Versions Compared

Old Version 2

changes.mady.by.user Izabela Jarosz

Saved on

compared with

New Version Current

changes.mady.by.user Izabela Jarosz

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This section includes rule mapping for the CWE standard. The mapping information for other standards is available in the PDF rule mapping files shipped with Compliance Packs.

CWE Top 25 2025 Mapping

ID

Name/description

Parasoft rule ID(s)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE.79.EACM
  • CWE.79.TDDIG
  • CWE.79.TDRESP
  • CWE.79.TDXML
  • CWE.79.TDXSS
  • CWE.79.VPPD
  • CWE.79.ARXML

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  • CWE.89.TDSQL
  • CWE.89.UPS

CWE-352

Cross-Site Request Forgery (CSRF)

  • CWE.352.EACM
  • CWE.352.TDXSS
  • CWE.352.VPPD
  • CWE.352.UOSC
  • CWE.352.DCSRFJAVA
  • CWE.352.DCSRFXML
  • CWE.352.REQMAP

CWE-862

Missing Authorization

  • CWE.862.PERMIT
  • CWE.862.LCA

CWE-787

Out-of-bounds Write

  • CWE.787.ARRAY
  • CWE.787.ARRAYSEC

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE.22.TDFNAMES

CWE-416

Use After Free

  • CWE.416.FREE

CWE-125

Out-of-bounds Read

  • CWE.125.ARRAY
  • CWE.125.ARRAYSEC

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE.78.TDCMD

CWE-94

Improper Control of Generation of Code ('Code Injection')

  • CWE.94.TDCODE
  • CWE.94.DCEMSL
  • CWE.94.ASAPI

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • N/A

CWE-434

Unrestricted Upload of File with Dangerous Type

  • CWE.434.TDFNAMES

CWE-476

NULL Pointer Dereference

  • CWE.476.NP

CWE-121

Stack-based Buffer Overflow

  • N/A

CWE-502

Deserialization of Untrusted Data

  • CWE.502.MASP
  • CWE.502.AUXD
  • CWE.502.SC
  • CWE.502.VOBD

CWE-122

Heap-based Buffer Overflow

  • N/A

CWE-863

Incorrect Authorization

  • CWE.863.DSR
  • CWE.863.SRCD
  • CWE.863.SSMS

CWE-20

Improper Input Validation

  • CWE.20.ARRAY
  • CWE.20.INTWRAP
  • CWE.20.FREE
  • CWE.20.ARRAYSEC
  • CWE.20.TDFNAMES
  • CWE.20.TDINPUT
  • CWE.20.TDLIB
  • CWE.20.TDLOG
  • CWE.20.TDRESP
  • CWE.20.TDRFL
  • CWE.20.XMLVAL
  • CWE.20.BSA
  • CWE.20.CACO
  • CWE.20.ICO
  • CWE.20.IOF
  • CWE.20.CAI
  • CWE.20.NATV
  • CWE.20.SYSP
  • CWE.20.AEAF
  • CWE.20.CDBV
  • CWE.20.CSVFV
  • CWE.20.NATIW
  • CWE.20.APIBS
  • CWE.20.UCO
  • CWE.20.DFV
  • CWE.20.EV
  • CWE.20.PLUGIN

CWE-284

Improper Access Control

  • CWE.284.TDPASSWD
  • CWE.284.DPANY
  • CWE.284.PERMIT
  • CWE.284.DPAM
  • CWE.284.DPPM
  • CWE.284.SPAM
  • CWE.284.UPWD
  • CWE.284.UBSP
  • CWE.284.URRP
  • CWE.284.PLAIN
  • CWE.284.PCL
  • CWE.284.DSR
  • CWE.284.LCA
  • CWE.284.PCCF
  • CWE.284.PWDPROP
  • CWE.284.PWDXML
  • CWE.284.SRCD
  • CWE.284.UTAX
  • CWE.284.WCPWD
  • CWE.284.WPWD
  • CWE.284.ASNF
  • CWE.284.CFAP
  • CWE.284.CKTS
  • CWE.284.DNSL
  • CWE.284.HCCK
  • CWE.284.HCCS
  • CWE.284.HTTPRHA
  • CWE.284.HV
  • CWE.284.IDP
  • CWE.284.JXCORS
  • CWE.284.PBFA
  • CWE.284.SCHTTP
  • CWE.284.SSMS
  • CWE.284.UBA
  • CWE.284.USC
  • CWE.284.VSI
  • CWE.284.MLVP

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

  • CWE.200.SENS
  • CWE.200.SENSLOG
  • CWE.200.CONSEN
  • CWE.200.PEO
  • CWE.200.SIO
  • CWE.200.TCC
  • CWE.200.ACPST
  • CWE.200.EWSSEC

CWE-306

Missing Authentication for Critical Function

  • N/A

CWE-918

Server-Side Request Forgery (SSRF)

  • CWE.918.TDNET

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE.77.TDCMD

CWE-639

Authorization Bypass Through User-Controlled Key

  • N/A

CWE-770

Allocation of Resources Without Limits or Throttling

  • CWE.770.TDALLOC
  • CWE.770.ISTART

CWE Top 25 2024 Mapping

ID

Name/description

Parasoft rule ID(s)

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE.79.EACM
  • CWE.79.TDDIG
  • CWE.79.TDRESP
  • CWE.79.TDXML
  • CWE.79.TDXSS
  • CWE.79.VPPD
  • CWE.79.ARXML

CWE-787

Out-of-bounds Write

  • CWE.787.ARRAY
  • CWE.787.ARRAYSEC

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  • CWE.89.TDSQL
  • CWE.89.UPS

CWE-352

Cross-Site Request Forgery (CSRF)

  • CWE.352.EACM
  • CWE.352.TDXSS
  • CWE.352.VPPD
  • CWE.352.UOSC
  • CWE.352.DCSRFJAVA
  • CWE.352.DCSRFXML
  • CWE.352.REQMAP

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE.22.TDFNAMES

CWE-125

Out-of-bounds Read

  • CWE.125.ARRAY
  • CWE.125.ARRAYSEC

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE.78.TDCMD

CWE-416

Use After Free

  • CWE.416.FREE

CWE-862

Missing Authorization

  • CWE.862.PERMIT
  • CWE.862.LCA

CWE-434

Unrestricted Upload of File with Dangerous Type

  • CWE.434.TDFNAMES

CWE-94

Improper Control of Generation of Code ('Code Injection')

  • CWE.94.TDCODE
  • CWE.94.DCEMSL
  • CWE.94.ASAPI

CWE-20

Improper Input Validation

  • CWE.20.ARRAY
  • CWE.20.INTWRAP
  • CWE.20.FREE
  • CWE.20.ARRAYSEC
  • CWE.20.TDFNAMES
  • CWE.20.TDINPUT
  • CWE.20.TDLIB
  • CWE.20.TDLOG
  • CWE.20.TDRESP
  • CWE.20.TDRFL
  • CWE.20.XMLVAL
  • CWE.20.BSA
  • CWE.20.CACO
  • CWE.20.ICO
  • CWE.20.IOF
  • CWE.20.CAI
  • CWE.20.NATV
  • CWE.20.SYSP
  • CWE.20.AEAF
  • CWE.20.CDBV
  • CWE.20.CSVFV
  • CWE.20.NATIW
  • CWE.20.APIBS
  • CWE.20.UCO
  • CWE.20.DFV
  • CWE.20.EV
  • CWE.20.PLUGIN

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE.77.TDCMD

CWE-287

Improper Authentication

  • CWE.287.TDPASSWD
  • CWE.287.UPWD
  • CWE.287.PLAIN
  • CWE.287.PCCF
  • CWE.287.PWDPROP
  • CWE.287.PWDXML
  • CWE.287.UTAX
  • CWE.287.WCPWD
  • CWE.287.WPWD
  • CWE.287.CKTS
  • CWE.287.DNSL
  • CWE.287.HCCK
  • CWE.287.HCCS
  • CWE.287.HTTPRHA
  • CWE.287.HV
  • CWE.287.PBFA
  • CWE.287.USC
  • CWE.287.VSI
  • CWE.287.MLVP

CWE-269

Improper Privilege Management

  • CWE.269.DPANY
  • CWE.269.PCL

CWE-502

Deserialization of Untrusted Data

  • CWE.502.MASP
  • CWE.502.AUXD
  • CWE.502.SC
  • CWE.502.VOBD

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

  • CWE.200.SENS
  • CWE.200.SENSLOG
  • CWE.200.CONSEN
  • CWE.200.PEO
  • CWE.200.SIO
  • CWE.200.ACPST
  • CWE.200.EWSSEC

CWE-863

Incorrect Authorization

  • CWE.863.DSR
  • CWE.863.SRCD

CWE-918

Server-Side Request Forgery (SSRF)

  • CWE.918.TDNET

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE.119.ARRAY
  • CWE.119.FREE
  • CWE.119.ARRAYSEC

CWE-476

NULL Pointer Dereference

  • CWE.476.NP

CWE-798

Use of Hard-coded Credentials

  • CWE.798.HCCK
  • CWE.798.HCCS

CWE-190

Integer Overflow or Wraparound

  • CWE.190.INTWRAP
  • CWE.190.BSA
  • CWE.190.CACO
  • CWE.190.ICO
  • CWE.190.IOF

CWE-400

Uncontrolled Resource Consumption

  • CWE.400.LEAKS
  • CWE.400.TDALLOC
  • CWE.400.ABUB
  • CWE.400.USB
  • CWE.400.DMDS
  • CWE.400.ISTART

CWE-306

Missing Authentication for Critical Function

  • N/A

CWE Weaknesses On the Cusp 2025 Mapping

ID

Name/description

Parasoft rule ID(s)

CWE-266

Incorrect Privilege Assignment

  • CWE.266.DPANY

CWE-276

Incorrect Default Permissions

  • CWE.276.ASNF
  • CWE.276.CFAP

CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

  • N/A

CWE-269

Improper Privilege Management

  • CWE.269.DPANY
  • CWE.269.PCL

CWE-190

Integer Overflow or Wraparound

  • CWE.190.INTWRAP
  • CWE.190.BSA
  • CWE.190.CACO
  • CWE.190.ICO
  • CWE.190.IOF

CWE-287

Improper Authentication

  • CWE.287.TDPASSWD
  • CWE.287.UPWD
  • CWE.287.PLAIN
  • CWE.287.PCCF
  • CWE.287.PWDPROP
  • CWE.287.PWDXML
  • CWE.287.UTAX
  • CWE.287.WCPWD
  • CWE.287.WPWD
  • CWE.287.CKTS
  • CWE.287.DNSL
  • CWE.287.HCCK
  • CWE.287.HCCS
  • CWE.287.HTTPRHA
  • CWE.287.HV
  • CWE.287.PBFA
  • CWE.287.UBA
  • CWE.287.USC
  • CWE.287.VSI
  • CWE.287.MLVP

CWE-400

Uncontrolled Resource Consumption

  • CWE.400.LEAKS
  • CWE.400.TDALLOC
  • CWE.400.ABUB
  • CWE.400.USB
  • CWE.400.DMDS
  • CWE.400.ISTART

CWE-288

Authentication Bypass Using an Alternate Path or Channel

  • N/A

CWE-427

Uncontrolled Search Path Element

  • CWE.427.PBRTE

CWE-798

Use of Hard-coded Credentials

  • CWE.798.HCCK
  • CWE.798.HCCS

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE.362.TOCTOU
  • CWE.362.DCL

CWE-401

Missing Release of Memory after Effective Lifetime

  • N/A

CWE-732

Incorrect Permission Assignment for Critical Resource

  • CWE.732.ASNF
  • CWE.732.CFAP
  • CWE.732.IDP
  • CWE.732.SCHTTP

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE.119.ARRAY
  • CWE.119.FREE
  • CWE.119.ARRAYSEC

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

  • CWE.601.TDNET
  • CWE.601.VRD
  • CWE.601.UCO

CWE Weaknesses On the Cusp 2024 Mapping

ID

Name/description

Parasoft rule ID(s)

CWE-770

Allocation of Resources Without Limits or Throttling

  • CWE.770.TDALLOC
  • CWE.770.ISTART

CWE-668

Exposure of Resource to Wrong Sphere

  • CWE.668.SENS
  • CWE.668.SENSLOG
  • CWE.668.TDFNAMES
  • CWE.668.TDINPUT
  • CWE.668.TDLIB
  • CWE.668.TDPASSWD
  • CWE.668.ULI
  • CWE.668.RR
  • CWE.668.UPWD
  • CWE.668.MFP
  • CWE.668.IMM
  • CWE.668.PSFA
  • CWE.668.PLAIN
  • CWE.668.SYSP
  • CWE.668.SPFF
  • CWE.668.CONSEN
  • CWE.668.PEO
  • CWE.668.RA
  • CWE.668.SIF
  • CWE.668.SIO
  • CWE.668.ATF
  • CWE.668.PCCF
  • CWE.668.PWDPROP
  • CWE.668.PWDXML
  • CWE.668.UTAX
  • CWE.668.WCPWD
  • CWE.668.WPWD
  • CWE.668.ACPST
  • CWE.668.APIBS
  • CWE.668.ASNF
  • CWE.668.CFAP
  • CWE.668.CKTS
  • CWE.668.CLONE
  • CWE.668.EWSSEC
  • CWE.668.IDP
  • CWE.668.INNER
  • CWE.668.MCNC
  • CWE.668.PBRTE
  • CWE.668.SCHTTP
  • CWE.668.SER
  • CWE.668.USC
  • CWE.668.UCO

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE.74.EACM
  • CWE.74.TDCMD
  • CWE.74.TDCODE
  • CWE.74.TDDIG
  • CWE.74.TDFNAMES
  • CWE.74.TDJXPATH
  • CWE.74.TDLDAP
  • CWE.74.TDNET
  • CWE.74.TDRESP
  • CWE.74.TDSQL
  • CWE.74.TDXML
  • CWE.74.TDXPATH
  • CWE.74.TDXSS
  • CWE.74.VPPD
  • CWE.74.UPS
  • CWE.74.XPIJ
  • CWE.74.DCEMSL
  • CWE.74.ARXML
  • CWE.74.ASAPI
  • CWE.74.DFV

CWE-427

Uncontrolled Search Path Element

  • CWE.427.PBRTE

CWE-639

Authorization Bypass Through User-Controlled Key

  • N/A

CWE-532

Insertion of Sensitive Information into Log File

  • CWE.532.SENSLOG
  • CWE.532.CONSEN

CWE-732

Incorrect Permission Assignment for Critical Resource

  • CWE.732.ASNF
  • CWE.732.CFAP
  • CWE.732.IDP
  • CWE.732.SCHTTP

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

  • CWE.601.TDNET
  • CWE.601.VRD
  • CWE.601.UCO

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE.362.TOCTOU
  • CWE.362.DCL

CWE-522

Insufficiently Protected Credentials

  • CWE.522.TDPASSWD
  • CWE.522.UPWD
  • CWE.522.PLAIN
  • CWE.522.PCCF
  • CWE.522.PWDPROP
  • CWE.522.PWDXML
  • CWE.522.UTAX
  • CWE.522.WCPWD
  • CWE.522.WPWD
  • CWE.522.CKTS
  • CWE.522.USC

CWE-276

Incorrect Default Permissions

  • CWE.276.ASNF
  • CWE.276.CFAP

CWE-203

Observable Discrepancy

  • N/A

CWE-59

Improper Link Resolution Before File Access ('Link Following')

  • CWE.59.FOLLOW
  • CWE.59.LNK

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

  • N/A

CWE-312

Cleartext Storage of Sensitive Information

  • CWE.312.PLAIN
  • CWE.312.PLC
  • CWE.312.PWDPROP

CWE 4.20 Mapping

ID

Name/description

Parasoft rule ID(s)

CWE-6

J2EE Misconfiguration: Insufficient Session-ID Length

  • CWE.6.SLID

CWE-7

J2EE Misconfiguration: Missing Custom Error Page

  • CWE.7.SEP

CWE-8

J2EE Misconfiguration: Entity Bean Declared Remote

  • CWE.8.ULI
  • CWE.8.RR

CWE-9

J2EE Misconfiguration: Weak Access Permissions for EJB Methods

  • CWE.9.DPANY

CWE-15

External Control of System or Configuration Setting

  • CWE.15.SYSP
  • CWE.15.UCO

CWE-20

Improper Input Validation

  • CWE-111.NATV
  • CWE-111.NATIW
  • CWE-109.EV
  • CWE-106.PLUGIN
  • CWE-104.AEAF
  • CWE-102.DFV
  • CWE-103.CSVFV
  • CWE-134.TDINPUT
  • CWE-113.TDRESP
  • CWE-470.TDRFL
  • CWE-470.APIBS
  • CWE-190.INTWRAP
  • CWE-190.BSA
  • CWE-190.CACO
  • CWE-190.ICO
  • CWE-190.IOF
  • CWE-73.TDFNAMES
  • CWE-112.XMLVAL
  • CWE-114.TDLIB
  • CWE-114.APIBS
  • CWE-117.TDLOG
  • CWE-129.ARRAY
  • CWE-129.ARRAYSEC
  • CWE-129.CAI
  • CWE-15.SYSP
  • CWE-15.UCO

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE.22.TDFNAMES

CWE-59

Improper Link Resolution Before File Access ('Link Following')

  • CWE-64.LNK
  • CWE-61.FOLLOW

CWE-61

UNIX Symbolic Link (Symlink) Following

  • CWE.61.FOLLOW

CWE-64

Windows Shortcut Following (.LNK)

  • CWE.64.LNK

CWE-73

External Control of File Name or Path

  • CWE.73.TDFNAMES
  • CWE-114.TDLIB
  • CWE-114.APIBS

CWE-74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-89.TDSQL
  • CWE-89.UPS
  • CWE-99.TDFNAMES
  • CWE-99.TDNET
  • CWE-94.DCEMSL
  • CWE-94.ASAPI
  • CWE-79.EACM
  • CWE-79.TDRESP
  • CWE-79.TDXSS
  • CWE-79.VPPD
  • CWE-78.TDCMD
  • CWE-91.TDXML

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE-78.TDCMD

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE.78.TDCMD

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE.79.EACM
  • CWE.79.TDRESP
  • CWE.79.TDXSS
  • CWE.79.VPPD
  • CWE-83.ARXML
  • CWE-80.TDDIG
  • CWE-80.TDXML
  • CWE-80.ARXML
  • CWE-81.ARXML

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

  • CWE.80.TDDIG
  • CWE.80.TDXML
  • CWE.80.ARXML

CWE-81

Improper Neutralization of Script in an Error Message Web Page

  • CWE.81.ARXML

CWE-83

Improper Neutralization of Script in Attributes in a Web Page

  • CWE.83.ARXML

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  • CWE.89.TDSQL
  • CWE.89.UPS

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

  • CWE.90.TDLDAP

CWE-91

XML Injection (aka Blind XPath Injection)

  • CWE.91.TDXML
  • CWE-652.TDXPATH
  • CWE-643.TDJXPATH
  • CWE-643.TDXPATH
  • CWE-643.XPIJ

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

  • CWE-113.TDRESP

CWE-94

Improper Control of Generation of Code ('Code Injection')

  • CWE.94.DCEMSL
  • CWE.94.ASAPI
  • CWE-95.TDCODE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

  • CWE.95.TDCODE

CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

  • CWE.99.TDFNAMES
  • CWE.99.TDNET

CWE-102

Struts: Duplicate Validation Forms

  • CWE.102.DFV

CWE-103

Struts: Incomplete validate() Method Definition

  • CWE.103.CSVFV

CWE-104

Struts: Form Bean Does Not Extend Validation Class

  • CWE.104.AEAF

CWE-106

Struts: Plug-in Framework not in Use

  • CWE.106.PLUGIN

CWE-109

Struts: Validator Turned Off

  • CWE.109.EV

CWE-111

Direct Use of Unsafe JNI

  • CWE.111.NATV
  • CWE.111.NATIW

CWE-112

Missing XML Validation

  • CWE.112.XMLVAL

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

  • CWE.113.TDRESP

CWE-114

Process Control

  • CWE.114.TDLIB
  • CWE.114.APIBS

CWE-116

Improper Encoding or Escaping of Output

  • CWE-644.TDRESP
  • CWE-838.SEO
  • CWE-117.TDLOG

CWE-117

Improper Output Neutralization for Logs

  • CWE.117.TDLOG

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE-125.ARRAY
  • CWE-125.ARRAYSEC
  • CWE-787.ARRAY
  • CWE-787.ARRAYSEC

CWE-125

Out-of-bounds Read

  • CWE.125.ARRAY
  • CWE.125.ARRAYSEC

CWE-128

Wrap-around Error

  • CWE.128.CACO

CWE-129

Improper Validation of Array Index

  • CWE.129.ARRAY
  • CWE.129.ARRAYSEC
  • CWE.129.CAI

CWE-131

Incorrect Calculation of Buffer Size

  • CWE.131.ARRAY

CWE-134

Use of Externally-Controlled Format String

  • CWE.134.TDINPUT

CWE-172

Encoding Error

  • CWE-173.SEO
  • CWE-176.NCUCP

CWE-173

Improper Handling of Alternate Encoding

  • CWE.173.SEO

CWE-176

Improper Handling of Unicode Encoding

  • CWE.176.NCUCP

CWE-179

Incorrect Behavior Order: Early Validation

  • CWE-180.CDBV

CWE-180

Incorrect Behavior Order: Validate Before Canonicalize

  • CWE.180.CDBV

CWE-185

Incorrect Regular Expression

  • CWE.185.REP

CWE-188

Reliance on Data/Memory Layout

  • CWE-198.PMRWLED

CWE-190

Integer Overflow or Wraparound

  • CWE.190.INTWRAP
  • CWE.190.BSA
  • CWE.190.CACO
  • CWE.190.ICO
  • CWE.190.IOF

CWE-191

Integer Underflow (Wrap or Wraparound)

  • CWE.191.INTWRAP
  • CWE.191.BSA

CWE-193

Off-by-one Error

  • CWE.193.AOBO

CWE-197

Numeric Truncation Error

  • CWE.197.INTDL

CWE-198

Use of Incorrect Byte Ordering

  • CWE.198.PMRWLED

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

  • CWE-532.SENSLOG
  • CWE-532.CONSEN
  • CWE-359.CONSEN
  • CWE-497.SENS
  • CWE-497.PEO
  • CWE-213.CONSEN
  • CWE-215.EWSSEC
  • CWE-209.SENS
  • CWE-209.PEO
  • CWE-209.SIO
  • CWE-209.ACPST

CWE-203

Observable Discrepancy

  • CWE-204.TCC

CWE-204

Observable Response Discrepancy

  • CWE.204.TCC

CWE-209

Generation of Error Message Containing Sensitive Information

  • CWE.209.SENS
  • CWE.209.PEO
  • CWE.209.SIO
  • CWE.209.ACPST

CWE-213

Exposure of Sensitive Information Due to Incompatible Policies

  • CWE.213.CONSEN

CWE-215

Insertion of Sensitive Information Into Debugging Code

  • CWE.215.EWSSEC

CWE-221

Information Loss or Omission

  • CWE-397.NTX
  • CWE-397.NTERR
  • CWE-396.NCE

CWE-223

Omission of Security-relevant Information

  • CWE-778.ENFL

CWE-245

J2EE Bad Practices: Direct Management of Connections

  • CWE.245.JDBCTEMPLATE

CWE-246

J2EE Bad Practices: Direct Use of Sockets

  • CWE.246.AUS
  • CWE.246.NSF
  • CWE.246.SS

CWE-248

Uncaught Exception

  • CWE.248.EXCEPT
  • CWE-600.CETS

CWE-250

Execution with Unnecessary Privileges

  • CWE.250.PCL

CWE-252

Unchecked Return Value

  • CWE.252.CHECKRET
  • CWE.252.CRRV

CWE-256

Plaintext Storage of a Password

  • CWE.256.TDPASSWD
  • CWE.256.UPWD
  • CWE.256.PLAIN
  • CWE.256.PCCF
  • CWE.256.PWDPROP
  • CWE.256.PWDXML
  • CWE.256.UTAX
  • CWE.256.WCPWD
  • CWE.256.WPWD

CWE-258

Empty Password in Configuration File

  • CWE.258.PWDPROP

CWE-260

Password in Configuration File

  • CWE.260.UTAX
  • CWE-555.PWDXML
  • CWE-258.PWDPROP

CWE-261

Weak Encoding for Password

  • CWE.261.CKTS

CWE-266

Incorrect Privilege Assignment

  • CWE-9.DPANY

CWE-269

Improper Privilege Management

  • CWE-250.PCL

CWE-276

Incorrect Default Permissions

  • CWE.276.ASNF
  • CWE.276.CFAP

CWE-279

Incorrect Execution-Assigned Permissions

  • CWE.279.IDP

CWE-284

Improper Access Control

  • CWE-863.DSR
  • CWE-863.SRCD
  • CWE-863.SSMS
  • CWE-862.PERMIT
  • CWE-862.LCA
  • CWE-749.DPAM
  • CWE-749.DPPM
  • CWE-749.SPAM
  • CWE-346.JXCORS

CWE-285

Improper Authorization

  • CWE-927.UBSP
  • CWE-863.DSR
  • CWE-863.SRCD
  • CWE-863.SSMS
  • CWE-862.PERMIT
  • CWE-862.LCA

CWE-287

Improper Authentication

  • CWE-521.MLVP
  • CWE-798.HCCS
  • CWE-290.HTTPRHA
  • CWE-295.HV
  • CWE-307.PBFA

CWE-290

Authentication Bypass by Spoofing

  • CWE.290.HTTPRHA
  • CWE-350.DNSL

CWE-295

Improper Certificate Validation

  • CWE.295.HV
  • CWE-297.VSI

CWE-297

Improper Validation of Certificate with Host Mismatch

  • CWE.297.VSI

CWE-305

Authentication Bypass by Primary Weakness

  • CWE.305.UBA

CWE-307

Improper Restriction of Excessive Authentication Attempts

  • CWE.307.PBFA

CWE-311

Missing Encryption of Sensitive Data

  • CWE.311.PWDXML
  • CWE-312.PWDPROP
  • CWE-319.WS
  • CWE-319.HTTPS
  • CWE-319.PTPT
  • CWE-319.USC

CWE-312

Cleartext Storage of Sensitive Information

  • CWE.312.PWDPROP
  • CWE-315.PLC
  • CWE-313.PLAIN

CWE-313

Cleartext Storage in a File or on Disk

  • CWE.313.PLAIN

CWE-315

Cleartext Storage of Sensitive Information in a Cookie

  • CWE.315.PLC

CWE-319

Cleartext Transmission of Sensitive Information

  • CWE.319.WS
  • CWE.319.HTTPS
  • CWE.319.PTPT
  • CWE.319.USC
  • CWE-614.UOSC
  • CWE-1428.UHTTPS

CWE-321

Use of Hard-coded Cryptographic Key

  • CWE.321.HCCK

CWE-325

Missing Cryptographic Step

  • CWE.325.MCMDU
  • CWE.325.SIKG

CWE-326

Inadequate Encryption Strength

  • CWE.326.CKTS
  • CWE-328.AISSAJAVA
  • CWE-328.AISSAXML
  • CWE-328.ICA

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

  • CWE.327.ACMD
  • CWE.327.AUNC
  • CWE-328.AISSAJAVA
  • CWE-328.AISSAXML
  • CWE-328.ICA

CWE-328

Use of Weak Hash

  • CWE.328.AISSAJAVA
  • CWE.328.AISSAXML
  • CWE.328.ICA

CWE-329

Generation of Predictable IV with CBC Mode

  • CWE.329.ENPP
  • CWE.329.IVR

CWE-330

Use of Insufficiently Random Values

  • CWE-338.SRD

CWE-334

Small Space of Random Values

  • CWE-6.SLID

CWE-335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

  • CWE-337.ENPP
  • CWE-336.ENPP

CWE-336

Same Seed in Pseudo-Random Number Generator (PRNG)

  • CWE.336.ENPP

CWE-337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

  • CWE.337.ENPP

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

  • CWE.338.SRD

CWE-344

Use of Invariant Value in Dynamically Changing Context

  • CWE-798.HCCS

CWE-345

Insufficient Verification of Data Authenticity

  • CWE-352.EACM
  • CWE-352.TDXSS
  • CWE-352.VPPD
  • CWE-352.UOSC
  • CWE-352.DCSRFJAVA
  • CWE-352.DCSRFXML
  • CWE-352.REQMAP
  • CWE-346.JXCORS
  • CWE-347.VJFS

CWE-346

Origin Validation Error

  • CWE.346.JXCORS

CWE-347

Improper Verification of Cryptographic Signature

  • CWE.347.VJFS

CWE-350

Reliance on Reverse DNS Resolution for a Security-Critical Action

  • CWE.350.DNSL

CWE-352

Cross-Site Request Forgery (CSRF)

  • CWE.352.EACM
  • CWE.352.TDXSS
  • CWE.352.VPPD
  • CWE.352.UOSC
  • CWE.352.DCSRFJAVA
  • CWE.352.DCSRFXML
  • CWE.352.REQMAP

CWE-359

Exposure of Private Personal Information to an Unauthorized Actor

  • CWE.359.CONSEN

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE.362.DCL
  • CWE-367.TOCTOU

CWE-367

Time-of-check Time-of-use (TOCTOU) Race Condition

  • CWE.367.TOCTOU

CWE-369

Divide By Zero

  • CWE.369.ZERO

CWE-375

Returning a Mutable Object to an Untrusted Caller

  • CWE.375.RA

CWE-377

Insecure Temporary File

  • CWE.377.ATF

CWE-382

J2EE Bad Practices: Use of System.exit()

  • CWE.382.EXIT
  • CWE.382.JVM

CWE-383

J2EE Bad Practices: Direct Use of Threads

  • CWE.383.THREAD
  • CWE.383.THR

CWE-384

Session Fixation

  • CWE.384.ISL

CWE-390

Detection of Error Condition Without Action

  • CWE.390.LGE

CWE-391

Unchecked Error Condition

  • CWE.391.AECB

CWE-395

Use of NullPointerException Catch to Detect NULL Pointer Dereference

  • CWE.395.NCNPE

CWE-396

Declaration of Catch for Generic Exception

  • CWE.396.NCE

CWE-397

Declaration of Throws for Generic Exception

  • CWE.397.NTX
  • CWE.397.NTERR

CWE-400

Uncontrolled Resource Consumption

  • CWE.400.DMDS
  • CWE-771.LEAKS
  • CWE-770.ISTART
  • CWE-1235.ABUB

CWE-404

Improper Resource Shutdown or Release

  • CWE.404.COCO
  • CWE-772.LEAKS
  • CWE-772.CLOSE
  • CWE-459.LEAKS

CWE-412

Unrestricted Externally Accessible Lock

  • CWE.412.SUL

CWE-413

Improper Resource Locking

  • CWE.413.LORD

CWE-416

Use After Free

  • CWE.416.FREE

CWE-427

Uncontrolled Search Path Element

  • CWE.427.PBRTE

CWE-434

Unrestricted Upload of File with Dangerous Type

  • CWE.434.TDFNAMES

CWE-436

Interpretation Conflict

  • CWE-113.TDRESP

CWE-441

Unintended Proxy or Intermediary ('Confused Deputy')

  • CWE-918.TDNET

CWE-456

Missing Initialization of a Variable

  • CWE.456.LV

CWE-457

Use of Uninitialized Variable

  • CWE.457.NP
  • CWE.457.NOTEXPLINIT
  • CWE.457.NOTINITCTOR
  • CWE.457.UIRC

CWE-459

Incomplete Cleanup

  • CWE.459.LEAKS
  • CWE-568.FCF

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

  • CWE.470.TDRFL
  • CWE.470.APIBS

CWE-471

Modification of Assumed-Immutable Data (MAID)

  • CWE-607.IMM
  • CWE-607.RMO

CWE-476

NULL Pointer Dereference

  • CWE.476.NP

CWE-477

Use of Obsolete Function

  • CWE.477.DPRAPI

CWE-478

Missing Default Case in Multiple Condition Expression

  • CWE.478.PDS

CWE-480

Use of Incorrect Operator

  • CWE-481.ASI

CWE-481

Assigning instead of Comparing

  • CWE.481.ASI

CWE-483

Incorrect Block Delimitation

  • CWE.483.BLK
  • CWE.483.EBI
  • CWE.483.EB

CWE-484

Omitted Break Statement in Switch

  • CWE.484.SBC
  • CWE.484.DAV

CWE-486

Comparison of Classes by Name

  • CWE.486.AUG
  • CWE.486.CMP

CWE-487

Reliance on Package-level Scope

  • CWE.487.AF

CWE-489

Active Debug Code

  • CWE.489.WVDBG

CWE-491

Public cloneable() Method Without Final ('Object Hijack')

  • CWE.491.CLONE
  • CWE.491.MCNC

CWE-492

Use of Inner Class Containing Sensitive Data

  • CWE.492.INNER

CWE-493

Critical Public Variable Without Final Modifier

  • CWE-500.SPFF

CWE-495

Private Data Structure Returned From A Public Method

  • CWE.495.RA

CWE-496

Public Data Assigned to Private Array-Typed Field

  • CWE.496.CAP

CWE-497

Exposure of Sensitive System Information to an Unauthorized Control Sphere

  • CWE.497.SENS
  • CWE.497.PEO

CWE-499

Serializable Class Containing Sensitive Data

  • CWE.499.SIF
  • CWE.499.SER

CWE-500

Public Static Field Not Marked Final

  • CWE.500.SPFF

CWE-501

Trust Boundary Violation

  • CWE.501.TDSESSION

CWE-502

Deserialization of Untrusted Data

  • CWE.502.MASP
  • CWE.502.AUXD
  • CWE.502.SC
  • CWE.502.VOBD

CWE-506

Embedded Malicious Code

  • CWE-511.RDM

CWE-511

Logic/Time Bomb

  • CWE.511.RDM

CWE-521

Weak Password Requirements

  • CWE.521.MLVP
  • CWE-258.PWDPROP

CWE-522

Insufficiently Protected Credentials

  • CWE-523.USC
  • CWE-261.CKTS
  • CWE-260.UTAX
  • CWE-256.TDPASSWD
  • CWE-256.UPWD
  • CWE-256.PLAIN
  • CWE-256.PCCF
  • CWE-256.PWDPROP
  • CWE-256.PWDXML
  • CWE-256.UTAX
  • CWE-256.WCPWD
  • CWE-256.WPWD

CWE-523

Unprotected Transport of Credentials

  • CWE.523.USC

CWE-532

Insertion of Sensitive Information into Log File

  • CWE.532.SENSLOG
  • CWE.532.CONSEN

CWE-538

Insertion of Sensitive Information into Externally-Accessible File or Directory

  • CWE-532.SENSLOG
  • CWE-532.CONSEN

CWE-543

Use of Singleton Pattern Without Synchronization in a Multithreaded Context

  • CWE.543.IASF
  • CWE.543.ILI

CWE-546

Suspicious Comment

  • CWE.546.TODOJAVA
  • CWE.546.TODOPROP
  • CWE.546.TODOXML

CWE-555

J2EE Misconfiguration: Plaintext Password in Configuration File

  • CWE.555.PWDXML

CWE-561

Dead Code

  • CWE.561.CC
  • CWE.561.SWITCH
  • CWE.561.PM

CWE-563

Assignment to Variable without Use

  • CWE.563.VOVR
  • CWE.563.UPPF
  • CWE.563.AURV
  • CWE.563.PF
  • CWE.563.UP

CWE-568

finalize() Method Without super.finalize()

  • CWE.568.FCF

CWE-570

Expression is Always False

  • CWE.570.CC
  • CWE.570.UCIF

CWE-571

Expression is Always True

  • CWE.571.CC
  • CWE.571.UCIF

CWE-572

Call to Thread run() instead of start()

  • CWE.572.IRUN

CWE-573

Improper Following of Specification by Caller

  • CWE-581.OVERRIDE
  • CWE-104.AEAF
  • CWE-103.CSVFV
  • CWE-577.AUS
  • CWE-580.SCLONE
  • CWE-325.MCMDU
  • CWE-325.SIKG
  • CWE-568.FCF
  • CWE-579.ONS
  • CWE-579.SNSO
  • CWE-578.ACL
  • CWE-329.ENPP
  • CWE-329.IVR

CWE-576

EJB Bad Practices: Use of Java I/O

  • CWE.576.JIO

CWE-577

EJB Bad Practices: Use of Sockets

  • CWE.577.AUS

CWE-578

EJB Bad Practices: Use of Class Loader

  • CWE.578.ACL

CWE-579

J2EE Bad Practices: Non-serializable Object Stored in Session

  • CWE.579.ONS
  • CWE.579.SNSO

CWE-580

clone() Method Without super.clone()

  • CWE.580.SCLONE

CWE-581

Object Model Violation: Just One of Equals and Hashcode Defined

  • CWE.581.OVERRIDE

CWE-582

Array Declared Public, Final, and Static

  • CWE.582.IMM
  • CWE.582.PSFA

CWE-583

finalize() Method Declared Public

  • CWE.583.MFP

CWE-584

Return Inside Finally Block

  • CWE.584.ARCF
  • CWE.584.ATSF

CWE-585

Empty Synchronized Block

  • CWE.585.SNE

CWE-586

Explicit Call to Finalize()

  • CWE.586.NCF

CWE-594

J2EE Framework: Saving Unserializable Objects to Disk

  • CWE.594.SIVS

CWE-595

Comparison of Object References Instead of Object Contents

  • CWE.595.UEIC

CWE-600

Uncaught Exception in Servlet

  • CWE.600.CETS

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

  • CWE.601.TDNET
  • CWE.601.VRD
  • CWE.601.UCO

CWE-605

Multiple Binds to the Same Port

  • CWE.605.HCNA

CWE-607

Public Static Final Field References Mutable Object

  • CWE.607.IMM
  • CWE.607.RMO

CWE-609

Double-Checked Locking

  • CWE.609.DCL

CWE-610

Externally Controlled Reference to a Resource in Another Sphere

  • CWE-73.TDFNAMES
  • CWE-601.TDNET
  • CWE-601.VRD
  • CWE-601.UCO
  • CWE-470.TDRFL
  • CWE-470.APIBS
  • CWE-918.TDNET
  • CWE-15.SYSP
  • CWE-15.UCO
  • CWE-384.ISL
  • CWE-611.XMLVAL
  • CWE-611.DXXE

CWE-611

Improper Restriction of XML External Entity Reference

  • CWE.611.XMLVAL
  • CWE.611.DXXE

CWE-613

Insufficient Session Expiration

  • CWE.613.RUIM
  • CWE.613.STTL

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

  • CWE.614.UOSC

CWE-617

Reachable Assertion

  • CWE.617.ASSERT

CWE-642

External Control of Critical State Data

  • CWE-15.SYSP
  • CWE-15.UCO
  • CWE-73.TDFNAMES

CWE-643

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

  • CWE.643.TDJXPATH
  • CWE.643.TDXPATH
  • CWE.643.XPIJ

CWE-644

Improper Neutralization of HTTP Headers for Scripting Syntax

  • CWE.644.TDRESP

CWE-652

Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

  • CWE.652.TDXPATH

CWE-657

Violation of Secure Design Principles

  • CWE-250.PCL

CWE-662

Improper Synchronization

  • CWE.662.DIFCS
  • CWE-543.IASF
  • CWE-543.ILI
  • CWE-362.DCL
  • CWE-833.ORDER
  • CWE-833.CSFS
  • CWE-833.LORD
  • CWE-833.RLF
  • CWE-833.STR
  • CWE-833.UWNA
  • CWE-764.DLOCK
  • CWE-667.LOCK
  • CWE-667.TSHL
  • CWE-667.CLOSE

CWE-664

Improper Control of a Resource Through its Lifetime

  • CWE-487.AF
  • CWE-580.SCLONE
  • CWE-662.DIFCS
  • CWE-704.AGBPT
  • CWE-495.RA
  • CWE-496.CAP
  • CWE-400.DMDS
  • CWE-404.COCO
  • CWE-501.TDSESSION

CWE-665

Improper Initialization

  • CWE-456.LV
  • CWE-770.ISTART
  • CWE-457.NP
  • CWE-457.NOTEXPLINIT
  • CWE-457.NOTINITCTOR
  • CWE-457.UIRC

CWE-666

Operation on Resource in Wrong Phase of Lifetime

  • CWE-605.HCNA

CWE-667

Improper Locking

  • CWE.667.LOCK
  • CWE.667.TSHL
  • CWE.667.CLOSE
  • CWE-412.SUL
  • CWE-413.LORD
  • CWE-833.ORDER
  • CWE-833.CSFS
  • CWE-833.LORD
  • CWE-833.RLF
  • CWE-833.STR
  • CWE-833.UWNA
  • CWE-609.DCL
  • CWE-764.DLOCK

CWE-668

Exposure of Resource to Wrong Sphere

  • CWE-375.RA
  • CWE-377.ATF
  • CWE-927.UBSP
  • CWE-499.SIF
  • CWE-499.SER
  • CWE-134.TDINPUT
  • CWE-491.CLONE
  • CWE-491.MCNC
  • CWE-492.INNER
  • CWE-427.PBRTE
  • CWE-8.ULI
  • CWE-8.RR
  • CWE-582.IMM
  • CWE-582.PSFA
  • CWE-583.MFP

CWE-669

Incorrect Resource Transfer Between Spheres

  • CWE-829.TDFILES
  • CWE-829.TDLIB
  • CWE-829.TDXPATH
  • CWE-434.TDFNAMES

CWE-670

Always-Incorrect Control Flow Implementation

  • CWE-483.BLK
  • CWE-483.EBI
  • CWE-483.EB
  • CWE-484.SBC
  • CWE-484.DAV
  • CWE-617.ASSERT

CWE-671

Lack of Administrator Control over Security

  • CWE-798.HCCS

CWE-672

Operation on a Resource after Expiration or Release

  • CWE-416.FREE
  • CWE-613.RUIM
  • CWE-613.STTL

CWE-674

Uncontrolled Recursion

  • CWE.674.FLRC

CWE-675

Multiple Operations on Resource in Single-Operation Context

  • CWE-764.DLOCK
  • CWE-605.HCNA

CWE-676

Use of Potentially Dangerous Function

  • CWE.676.SRD

CWE-681

Incorrect Conversion between Numeric Types

  • CWE.681.INTDL
  • CWE.681.INTVC
  • CWE.681.CLP
  • CWE.681.IDCD
  • CWE-197.INTDL

CWE-682

Incorrect Calculation

  • CWE-369.ZERO
  • CWE-131.ARRAY
  • CWE-128.CACO
  • CWE-191.INTWRAP
  • CWE-191.BSA
  • CWE-190.INTWRAP
  • CWE-190.BSA
  • CWE-190.CACO
  • CWE-190.ICO
  • CWE-190.IOF
  • CWE-193.AOBO

CWE-691

Insufficient Control Flow Management

  • CWE-662.DIFCS

CWE-693

Protection Mechanism Failure

  • CWE-807.HGRSI
  • CWE-311.PWDXML
  • CWE-327.ACMD
  • CWE-327.AUNC
  • CWE-326.CKTS

CWE-694

Use of Multiple Resources with Duplicate Identifier

  • CWE-102.DFV

CWE-695

Use of Low-Level Functionality

  • CWE-111.NATV
  • CWE-111.NATIW
  • CWE-245.JDBCTEMPLATE
  • CWE-383.THREAD
  • CWE-383.THR
  • CWE-246.AUS
  • CWE-246.NSF
  • CWE-246.SS
  • CWE-576.JIO

CWE-697

Incorrect Comparison

  • CWE-185.REP
  • CWE-581.OVERRIDE
  • CWE-1077.DCF

CWE-703

Improper Check or Handling of Exceptional Conditions

  • CWE-397.NTX
  • CWE-397.NTERR
  • CWE-391.AECB
  • CWE-248.EXCEPT
  • CWE-755.CIET

CWE-704

Incorrect Type Conversion or Cast

  • CWE.704.AGBPT
  • CWE-681.INTDL
  • CWE-681.INTVC
  • CWE-681.CLP
  • CWE-681.IDCD

CWE-705

Incorrect Control Flow Scoping

  • CWE-397.NTX
  • CWE-397.NTERR
  • CWE-396.NCE
  • CWE-395.NCNPE
  • CWE-382.EXIT
  • CWE-382.JVM
  • CWE-248.EXCEPT
  • CWE-584.ARCF
  • CWE-584.ATSF
  • CWE-617.ASSERT

CWE-706

Use of Incorrectly-Resolved Name or Reference

  • CWE-22.TDFNAMES

CWE-710

Improper Adherence to Coding Standards

  • CWE-489.WVDBG
  • CWE-484.SBC
  • CWE-484.DAV
  • CWE-476.NP
  • CWE-477.DPRAPI
  • CWE-571.CC
  • CWE-571.UCIF
  • CWE-570.CC
  • CWE-570.UCIF
  • CWE-1066.OROM
  • CWE-1126.DVCU

CWE-732

Incorrect Permission Assignment for Critical Resource

  • CWE-276.ASNF
  • CWE-276.CFAP
  • CWE-1004.SCHTTP
  • CWE-279.IDP

CWE-749

Exposed Dangerous Method or Function

  • CWE.749.DPAM
  • CWE.749.DPPM
  • CWE.749.SPAM

CWE-754

Improper Check for Unusual or Exceptional Conditions

  • CWE-476.NP
  • CWE-391.AECB
  • CWE-252.CHECKRET
  • CWE-252.CRRV

CWE-755

Improper Handling of Exceptional Conditions

  • CWE.755.CIET
  • CWE-396.NCE
  • CWE-395.NCNPE
  • CWE-390.LGE
  • CWE-248.EXCEPT
  • CWE-209.SENS
  • CWE-209.PEO
  • CWE-209.SIO
  • CWE-209.ACPST

CWE-756

Missing Custom Error Page

  • CWE-7.SEP

CWE-758

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

  • CWE-1102.DNHCP
  • CWE-1102.LNSP
  • CWE-1102.PEER

CWE-759

Use of a One-Way Hash without a Salt

  • CWE.759.MDSALT

CWE-764

Multiple Locks of a Critical Resource

  • CWE.764.DLOCK

CWE-770

Allocation of Resources Without Limits or Throttling

  • CWE.770.ISTART
  • CWE-789.TDALLOC

CWE-771

Missing Reference to Active Allocated Resource

  • CWE.771.LEAKS

CWE-772

Missing Release of Resource after Effective Lifetime

  • CWE.772.LEAKS
  • CWE.772.CLOSE

CWE-778

Insufficient Logging

  • CWE.778.ENFL

CWE-787

Out-of-bounds Write

  • CWE.787.ARRAY
  • CWE.787.ARRAYSEC

CWE-789

Memory Allocation with Excessive Size Value

  • CWE.789.TDALLOC

CWE-798

Use of Hard-coded Credentials

  • CWE.798.HCCS
  • CWE-321.HCCK

CWE-799

Improper Control of Interaction Frequency

  • CWE-307.PBFA

CWE-807

Reliance on Untrusted Inputs in a Security Decision

  • CWE.807.HGRSI
  • CWE-350.DNSL

CWE-820

Missing Synchronization

  • CWE-543.IASF
  • CWE-543.ILI

CWE-821

Incorrect Synchronization

  • CWE-572.IRUN

CWE-825

Expired Pointer Dereference

  • CWE-416.FREE

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

  • CWE.829.TDFILES
  • CWE.829.TDLIB
  • CWE.829.TDXPATH

CWE-833

Deadlock

  • CWE.833.ORDER
  • CWE.833.CSFS
  • CWE.833.LORD
  • CWE.833.RLF
  • CWE.833.STR
  • CWE.833.UWNA

CWE-834

Excessive Iteration

  • CWE-674.FLRC
  • CWE-835.PCIF
  • CWE-835.AIL

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

  • CWE.835.PCIF
  • CWE.835.AIL

CWE-838

Inappropriate Encoding for Output Context

  • CWE.838.SEO

CWE-862

Missing Authorization

  • CWE.862.PERMIT
  • CWE.862.LCA

CWE-863

Incorrect Authorization

  • CWE.863.DSR
  • CWE.863.SRCD
  • CWE.863.SSMS

CWE-908

Use of Uninitialized Resource

  • CWE-457.NP
  • CWE-457.NOTEXPLINIT
  • CWE-457.NOTINITCTOR
  • CWE-457.UIRC

CWE-909

Missing Initialization of Resource

  • CWE-456.LV

CWE-913

Improper Control of Dynamically-Managed Code Resources

  • CWE-470.TDRFL
  • CWE-470.APIBS
  • CWE-502.MASP
  • CWE-502.AUXD
  • CWE-502.SC
  • CWE-502.VOBD
  • CWE-94.DCEMSL
  • CWE-94.ASAPI

CWE-916

Use of Password Hash With Insufficient Computational Effort

  • CWE-759.MDSALT

CWE-918

Server-Side Request Forgery (SSRF)

  • CWE.918.TDNET

CWE-922

Insecure Storage of Sensitive Information

  • CWE-312.PWDPROP

CWE-923

Improper Restriction of Communication Channel to Intended Endpoints

  • CWE-297.VSI

CWE-925

Improper Verification of Intent by Broadcast Receiver

  • CWE.925.URRP

CWE-927

Use of Implicit Intent for Sensitive Communication

  • CWE.927.UBSP

CWE-940

Improper Verification of Source of a Communication Channel

  • CWE-925.URRP

CWE-943

Improper Neutralization of Special Elements in Data Query Logic

  • CWE-652.TDXPATH
  • CWE-90.TDLDAP
  • CWE-643.TDJXPATH
  • CWE-643.TDXPATH
  • CWE-643.XPIJ
  • CWE-89.TDSQL
  • CWE-89.UPS

CWE-1004

Sensitive Cookie Without 'HttpOnly' Flag

  • CWE.1004.SCHTTP

CWE-1023

Incomplete Comparison with Missing Factors

  • CWE-478.PDS

CWE-1025

Comparison Using Wrong Factors

  • CWE-595.UEIC
  • CWE-486.AUG
  • CWE-486.CMP

CWE-1046

Creation of Immutable Text Using String Concatenation

  • CWE.1046.USB

CWE-1051

Initialization with Hard-Coded Network Resource Configuration Data

  • CWE.1051.HCNA

CWE-1061

Insufficient Encapsulation

  • CWE-1062.RSFC

CWE-1062

Parent Class with References to Child Class

  • CWE.1062.RSFC

CWE-1066

Missing Serialization Control Element

  • CWE.1066.OROM

CWE-1069

Empty Exception Block

  • CWE.1069.AECB

CWE-1071

Empty Code Block

  • CWE.1071.CEB
  • CWE-1069.AECB
  • CWE-585.SNE

CWE-1075

Unconditional Control Flow Transfer outside of Switch Block

  • CWE.1075.ABCL

CWE-1076

Insufficient Adherence to Expected Conventions

  • CWE-594.SIVS
  • CWE-586.NCF

CWE-1077

Floating Point Comparison with Incorrect Operator

  • CWE.1077.DCF

CWE-1078

Inappropriate Source Code Style or Formatting

  • CWE-546.TODOJAVA
  • CWE-546.TODOPROP
  • CWE-546.TODOXML
  • CWE-1115.MCH
  • CWE-1106.USN

CWE-1095

Loop Condition Value Update within the Loop

  • CWE.1095.FLVA

CWE-1102

Reliance on Machine-Dependent Data Representation

  • CWE.1102.DNHCP
  • CWE.1102.LNSP
  • CWE.1102.PEER

CWE-1106

Insufficient Use of Symbolic Constants

  • CWE.1106.USN

CWE-1115

Source Code Element without Standard Prologue

  • CWE.1115.MCH

CWE-1120

Excessive Code Complexity

  • CWE-1075.ABCL
  • CWE-1095.FLVA

CWE-1126

Declaration of Variable with Unnecessarily Wide Scope

  • CWE.1126.DVCU

CWE-1164

Irrelevant Code

  • CWE-1071.CEB
  • CWE-561.CC
  • CWE-561.SWITCH
  • CWE-561.PM
  • CWE-563.VOVR
  • CWE-563.UPPF
  • CWE-563.AURV
  • CWE-563.PF
  • CWE-563.UP

CWE-1173

Improper Use of Validation Framework

  • CWE-109.EV
  • CWE-106.PLUGIN
  • CWE-102.DFV

CWE-1176

Inefficient CPU Computation

  • CWE-1046.USB

CWE-1177

Use of Prohibited Code

  • CWE-676.SRD

CWE-1204

Generation of Weak Initialization Vector (IV)

  • CWE-329.ENPP
  • CWE-329.IVR

CWE-1235

Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations

  • CWE.1235.ABUB

CWE-1240

Use of a Cryptographic Primitive with a Risky Implementation

  • CWE-325.MCMDU
  • CWE-325.SIKG

CWE-1285

Improper Validation of Specified Index, Position, or Offset in Input

  • CWE-129.ARRAY
  • CWE-129.ARRAYSEC
  • CWE-129.CAI

CWE-1286

Improper Validation of Syntactic Correctness of Input

  • CWE-112.XMLVAL

CWE-1390

Weak Authentication

  • CWE-290.HTTPRHA
  • CWE-305.UBA
  • CWE-307.PBFA

CWE-1391

Use of Weak Credentials

  • CWE-798.HCCS
  • CWE-521.MLVP

CWE-1419

Incorrect Initialization of Resource

  • CWE-1051.HCNA

CWE-1428

Reliance on HTTP instead of HTTPS

  • CWE.1428.UHTTPS