Page tree

Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

This section includes rule mapping for the CWE standard. The mapping information for other standards is available in the PDF rule mapping files shipped with Compliance Packs.

CWE Top 25 Mapping

CWE ID

CWE

Name

name/description

Parasoft rule ID(s)

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE.119.ARRAY

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE.79.VPPD
  • CWE.79.TDRESP
  • CWE.79.TDXSS

CWE-20

Improper Input Validation

  • CWE.20.ARRAY
  • CWE.20.VPPD
  • CWE.20.TDNET
  • CWE.20.TDFNAMES
  • CWE.20.TDCMD
  • CWE.20.
AUPSCWE.20.
  • TDRESP
  • CWE.20.TDXSS
  • CWE.20.TDSQL
  • CWE.20.TDSQLC

CWE-200

Information Exposure

  • CWE.200.SENS
  • CWE.200.PEO
  • CWE.200.ACPST
  • CWE.200.CSG

CWE-125

Out-of-bounds Read

  • CWE.125.ARRAY

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  • CWE.89.TDSQL
  • CWE.89.TDSQLC

CWE-416

Use After Free

  • CWE.416.DISP
  • CWE.416.FIN

CWE-190

Integer Overflow or Wraparound

  • CWE.190.AIWIL
  • CWE.190.INTOVERF

CWE-352

Cross-Site Request Forgery (CSRF)

  • CWE.352.VPPD
  • CWE.352.TDRESP
  • CWE.352.VAFT

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE.22.TDFNAMES

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE.78.TDCMD
CWE.78.AUPS

CWE-787

Out-of-bounds Write

  • CWE.787.ARRAY

CWE-287

Improper Authentication

  • CWE.287.TDPASSWD
  • CWE.287.AAM
  • CWE.287.UAAMC
  • CWE.287.LUAFLA
  • CWE.287.IIPHEU

CWE-476

NULL Pointer Dereference

  • CWE.476.NR
  • CWE.476.DEREF
  • CWE.476.CNFA

CWE-732

Incorrect Permission Assignment for Critical Resource

  • CWE.732.ADSVSP

CWE-434

Unrestricted Upload of File with Dangerous Type

  • CWE.434.TDFNAMES

CWE-611

Improper Restriction of XML External Entity Reference

  • CWE.611.PDTDP
  • CWE.611.USXRS

CWE-94

Improper Control of Generation of Code ('Code Injection')

N/A
  • CWE.94.TDCODE

CWE-798

Use of Hard-coded Credentials

  • CWE.798.HARDCONN
  • CWE.798.HPW

CWE-400

Uncontrolled Resource Consumption

  • CWE.400.LEAKS

CWE-772

Missing Release of Resource after Effective Lifetime

  • CWE.772.LEAKS

CWE-426

Untrusted Search Path

N/A
  • CWE.426.PBRTE

CWE-502

Deserialization of Untrusted Data

  • CWE.502.IIDC
  • CWE.502.UIS
  • CWE.502.IDC
  • CWE.502.MGODWSPA

CWE-269

Improper Privilege Management

N/A
  • CWE.269.IDENTITY

CWE-295

Improper Certificate Validation

  • CWE.295.DNICV

CWE Weaknesses On the Cusp Mapping

CWE ID

CWE name/description

Parasoft rule ID(s)

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

  • CWE.835.IVFLC
  • CWE.835.IVFLI
  • CWE.835.NSIVFLN

CWE-522

Insufficiently Protected Credentials

N/A
  • CWE.522.TDPASSWD

CWE-704

Incorrect Type Conversion or Cast

  • CWE.704.ECLTS

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE.362.LOCKSETGET
  • CWE.362.DIFCS

CWE-918

Server-Side Request Forgery (SSRF)

N/A
  • CWE.918.TDNET

CWE-415

Double Free

  • N/A

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

  • CWE.601.TDNET

CWE-863

Incorrect Authorization

  • CWE.863.AAM
  • CWE.863.UAAMC
  • CWE.863.AUTH

CWE-862

Missing Authorization

  • CWE.862.UAA

CWE-532

Inclusion of Sensitive Information in Log Files

N/A
  • CWE.532.ALSI

CWE-306

Missing Authentication for Critical Function

  • CWE.306.ADSVSP

CWE-384

Session Fixation

  • N/A

CWE-326

Inadequate Encryption Strength

  • CWE.326.ICA

CWE-770

Allocation of Resources Without Limits or Throttling

  • CWE.770.
LEAKS
  • TDALLOC

CWE-617

Reachable Assertion

N/A
  • CWE.617.ATA

CWE 4.0 Mapping

CWE ID

CWE name/description

Parasoft rule ID(s)

CWE-20

Improper Input Validation

  • CWE.20.ARRAY
  • CWE.20.VPPD
  • CWE.20.TDNET
  • CWE.20.TDFNAMES
  • CWE.20.TDCMD
  • CWE.20.
AUPSCWE.20.
  • TDRESP
  • CWE.20.TDXSS
  • CWE.20.TDSQL
  • CWE.20.TDSQLC

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

  • CWE.22.TDFNAMES

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

  • CWE.77.TDCMD

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

  • CWE.78.TDCMD

CWE

.78.AUPSCWE

-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

  • CWE.79.VPPD
  • CWE.79.TDRESP
  • CWE.79.TDXSS

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

  • CWE.80.VPPD
  • CWE.80.TDRESP

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

  • CWE.88.TDCMD
  • CWE.88.VPPD

CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

  • CWE.89.TDSQL
  • CWE.89.TDSQLC

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

  • CWE.90.TDLDAP

CWE-94

Improper Control of Generation of Code ('Code Injection')

  • CWE.94.TDCODE

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

  • CWE.95.TDCODE

CWE-99

Improper Control of Resource Identifiers ('Resource Injection')

  • CWE.99.TDFNAMES
  • CWE.99.TDNET

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

  • CWE.119.ARRAY

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

  • CWE.120.AUK

CWE-125

Out-of-bounds Read

  • CWE.125.ARRAY

CWE-129

Improper Validation of Array Index

  • CWE.129.ARRAY

CWE-131

Incorrect Calculation of Buffer Size

  • CWE.131.AUK

CWE-134

Use of Externally-Controlled Format String

  • CWE.134.TDINPUT

CWE-190

Integer Overflow or Wraparound

  • CWE.190.AIWIL
  • CWE.190.INTOVERF

CWE-191

Integer Underflow (Wrap or Wraparound)

  • CWE.191.AIWIL
  • CWE.191.INTOVERF

CWE-197

Numeric Truncation Error

  • CWE.197.ECLSII

CWE-200

Information Exposure

  • CWE.200.SENS
  • CWE.200.PEO
  • CWE.200.ACPST
  • CWE.200.CSG

CWE-201

Information Exposure Through Sent Data

  • CWE.201.SELSPLAT

CWE-209

Information Exposure Through an Error Message

  • CWE.209.SENS
  • CWE.209.PEO
  • CWE.209.ACPST

CWE-212

Improper Cross-boundary Removal of Sensitive Data

  • CWE.212.CSG

CWE-250

Execution with Unnecessary Privileges

  • CWE.250.AUEP

CWE-252

Unchecked Return Value

  • CWE.252.RETVAL
  • CWE.252.CHECKRET

CWE-256

Unprotected Storage of Credentials

  • CWE.256.TDPASSWD

CWE-259

Use of Hard-coded Password

  • CWE.259.HPW

CWE-269

Improper Privilege Management

  • CWE.269.IDENTITY

CWE-285

Improper Authorization

  • CWE.285.TDSQL

CWE-287

Improper Authentication

  • CWE.287.TDPASSWD
  • CWE.287.AAM
  • CWE.287.UAAMC
  • CWE.287.LUAFLA
  • CWE.287.IIPHEU

CWE-295

Improper Certificate Validation

  • CWE.295.DNICV

CWE-306

Missing Authentication for Critical Function

  • CWE.306.ADSVSP

CWE-307

Improper Restriction of Excessive Authentication Attempts

  • CWE.307.LUAFLA

CWE-316

Cleartext Storage of Sensitive Information in Memory

  • CWE.316.RSFSS
  • CWE.316.SSFP

CWE-326

Inadequate Encryption Strength

  • CWE.326.ICA

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

  • CWE.327.ICA
  • CWE.327.DNCCKS
  • CWE.327.ACCA

CWE-328

Reversible One-Way Hash

  • CWE.328.ICA

CWE-329

Not Using a Random IV with CBC Mode

  • CWE.329.ACCA

CWE-330

Use of Insufficiently Random Values

  • CWE.330.USSCR

CWE-350

Reliance on Reverse DNS Resolution for a Security-Critical Action

  • CWE.350.IIPHEU

CWE-352

Cross-Site Request Forgery (CSRF)

  • CWE.352.VPPD
  • CWE.352.TDRESP
  • CWE.352.VAFT

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

  • CWE.362.LOCKSETGET
  • CWE.362.DIFCS

CWE-369

Divide By Zero

  • CWE.369.ZERO

CWE-391

Unchecked Error Condition

  • CWE.391.LGE

CWE-395

Use of NullPointerException Catch to Detect NULL Pointer Dereference

  • CWE.395.NCNRE

CWE-396

Declaration of Catch for Generic Exception

  • CWE.396.NCSAE

CWE-397

Declaration of Throws for Generic Exception

  • CWE.397.NTSAE

CWE-400

Uncontrolled Resource Consumption

  • CWE.400.LEAKS

CWE-401

Missing Release of Memory after Effective Lifetime

  • CWE.401.DBDTFF
  • CWE.401.DCDSF
  • CWE.401.DCID
  • CWE.401.DDFODB
  • CWE.401.SRIF
  • CWE.401.TICUFDS
  • CWE.401.TIID
  • CWE.401.CBDM
  • CWE.401.IDWF
  • CWE.401.MDPP
  • CWE.401.ASC

CWE-402

Transmission of Private Resources into a New Sphere ('Resource Leak')

  • CWE.402.CSG

CWE-412

Unrestricted Externally Accessible Lock

  • CWE.412.NLT

CWE-416

Use After Free

  • CWE.416.DISP
  • CWE.416.FIN

CWE-426

Untrusted Search Path

  • CWE.426.PBRTE

CWE-434

Unrestricted Upload of File with Dangerous Type

  • CWE.434.TDFNAMES

CWE-456

Missing Initialization of a Variable

  • CWE.456.NOTEXPLINIT

CWE-457

Use of Uninitialized Variable

  • CWE.457.NOTEXPLINIT

CWE-470

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

  • CWE.470.TDRFL

CWE-476

NULL Pointer Dereference

  • CWE.476.NR
  • CWE.476.DEREF
  • CWE.476.CNFA

CWE-480

Use of Incorrect Operator

  • CWE.480.PUO

CWE-481

Assigning instead of Comparing

  • CWE.481.AWC

CWE-494

Download of Code Without Integrity Check

  • CWE.494.IREC

CWE-499

Serializable Class Containing Sensitive Data

  • CWE.499.CSG

CWE-502

Deserialization of Untrusted Data

  • CWE.502.IIDC
  • CWE.502.UIS
  • CWE.502.IDC
  • CWE.502
.UISCWE.502.IDC
  • .MGODWSPA

CWE-522

Insufficiently Protected Credentials

  • CWE.522.TDPASSWD

CWE-532

Inclusion of Sensitive Information in Log Files

  • CWE.
502
  • 532.
MGODWSPA
  • ALSI

CWE-546

Suspicious Comment

  • CWE.546.TODO

CWE-561

Dead Code

  • CWE.561.UC

CWE-563

Assignment to Variable without Use

  • CWE.563.POVR
  • CWE.563.VOVR

CWE-570

Expression is Always False

  • CWE.570.CC

CWE-571

Expression is Always True

  • CWE.571.CC

CWE-595

Comparison of Object References Instead of Object Contents

  • CWE.595.REVT

CWE-601

URL Redirection to Untrusted Site ('Open Redirect')

  • CWE.601.TDNET

CWE-611

Improper Restriction of XML External Entity Reference

  • CWE.611.PDTDP
  • CWE.611.USXRS

CWE-613

Insufficient Session Expiration

  • CWE.613.ISE

CWE-617

Reachable Assertion

  • CWE.617.ATA

CWE-662

Improper Synchronization

  • CWE.662.DIFCS

CWE-676

Use of Potentially Dangerous Function

  • CWE.676.APDM

CWE-681

Incorrect Conversion between Numeric Types

  • CWE.681.ECLTS

CWE-704

Incorrect Type Conversion or Cast

  • CWE.704.ECLTS

CWE-732

Incorrect Permission Assignment for Critical Resource

  • CWE.732.ADSVSP

CWE-759

Use of a One-Way Hash without a Salt

  • CWE.759.SALT

CWE-760

Use of a One-Way Hash with a Predictable Salt

  • CWE.760.SALT

CWE-770

Allocation of Resources Without Limits or Throttling

  • CWE.770.
LEAKS
  • TDALLOC

CWE-772

Missing Release of Resource after Effective Lifetime

  • CWE.772.LEAKS

CWE-780

Use of RSA Algorithm without OAEP

  • CWE.780.UOWR

CWE-787

Out-of-bounds Write

  • CWE.787.ARRAY

CWE-789

Uncontrolled Memory Allocation

  • CWE.789.TDALLOC

CWE-798

Use of Hard-coded Credentials

  • CWE.798.HARDCONN
  • CWE.798.HPW

CWE-807

Reliance on Untrusted Inputs in a Security Decision

  • CWE.807.AUTH

CWE-827

Improper Control of Document Type Definition

  • CWE.827.PDTDP

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

  • CWE.829.DMSC
  • CWE.829.ADLL

CWE-833

Deadlock

  • CWE.833.ORDER

CWE-835

Loop with Unreachable Exit Condition ('Infinite Loop')

  • CWE.835.IVFLC
  • CWE.835.IVFLI
  • CWE.835.NSIVFLN

CWE-838

Inappropriate Encoding for Output Context

  • CWE.838.AIHUE

CWE-862

Missing Authorization

  • CWE.862.UAA

CWE-863

Incorrect Authorization

  • CWE.863.AAM
  • CWE.863.UAAMC
  • CWE.863.AUTH

CWE-918

Server-Side Request Forgery (SSRF)

  • CWE.918.TDNET