE-484.SBC
• CWE-484.DAV
• CWE-476.NP
• CWE-477.DPRAPI
• CWE-571.CC
• CWE-571.UCIF
• CWE-570.CC
• CWE-570.UCIF
• CWE-1066.OROM
• CWE-1126.DVCU

CWE-732

Incorrect Permission Assignment for Critical Resource

• CWE-276.ASNF
• CWE-276.CFAP
• CWE-1004.SCHTTP
• CWE-279.IDP

CWE-749

Exposed Dangerous Method or Function

• CWE.749.DPAM
• CWE.749.DPPM
• CWE.749.SPAM

CWE-754

Improper Check for Unusual or Exceptional Conditions

• CWE-476.NP
• CWE-391.AECB
• CWE-252.CHECKRET
• CWE-252.CRRV

CWE-755

Improper Handling of Exceptional Conditions

• CWE.755.CIET
• CWE-396.NCE
• CWE-395.NCNPE
• CWE-390.LGE
• CWE-209.SENS
• CWE-209.PEO
• CWE-209.SIO
• CWE-209.ACPST

CWE-756

Missing Custom Error Page

• CWE-7.SEP

CWE-758

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

• CWE-1102.DNHCP
• CWE-1102.LNSP
• CWE-1102.PEER

CWE-759

Use of a One-Way Hash without a Salt

• CWE.759.MDSALT

CWE-764

Multiple Locks of a Critical Resource

• CWE.764.DLOCK

CWE-770

Allocation of Resources Without Limits or Throttling

• CWE.770.ISTART
• CWE-789.TDALLOC

CWE-771

Missing Reference to Active Allocated Resource

• CWE.771.LEAKS

CWE-772

Missing Release of Resource after Effective Lifetime

• CWE.772.LEAKS
• CWE.772.CLOSE

CWE-778

Insufficient Logging

• CWE.778.ENFL

CWE-787

Out-of-bounds Write

• CWE.787.ARRAY
• CWE.787.ARRAYSEC

CWE-789

Memory Allocation with Excessive Size Value

• CWE.789.TDALLOC

CWE-798

Use of Hard-coded Credentials

• CWE.798.HCCS
• CWE-321.HCCK

CWE-799

Improper Control of Interaction Frequency

• CWE-307.PBFA

CWE-805

Buffer Access with Incorrect Length Value

• CWE-806.BUSSB

CWE-806

Buffer Access Using Size of Source Buffer

• CWE.806.BUSSB

CWE-807

Reliance on Untrusted Inputs in a Security Decision

• CWE.807.PLC
• CWE.807.HGRSI
• CWE.807.UOSC
• CWE-350.DNSL

CWE-820

Missing Synchronization

• CWE-543.IASF
• CWE-543.ILI

CWE-821

Incorrect Synchronization

• CWE-572.IRUN

CWE-825

Expired Pointer Dereference

• CWE-416.FREE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

• CWE.829.TDFILES
• CWE.829.TDFNAMES
• CWE.829.TDLIB
• CWE.829.TDXPATH

CWE-832

Unlock of a Resource that is not Locked

• CWE.832.LORD

CWE-833

Deadlock

• CWE.833.ORDER
• CWE.833.TSHL
• CWE.833.CSFS
• CWE.833.RLF
• CWE.833.STR
• CWE.833.UWNA

CWE-834

Excessive Iteration

• CWE-674.FLRC
• CWE-835.PCIF
• CWE-835.AIL

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

• CWE.835.PCIF
• CWE.835.AIL

CWE-836

Use of Password Hash Instead of Password for Authentication

• CWE.836.PLAIN

CWE-838

Inappropriate Encoding for Output Context

• CWE.838.SEO

CWE-841

Improper Enforcement of Behavioral Workflow

• CWE.841.PERMIT

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

• CWE.843.EQUS

CWE-862

Missing Authorization

• CWE.862.PERMIT
• CWE.862.LCA

CWE-863

Incorrect Authorization

• CWE.863.DSR
• CWE.863.SRCD

CWE-908

Use of Uninitialized Resource

• CWE-457.NP
• CWE-457.NOTEXPLINIT
• CWE-457.NOTINITCTOR
• CWE-457.UIRC

CWE-909

Missing Initialization of Resource

• CWE-456.LV

CWE-912

Hidden Functionality

• CWE-506.HCCK

CWE-913

Improper Control of Dynamically-Managed Code Resources

• CWE-470.TDRFL
• CWE-470.APIBS
• CWE-502.SSSD
• CWE-502.MASP
• CWE-502.AUXD
• CWE-502.SC
• CWE-502.RWAF
• CWE-502.VOBD
• CWE-94.DCEMSL
• CWE-94.ASAPI

CWE-916

Use of Password Hash With Insufficient Computational Effort

• CWE-759.MDSALT

CWE-918

Server-Side Request Forgery (SSRF)

• CWE.918.TDNET

CWE-922

Insecure Storage of Sensitive Information

• CWE-312.PWDPROP

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

• CWE-297.VSI

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

• CWE-652.TDXPATH
• CWE-652.XPIJ
• CWE-90.TDLDAP
• CWE-643.TDJXPATH
• CWE-643.TDXPATH
• CWE-89.TDSQL
• CWE-89.UPS

CWE-1004

Sensitive Cookie Without 'HttpOnly' Flag

• CWE.1004.SCHTTP

CWE-1023

Incomplete Comparison with Missing Factors

• CWE-478.PDS

CWE-1025

Comparison Using Wrong Factors

• CWE-595.UEIC
• CWE-486.AUG
• CWE-486.CMP

CWE-1046

Creation of Immutable Text Using String Concatenation

• CWE.1046.USB

CWE-1051

Initialization with Hard-Coded Network Resource Configuration Data

• CWE.1051.HCNA

CWE-1066

Missing Serialization Control Element

• CWE.1066.OROM

CWE-1069

Empty Exception Block

• CWE.1069.AECB

CWE-1071

Empty Code Block

• CWE-1069.AECB
• CWE-585.SNE

CWE-1075

Unconditional Control Flow Transfer outside of Switch Block

• CWE.1075.ABCL

CWE-1076

Insufficient Adherence to Expected Conventions

• CWE-594.SIVS
• CWE-586.NCF

CWE-1077

Floating Point Comparison with Incorrect Operator

• CWE.1077.DCF

CWE-1078

Inappropriate Source Code Style or Formatting

• CWE-546.TODOJAVA
• CWE-546.TODOPROP
• CWE-546.TODOXML
• CWE-1115.MCH
• CWE-1106.USN

CWE-1102

Reliance on Machine-Dependent Data Representation

• CWE.1102.DNHCP
• CWE.1102.LNSP
• CWE.1102.PEER

CWE-1106

Insufficient Use of Symbolic Constants

• CWE.1106.USN

CWE-1115

Source Code Element without Standard Prologue

• CWE.1115.MCH

CWE-1120

Excessive Code Complexity

• CWE-1075.ABCL

CWE-1126

Declaration of Variable with Unnecessarily Wide Scope

• CWE.1126.DVCU

CWE-1164

Irrelevant Code

• CWE-561.CC
• CWE-561.SWITCH
• CWE-561.PM
• CWE-563.VOVR
• CWE-563.UPPF
• CWE-563.AURV
• CWE-563.PF
• CWE-563.UP

CWE-1173

Improper Use of Validation Framework

• CWE-109.EV
• CWE-106.PLUGIN
• CWE-102.DFV

CWE-1176

Inefficient CPU Computation

• CWE-1046.USB

CWE-1177

Use of Prohibited Code

• CWE-676.SRD

CWE-1204

Generation of Weak Initialization Vector (IV)

• CWE-329.ENPP
• CWE-329.IVR

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

• CWE-129.ARRAY
• CWE-129.ARRAYSEC
• CWE-129.CAI

CWE-1385

Missing Origin Validation in WebSockets

• CWE.1385.WS

CWE-1390

Weak Authentication

• CWE-290.HTTPRHA
• CWE-836.PLAIN
• CWE-307.PBFA

CWE-1391

Use of Weak Credentials

• CWE-798.HCCS
• CWE-521.MLVP

CWE-1419

Incorrect Initialization of Resource

• CWE-1051.HCNA

CWE-1428

Reliance on HTTP instead of HTTPS

• CWE.1428.UHTTPS