Weakness classes (CWE)

1,245 pages, showing 1–100, ordered by identifier.

CWE-1001 — SFP Secondary Cluster: Use of an Improper API SFP Secondary Cluster: Use of an Improper API
CWE-1002 — SFP Secondary Cluster: Unexpected Entry Points SFP Secondary Cluster: Unexpected Entry Points
CWE-1004 — Sensitive Cookie Without 'HttpOnly' Flag The product uses a cookie to store sensitive information, but the cookie is not marked with the HttpOnly flag.
CWE-1005 — 7PK - Input Validation and Representation 7PK - Input Validation and Representation
CWE-1006 — Bad Coding Practices Bad Coding Practices
CWE-1007 — Insufficient Visual Distinction of Homoglyphs Presented to User The product displays information or identifiers to a user, but the display mechanism does not make it easy for the...
CWE-1009 — Audit Audit
CWE-1010 — Authenticate Actors Authenticate Actors
CWE-1011 — Authorize Actors Authorize Actors
CWE-1012 — Cross Cutting Cross Cutting
CWE-1013 — Encrypt Data Encrypt Data
CWE-1014 — Identify Actors Identify Actors
CWE-1015 — Limit Access Limit Access
CWE-1016 — Limit Exposure Limit Exposure
CWE-1017 — Lock Computer Lock Computer
CWE-1018 — Manage User Sessions Manage User Sessions
CWE-1019 — Validate Inputs Validate Inputs
CWE-102 — Struts: Duplicate Validation Forms The product uses multiple validation forms with the same name, which might cause the Struts Validator to validate a...
CWE-1020 — Verify Message Integrity Verify Message Integrity
CWE-1021 — Improper Restriction of Rendered UI Layers or Frames The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another...
CWE-1022 — Use of Web Link to Untrusted Target with window.opener Access The web application produces links to untrusted external sites outside of its sphere of control, but it does not...
CWE-1023 — Incomplete Comparison with Missing Factors The product performs a comparison between entities that must consider multiple factors or characteristics of each...
CWE-1024 — Comparison of Incompatible Types The product performs a comparison between two entities, but the entities are of different, incompatible types that...
CWE-1025 — Comparison Using Wrong Factors The code performs a comparison between two entities, but the comparison examines the wrong factors or...
CWE-1027 — OWASP Top Ten 2017 Category A1 - Injection OWASP Top Ten 2017 Category A1 - Injection
CWE-1028 — OWASP Top Ten 2017 Category A2 - Broken Authentication OWASP Top Ten 2017 Category A2 - Broken Authentication
CWE-1029 — OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure
CWE-103 — Struts: Incomplete validate() Method Definition The product has a validator form that either does not define a validate() method, or defines a validate() method but...
CWE-1030 — OWASP Top Ten 2017 Category A4 - XML External Entities (XXE) OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)
CWE-1031 — OWASP Top Ten 2017 Category A5 - Broken Access Control OWASP Top Ten 2017 Category A5 - Broken Access Control
CWE-1032 — OWASP Top Ten 2017 Category A6 - Security Misconfiguration OWASP Top Ten 2017 Category A6 - Security Misconfiguration
CWE-1033 — OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS) OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)
CWE-1034 — OWASP Top Ten 2017 Category A8 - Insecure Deserialization OWASP Top Ten 2017 Category A8 - Insecure Deserialization
CWE-1035 — OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1036 — OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring
CWE-1037 — Processor Optimization Removal or Modification of Security-critical Code The developer builds a security-critical protection mechanism into the software, but the processor optimizes the...
CWE-1038 — Insecure Automated Optimizations The product uses a mechanism that automatically optimizes code, e.g. to improve a characteristic such as...
CWE-1039 — Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism The product uses an automated mechanism such as machine learning to recognize complex data inputs (e.g. image or...
CWE-104 — Struts: Form Bean Does Not Extend Validation Class If a form bean does not extend an ActionForm subclass of the Validator framework, it can expose the application to...
CWE-1041 — Use of Redundant Code The product has multiple functions, methods, procedures, macros, etc. that contain the same code.
CWE-1042 — Static Member Data Element outside of a Singleton Class Element The code contains a member element that is declared as static (but not final), in which its parent class element is...
CWE-1043 — Data Element Aggregating an Excessively Large Number of Non-Primitive Elements The product uses a data element that has an excessively large number of sub-elements with non-primitive data types...
CWE-1044 — Architecture with Number of Horizontal Layers Outside of Expected Range The product's architecture contains too many - or too few - horizontal layers.
CWE-1045 — Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor A parent class has a virtual destructor method, but the parent has a child class that does not have a virtual destructor.
CWE-1046 — Creation of Immutable Text Using String Concatenation The product creates an immutable text string using string concatenation operations.
CWE-1047 — Modules with Circular Dependencies The product contains modules in which one module has references that cycle back to itself, i.e., there are circular...
CWE-1048 — Invokable Control Element with Large Number of Outward Calls The code contains callable control elements that contain an excessively large number of references to other...
CWE-1049 — Excessive Data Query Operations in a Large Data Table The product performs a data query with a large number of joins and sub-queries on a large data table.
CWE-105 — Struts: Form Field Without Validator The product has a form field that is not validated by a corresponding validation form, which can introduce other...
CWE-1050 — Excessive Platform Resource Consumption within a Loop The product has a loop body or loop condition that contains a control element that directly or indirectly consumes...
CWE-1051 — Initialization with Hard-Coded Network Resource Configuration Data The product initializes data using hard-coded values that act as network resource identifiers.
CWE-1052 — Excessive Use of Hard-Coded Literals in Initialization The product initializes a data element using a hard-coded literal that is not a simple integer or static constant element.
CWE-1053 — Missing Documentation for Design The product does not have documentation that represents how it is designed.
CWE-1054 — Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer The code at one architectural layer invokes code that resides at a deeper layer than the adjacent layer, i.e., the...
CWE-1055 — Multiple Inheritance from Concrete Classes The product contains a class with inheritance from more than one concrete class.
CWE-1056 — Invokable Control Element with Variadic Parameters A named-callable or method control element has a signature that supports a variable (variadic) number of parameters...
CWE-1057 — Data Access Operations Outside of Expected Data Manager Component The product uses a dedicated, central data manager component as required by design, but it contains code that...
CWE-1058 — Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element The code contains a function or method that operates in a multi-threaded environment but owns an unsafe non-final...
CWE-1059 — Insufficient Technical Documentation The product does not contain sufficient technical or engineering documentation (whether on paper or in electronic...
CWE-106 — Struts: Plug-in Framework not in Use When an application does not use an input validation framework such as the Struts Validator, there is a greater risk...
CWE-1060 — Excessive Number of Inefficient Server-Side Data Accesses The product performs too many data queries without using efficient data processing functionality such as stored procedures.
CWE-1061 — Insufficient Encapsulation The product does not sufficiently hide the internal representation and implementation details of data or methods,...
CWE-1062 — Parent Class with References to Child Class The code has a parent class that contains references to a child class, its methods, or its members.
CWE-1063 — Creation of Class Instance within a Static Code Block A static code block creates an instance of a class.
CWE-1064 — Invokable Control Element with Signature Containing an Excessive Number of Parameters The product contains a function, subroutine, or method whose signature has an unnecessarily large number of...
CWE-1065 — Runtime Resource Management Control Element in a Component Built to Run on Application Servers The product uses deployed components from application servers, but it also uses low-level functions/methods for...
CWE-1066 — Missing Serialization Control Element The product contains a serializable data element that does not have an associated serialization method.
CWE-1067 — Excessive Execution of Sequential Searches of Data Resource The product contains a data query against an SQL table or view that is configured in a way that does not utilize an...
CWE-1068 — Inconsistency Between Implementation and Documented Design The implementation of the product is not consistent with the design as described within the relevant documentation.
CWE-1069 — Empty Exception Block An invokable code block contains an exception handling block that does not contain any code, i.e. is empty.
CWE-107 — Struts: Unused Validation Form An unused validation form indicates that validation logic is not up-to-date.
CWE-1070 — Serializable Data Element Containing non-Serializable Item Elements The product contains a serializable, storable data element such as a field or member, but the data element contains...
CWE-1071 — Empty Code Block The source code contains a block that does not contain any code, i.e., the block is empty.
CWE-1072 — Data Resource Access without Use of Connection Pooling The product accesses a data resource through a database without using a connection pooling capability.
CWE-1073 — Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses The product contains a client with a function or method that contains a large number of data accesses/queries that...
CWE-1074 — Class with Excessively Deep Inheritance A class has an inheritance level that is too high, i.e., it has a large number of parent classes.
CWE-1075 — Unconditional Control Flow Transfer outside of Switch Block The product performs unconditional control transfer (such as a 'goto') in code outside of a branching structure such...
CWE-1076 — Insufficient Adherence to Expected Conventions The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.
CWE-1077 — Floating Point Comparison with Incorrect Operator The code performs a comparison such as an equality test between two float (floating point) values, but it uses...
CWE-1078 — Inappropriate Source Code Style or Formatting The source code does not follow desired style or formatting for indentation, white space, comments, etc.
CWE-1079 — Parent Class without Virtual Destructor Method A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.
CWE-108 — Struts: Unvalidated Action Form Every Action Form must have a corresponding validation form.
CWE-1080 — Source Code File with Excessive Number of Lines of Code A source code file has too many lines of code.
CWE-1082 — Class Instance Self Destruction Control Element The code contains a class instance that calls the method or function to delete or destroy itself.
CWE-1083 — Data Access from Outside Expected Data Manager Component The product is intended to manage data access through a particular data manager component such as a relational or...
CWE-1084 — Invokable Control Element with Excessive File or Data Access Operations A function or method contains too many operations that utilize a data manager or file resource.
CWE-1085 — Invokable Control Element with Excessive Volume of Commented-out Code A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.
CWE-1086 — Class with Excessive Number of Child Classes A class contains an unnecessarily large number of children.
CWE-1087 — Class with Virtual Method without a Virtual Destructor A class contains a virtual method, but the method does not have an associated virtual destructor.
CWE-1088 — Synchronous Access of Remote Resource without Timeout The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to...
CWE-1089 — Large Data Table with Excessive Number of Indices The product uses a large data table that contains an excessively large number of indices.
CWE-109 — Struts: Validator Turned Off Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation...
CWE-1090 — Method Containing Access of a Member Element from Another Class A method for a class performs an operation that directly accesses a member element from another class.
CWE-1091 — Use of Object without Invoking Destructor Method The product contains a method that accesses an object but does not later invoke the element's associated...
CWE-1092 — Use of Same Invokable Control Element in Multiple Architectural Layers The product uses the same control element across multiple architectural layers.
CWE-1093 — Excessively Complex Data Representation The product uses an unnecessarily complex internal representation for its data structures or interrelationships...
CWE-1094 — Excessive Index Range Scan for a Data Resource The product contains an index range scan for a large data table, but the scan can cover a large number of rows.
CWE-1095 — Loop Condition Value Update within the Loop The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.
CWE-1096 — Singleton Class Instance Creation without Proper Locking or Synchronization The product implements a Singleton design pattern but does not use appropriate locking or other synchronization...
CWE-1097 — Persistent Storable Data Element without Associated Comparison Control Element The product uses a storable data element that does not have all of the associated functions or methods that are...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.