Page History

CWE-6

J2EE Misconfiguration: Insufficient Session-ID Length

• CWE.6.SLID

CWE-7

J2EE Misconfiguration: Missing Custom Error Page

• CWE.7.SEP

CWE-8

J2EE Misconfiguration: Entity Bean Declared Remote

• CWE.8.ULI
• CWE.8.RR

CWE-9

J2EE Misconfiguration: Weak Access Permissions for EJB Methods

• CWE.9.DPANY

CWE-15

External Control of System or Configuration Setting

• CWE.15.SYSP
• CWE.15.UCO

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

• CWE.22.TDFNAMES

CWE-61

UNIX Symbolic Link (Symlink) Following

• CWE.61.FOLLOW

CWE-64

Windows Shortcut Following (.LNK)

• CWE.64.LNK

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

• CWE.78.TDCMD

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

• CWE.79.EACM
• CWE.79.TDRESP
• CWE.79.TDXSS
• CWE.79.VPPD

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

• CWE.80.TDDIG
• CWE.80.TDXML
• CWE.80.ARXML

CWE-81

Improper Neutralization of Script in an Error Message Web Page

• CWE.81.ARXML

CWE-83

Improper Neutralization of Script in Attributes in a Web Page

• CWE.83.ARXML

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

• CWE.89.TDSQL
• CWE.89.UPS

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

• CWE.90.TDLDAP

CWE-91

XML Injection (aka Blind XPath Injection)

• CWE.91.TDXML

CWE-94

Improper Control of Generation of Code ('Code Injection')

• CWE.94.DCEMSL
• CWE.94.ASAPI

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

• CWE.95.TDCODE

CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

• CWE.99.TDNET

CWE-102

Struts: Duplicate Validation Forms

• CWE.102.DFV

CWE-103

Struts: Incomplete validate() Method Definition

• CWE.103.CSVFV

CWE-104

Struts: Form Bean Does Not Extend Validation Class

• CWE.104.AEAF

CWE-106

Struts: Plug-in Framework not in Use

• CWE.106.PLUGIN

CWE-109

Struts: Validator Turned Off

• CWE.109.EV

CWE-111

Direct Use of Unsafe JNI

• CWE.111.NATV
• CWE.111.NATIW

CWE-112

Missing XML Validation

• CWE.112.XMLVAL

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

• CWE.113.TDRESP

CWE-114

Process Control

• CWE.114.TDLIB
• CWE.114.APIBS

CWE-117

Improper Output Neutralization for Logs

• CWE.117.TDLOG

CWE-125

Out-of-bounds Read

• CWE.125.ARRAY
• CWE.125.ARRAYSEC

CWE-128

Wrap-around Error

• CWE.128.CACO

CWE-129

Improper Validation of Array Index

• CWE.129.ARRAY
• CWE.129.ARRAYSEC
• CWE.129.CAI

CWE-131

Incorrect Calculation of Buffer Size

• CWE.131.ARRAY

CWE-134

Use of Externally-Controlled Format String

• CWE.134.TDINPUT

CWE-173

Improper Handling of Alternate Encoding

• CWE.173.SEO

CWE-176

Improper Handling of Unicode Encoding

• CWE.176.NCUCP

CWE-180

Incorrect Behavior Order: Validate Before Canonicalize

• CWE.180.CDBV

CWE-185

Incorrect Regular Expression

• CWE.185.REP

CWE-190

Integer Overflow or Wraparound

• CWE.190.INTWRAP
• CWE.190.BSA
• CWE.190.CACO
• CWE.190.CLP
• CWE.190.ICO
• CWE.190.IOF

CWE-191

Integer Underflow (Wrap or Wraparound)

• CWE.191.INTWRAP
• CWE.191.BSA

CWE-193

Off-by-one Error

• CWE.193.AOBO

CWE-197

Numeric Truncation Error

• CWE.197.INTDL

CWE-198

Use of Incorrect Byte Ordering

• CWE.198.PMRWLED

CWE-209

Generation of Error Message Containing Sensitive Information

• CWE.209.SENS
• CWE.209.PEO
• CWE.209.SIO
• CWE.209.ACPST

CWE-212

Improper Removal of Sensitive Information Before Storage or Transfer

• CWE.212.FT

CWE-213

Exposure of Sensitive Information Due to Incompatible Policies

• CWE.213.CONSEN

CWE-215

Insertion of Sensitive Information Into Debugging Code

• CWE.215.EWSSEC

CWE-245

J2EE Bad Practices: Direct Management of Connections

• CWE.245.JDBCTEMPLATE

CWE-246

J2EE Bad Practices: Direct Use of Sockets

• CWE.246.AUS
• CWE.246.NSF
• CWE.246.SS

CWE-248

Uncaught Exception

• CWE.248.EXCEPT

CWE-250

Execution with Unnecessary Privileges

• CWE.250.LDP
• CWE.250.PCL

CWE-252

Unchecked Return Value

• CWE.252.CHECKRET
• CWE.252.CRRV

CWE-256

Plaintext Storage of a Password

• CWE.256.TDPASSWD
• CWE.256.UPWD
• CWE.256.PLAIN
• CWE.256.PCCF
• CWE.256.PTPT
• CWE.256.PWDPROP
• CWE.256.PWDXML
• CWE.256.UTAX
• CWE.256.WCPWD
• CWE.256.WPWD

CWE-258

Empty Password in Configuration File

• CWE.258.PWDPROP

CWE-260

Password in Configuration File

• CWE.260.UTAX

CWE-261

Weak Encoding for Password

• CWE.261.CKTS

CWE-276

Incorrect Default Permissions

• CWE.276.ASNF
• CWE.276.CFAP

CWE-279

Incorrect Execution-Assigned Permissions

• CWE.279.IDP

CWE-290

Authentication Bypass by Spoofing

• CWE.290.HTTPRHA

CWE-295

Improper Certificate Validation

• CWE.295.HV

CWE-297

Improper Validation of Certificate with Host Mismatch

• CWE.297.VSI

CWE-306

Missing Authentication for Critical Function

• CWE.306.SSM

CWE-307

Improper Restriction of Excessive Authentication Attempts

• CWE.307.PBFA

CWE-311

Missing Encryption of Sensitive Data

• CWE.311.SENS
• CWE.311.PWDXML

CWE-312

Cleartext Storage of Sensitive Information

• CWE.312.PWDPROP

CWE-313

Cleartext Storage in a File or on Disk

• CWE.313.PLAIN

CWE-315

Cleartext Storage of Sensitive Information in a Cookie

• CWE.315.PLC

CWE-319

Cleartext Transmission of Sensitive Information

• CWE.319.HTTPS
• CWE.319.USC

CWE-321

Use of Hard-coded Cryptographic Key

• CWE.321.HCCK

CWE-325

Missing Cryptographic Step

• CWE.325.MCMDU
• CWE.325.SIKG

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

• CWE.327.ACMD

CWE-328

Use of Weak Hash

• CWE.328.AISSAJAVA
• CWE.328.AISSAXML
• CWE.328.AUNC
• CWE.328.ICA
• CWE.328.MDSALT
• CWE.328.SRD

CWE-329

Generation of Predictable IV with CBC Mode

• CWE.329.ENPP
• CWE.329.IVR

CWE-336

Same Seed in Pseudo-Random Number Generator (PRNG)

• CWE.336.ENPP

CWE-337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

• CWE.337.ENPP

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

• CWE.338.SRD

CWE-346

Origin Validation Error

• CWE.346.JXCORS

CWE-347

Improper Verification of Cryptographic Signature

• CWE.347.VJFS

CWE-350

Reliance on Reverse DNS Resolution for a Security-Critical Action

• CWE.350.DNSL

CWE-352

Cross-Site Request Forgery (CSRF)

• CWE.352.EACM
• CWE.352.TDRESP
• CWE.352.TDXSS
• CWE.352.VPPD
• CWE.352.UOSC
• CWE.352.DCSRFJAVA
• CWE.352.DCSRFXML
• CWE.352.REQMAP

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

• CWE.359.CONSEN

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

• CWE.362.DCL

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

• CWE.367.TOCTOU

CWE-369

Divide By Zero

• CWE.369.ZERO

CWE-375

Returning a Mutable Object to an Untrusted Caller

• CWE.375.RA

CWE-377

Insecure Temporary File

• CWE.377.ATF

CWE-382

J2EE Bad Practices: Use of System.exit()

• CWE.382.EXIT
• CWE.382.JVM

CWE-383

J2EE Bad Practices: Direct Use of Threads

• CWE.383.THREAD
• CWE.383.THR

CWE-384

Session Fixation

• CWE.384.ISL

CWE-390

Detection of Error Condition Without Action

• CWE.390.LGE

CWE-391

Unchecked Error Condition

• CWE.391.AECB

CWE-395

Use of NullPointerException Catch to Detect NULL Pointer Dereference

• CWE.395.NCNPE

CWE-396

Declaration of Catch for Generic Exception

• CWE.396.NCE

CWE-397

Declaration of Throws for Generic Exception

• CWE.397.NTX
• CWE.397.NTERR

CWE-400

Uncontrolled Resource Consumption

• CWE.400.DMDS

CWE-404

Improper Resource Shutdown or Release

• CWE.404.COCO
• CWE.404.ODBIL
• CWE.404.CRWD

CWE-413

Improper Resource Locking

• CWE.413.LORD

CWE-416

Use After Free

• CWE.416.FREE

CWE-426

Untrusted Search Path

• CWE.426.PBRTE

CWE-427

Uncontrolled Search Path Element

• CWE.427.PBRTE

CWE-434

Unrestricted Upload of File with Dangerous Type

• CWE.434.TDFNAMES

CWE-456

Missing Initialization of a Variable

• CWE.456.LV

CWE-457

Use of Uninitialized Variable

• CWE.457.NP
• CWE.457.NOTEXPLINIT
• CWE.457.NOTINITCTOR
• CWE.457.UIRC

CWE-459

Incomplete Cleanup

• CWE.459.LEAKS

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

• CWE.470.TDRFL
• CWE.470.APIBS

CWE-476

NULL Pointer Dereference

• CWE.476.NP

CWE-477

Use of Obsolete Function

• CWE.477.DPRAPI

CWE-478

Missing Default Case in Multiple Condition Expression

• CWE.478.PDS

CWE-481

Assigning instead of Comparing

• CWE.481.ASI

CWE-483

Incorrect Block Delimitation

• CWE.483.BLK
• CWE.483.EBI
• CWE.483.EB

CWE-484

Omitted Break Statement in Switch

• CWE.484.SBC
• CWE.484.DAV

CWE-486

Comparison of Classes by Name

• CWE.486.AUG
• CWE.486.CMP

CWE-487

Reliance on Package-level Scope

• CWE.487.AF

CWE-491

Public cloneable() Method Without Final ('Object Hijack')

• CWE.491.CLONE
• CWE.491.MCNC

CWE-492

Use of Inner Class Containing Sensitive Data

• CWE.492.INNER

CWE-495

Private Data Structure Returned From A Public Method

• CWE.495.RA

CWE-496

Public Data Assigned to Private Array-Typed Field

• CWE.496.CAP

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

• CWE.497.SENS
• CWE.497.PEO

CWE-499

Serializable Class Containing Sensitive Data

• CWE.499.SIF
• CWE.499.SER

CWE-500

Public Static Field Not Marked Final

• CWE.500.SPFF

CWE-501

Trust Boundary Violation

• CWE.501.TDSESSION

CWE-502

Deserialization of Untrusted Data

• CWE.502.SSSD
• CWE.502.MASP
• CWE.502.AUXD
• CWE.502.SC
• CWE.502.RWAF
• CWE.502.VOBD

CWE-506

Embedded Malicious Code

• CWE.506.HCCK

CWE-511

Logic/Time Bomb

• CWE.511.RDM

CWE-521

Weak Password Requirements

• CWE.521.MLVP

CWE-523

Unprotected Transport of Credentials

• CWE.523.USC

CWE-532

Insertion of Sensitive Information into Log File

• CWE.532.SENSLOG
• CWE.532.CONSEN

CWE-543

Use of Singleton Pattern Without Synchronization in a Multithreaded Context

• CWE.543.IASF
• CWE.543.ILI

CWE-546

Suspicious Comment

• CWE.546.TODOJAVA
• CWE.546.TODOPROP
• CWE.546.TODOXML

CWE-555

J2EE Misconfiguration: Plaintext Password in Configuration File

• CWE.555.PWDXML

CWE-561

Dead Code

• CWE.561.CC
• CWE.561.SWITCH
• CWE.561.PM

CWE-563

Assignment to Variable without Use

• CWE.563.VOVR
• CWE.563.UPPF
• CWE.563.AURV
• CWE.563.PF
• CWE.563.UP

CWE-568

finalize() Method Without super.finalize()

• CWE.568.FCF

CWE-570

Expression is Always False

• CWE.570.CC
• CWE.570.UCIF

CWE-571

Expression is Always True

• CWE.571.CC
• CWE.571.UCIF

CWE-572

Call to Thread run() instead of start()

• CWE.572.IRUN

CWE-576

EJB Bad Practices: Use of Java I/O

• CWE.576.JIO

CWE-577

EJB Bad Practices: Use of Sockets

• CWE.577.AUS

CWE-578

EJB Bad Practices: Use of Class Loader

• CWE.578.ACL

CWE-579

J2EE Bad Practices: Non-serializable Object Stored in Session

• CWE.579.ONS
• CWE.579.SNSO

CWE-580

clone() Method Without super.clone()

• CWE.580.SCLONE

CWE-581

Object Model Violation: Just One of Equals and Hashcode Defined

• CWE.581.OVERRIDE

CWE-582

Array Declared Public, Final, and Static

• CWE.582.IMM
• CWE.582.PSFA

CWE-583

finalize() Method Declared Public

• CWE.583.MFP

CWE-584

Return Inside Finally Block

• CWE.584.ARCF
• CWE.584.ATSF

CWE-585

Empty Synchronized Block

• CWE.585.SNE

CWE-586

Explicit Call to Finalize()

• CWE.586.NCF

CWE-594

J2EE Framework: Saving Unserializable Objects to Disk

• CWE.594.SIVS

CWE-595

Comparison of Object References Instead of Object Contents

• CWE.595.UEIC

CWE-600

Uncaught Exception in Servlet

• CWE.600.CETS

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

• CWE.601.TDNET
• CWE.601.TDRESP
• CWE.601.VRD
• CWE.601.UCO

CWE-605

Multiple Binds to the Same Port

• CWE.605.HCNA

CWE-607

Public Static Final Field References Mutable Object

• CWE.607.IMM
• CWE.607.RMO

CWE-609

Double-Checked Locking

• CWE.609.DCL

CWE-611

Improper Restriction of XML External Entity Reference

• CWE.611.XMLVAL
• CWE.611.DXXE

CWE-613

Insufficient Session Expiration

• CWE.613.RUIM
• CWE.613.STTL

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

• CWE.614.UOSC

CWE-617

Reachable Assertion

• CWE.617.ASSERT

CWE-643

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

• CWE.643.TDJXPATH
• CWE.643.TDXPATH

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

• CWE.644.TDRESP

CWE-652

Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

• CWE.652.TDXPATH
• CWE.652.XPIJ

CWE-662

Improper Synchronization

• CWE.662.DIFCS

CWE-667

Improper Locking

• CWE.667.LOCK
• CWE.667.CLOSE

CWE-674

Uncontrolled Recursion

• CWE.674.FLRC

CWE-676

Use of Potentially Dangerous Function

• CWE.676.SRD

CWE-680

Integer Overflow to Buffer Overflow

• CWE.680.BSA

CWE-681

Incorrect Conversion between Numeric Types

• CWE.681.INTVC
• CWE.681.CLP
• CWE.681.IDCD

CWE-691

Insufficient Control Flow Management

• CWE.691.ANL

CWE-704

Incorrect Type Conversion or Cast

• CWE.704.AGBPT
• CWE.704.CPTS

CWE-749

Exposed Dangerous Method or Function

• CWE.749.DPAM
• CWE.749.DPPM
• CWE.749.SPAM

CWE-755

Improper Handling of Exceptional Conditions

• CWE.755.CIET

CWE-759

Use of a One-Way Hash without a Salt

• CWE.759.MDSALT

CWE-764

Multiple Locks of a Critical Resource

• CWE.764.DLOCK

CWE-770

Allocation of Resources Without Limits or Throttling

• CWE.770.ISTART

CWE-771

Missing Reference to Active Allocated Resource

• CWE.771.LEAKS

CWE-772

Missing Release of Resource after Effective Lifetime

• CWE.772.LEAKS
• CWE.772.CLOSE

CWE-778

Insufficient Logging

• CWE.778.ENFL

CWE-787

Out-of-bounds Write

• CWE.787.ARRAY
• CWE.787.ARRAYSEC

CWE-789

Memory Allocation with Excessive Size Value

• CWE.789.TDALLOC

CWE-798

Use of Hard-coded Credentials

• CWE.798.HCCS

CWE-806

Buffer Access Using Size of Source Buffer

• CWE.806.BUSSB

CWE-807

Reliance on Untrusted Inputs in a Security Decision

• CWE.807.PLC
• CWE.807.HGRSI
• CWE.807.UOSC

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

• CWE.829.TDFILES
• CWE.829.TDFNAMES
• CWE.829.TDLIB
• CWE.829.TDXPATH

CWE-832

Unlock of a Resource that is not Locked

• CWE.832.LORD

CWE-833

Deadlock

• CWE.833.ORDER
• CWE.833.TSHL
• CWE.833.CSFS
• CWE.833.RLF
• CWE.833.STR
• CWE.833.UWNA

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

• CWE.835.PCIF
• CWE.835.AIL

CWE-836

Use of Password Hash Instead of Password for Authentication

• CWE.836.PLAIN

CWE-838

Inappropriate Encoding for Output Context

• CWE.838.SEO

CWE-841

Improper Enforcement of Behavioral Workflow

• CWE.841.PERMIT

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

• CWE.843.EQUS

CWE-862

Missing Authorization

• CWE.862.PERMIT
• CWE.862.LCA

CWE-863

Incorrect Authorization

• CWE.863.DSR
• CWE.863.SRCD

CWE-918

Server-Side Request Forgery (SSRF)

• CWE.918.TDNET

CWE-1004

Sensitive Cookie Without 'HttpOnly' Flag

• CWE.1004.SCHTTP

CWE-1046

Creation of Immutable Text Using String Concatenation

• CWE.1046.USB

CWE-1051

Initialization with Hard-Coded Network Resource Configuration Data

• CWE.1051.HCNA

CWE-1062

Parent Class with References to Child Class

• CWE.1062.RSFC

CWE-1066

Missing Serialization Control Element

• CWE.1066.OROM

CWE-1069

Empty Exception Block

• CWE.1069.AECB

CWE-1071

Empty Code Block

• CWE.1071.CEB

CWE-1075

Unconditional Control Flow Transfer outside of Switch Block

• CWE.1075.ABCL

CWE-1077

Floating Point Comparison with Incorrect Operator

• CWE.1077.DCF

CWE-1095

Loop Condition Value Update within the Loop

• CWE.1095.FLVA

CWE-1102

Reliance on Machine-Dependent Data Representation

• CWE.1102.DNHCP
• CWE.1102.LNSP
• CWE.1102.PEER

CWE-1106

Insufficient Use of Symbolic Constants

• CWE.1106.USN

CWE-1115

Source Code Element without Standard Prologue

• CWE.1115.MCH

CWE-1126

Declaration of Variable with Unnecessarily Wide Scope

• CWE.1126.DVCU

CWE-1235

Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations

• CWE.1235.ABUB

CWE-1385

Missing Origin Validation in WebSockets

• CWE.1385.WS

CWE-1428

Reliance on HTTP instead of HTTPS

• CWE.1428.UHTTPS