Weakness classes (CWE)

1,245 pages, showing 1,001–1,100, ordered by identifier.

CWE-685 — Function Call With Incorrect Number of Arguments The product calls a function, procedure, or routine, but the caller specifies too many arguments, or too few...
CWE-686 — Function Call With Incorrect Argument Type The product calls a function, procedure, or routine, but the caller specifies an argument that is the wrong data...
CWE-687 — Function Call With Incorrectly Specified Argument Value The product calls a function, procedure, or routine, but the caller specifies an argument that contains the wrong...
CWE-688 — Function Call With Incorrect Variable or Reference as Argument The product calls a function, procedure, or routine, but the caller specifies the wrong variable or reference as one...
CWE-689 — Permission Race Condition During Resource Copy The product, while copying or cloning a resource, does not set the resource's permissions or access control until...
CWE-69 — Improper Handling of Windows ::DATA Alternate Data Stream The product does not properly prevent access to, or detect usage of, alternate data streams (ADS).
CWE-690 — Unchecked Return Value to NULL Pointer Dereference The product does not check for an error after calling a function that can return with a NULL pointer if the function...
CWE-691 — Insufficient Control Flow Management The code does not sufficiently manage its control flow during execution, creating conditions in which the control...
CWE-692 — Incomplete Denylist to Cross-Site Scripting The product uses a denylist-based protection mechanism to defend against XSS attacks, but the denylist is...
CWE-693 — Protection Mechanism Failure The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against...
CWE-694 — Use of Multiple Resources with Duplicate Identifier The product uses multiple resources that can have the same identifier, in a context in which unique identifiers are required.
CWE-695 — Use of Low-Level Functionality The product uses low-level functionality that is explicitly prohibited by the framework or specification under which...
CWE-696 — Incorrect Behavior Order The product performs multiple related behaviors, but the behaviors are performed in the wrong order in ways that may...
CWE-697 — Incorrect Comparison The product compares two entities in a security-relevant context, but the comparison is incorrect.
CWE-698 — Execution After Redirect (EAR) The web application sends a redirect to another location, but instead of exiting, it executes additional code.
CWE-7 — J2EE Misconfiguration: Missing Custom Error Page The default error page of a web application should not display sensitive information about the product.
CWE-703 — Improper Check or Handling of Exceptional Conditions The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation...
CWE-704 — Incorrect Type Conversion or Cast The product does not correctly convert an object, resource, or structure from one type to a different type.
CWE-705 — Incorrect Control Flow Scoping The product does not properly return control flow to the proper location after it has completed a task or detected...
CWE-706 — Use of Incorrectly-Resolved Name or Reference The product uses a name or reference to access a resource, but the name/reference resolves to a resource that is...
CWE-707 — Improper Neutralization The product does not ensure or incorrectly ensures that structured messages or data are well-formed and that certain...
CWE-708 — Incorrect Ownership Assignment The product assigns an owner to a resource, but the owner is outside of the intended control sphere.
CWE-710 — Improper Adherence to Coding Standards The product does not follow certain coding rules for development, which can lead to resultant weaknesses or increase...
CWE-72 — Improper Handling of Apple HFS+ Alternate Data Stream Path The product does not properly handle special paths that may identify the data or resource fork of a file on the HFS+...
CWE-73 — External Control of File Name or Path The product allows user input to control or influence paths or file names that are used in filesystem operations.
CWE-732 — Incorrect Permission Assignment for Critical Resource The product specifies permissions for a security-critical resource in a way that allows that resource to be read or...
CWE-733 — Compiler Optimization Removal or Modification of Security-critical Code The developer builds a security-critical protection mechanism into the software, but the compiler optimizes the...
CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') The product constructs all or part of a command, data structure, or record using externally-influenced input from an...
CWE-749 — Exposed Dangerous Method or Function The product provides an Applications Programming Interface (API) or similar interface for interaction with external...
CWE-75 — Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) The product does not adequately filter user-controlled input for special elements with control implications.
CWE-754 — Improper Check for Unusual or Exceptional Conditions The product does not check or incorrectly checks for unusual or exceptional conditions that are not expected to...
CWE-755 — Improper Handling of Exceptional Conditions The product does not handle or incorrectly handles an exceptional condition.
CWE-756 — Missing Custom Error Page The product does not return custom error pages to the user, possibly exposing sensitive information.
CWE-757 — Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate...
CWE-758 — Reliance on Undefined, Unspecified, or Implementation-Defined Behavior The product uses an API function, data structure, or other entity in a way that relies on properties that are not...
CWE-759 — Use of a One-Way Hash without a Salt The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password,...
CWE-76 — Improper Neutralization of Equivalent Special Elements The product correctly neutralizes certain special elements, but it improperly neutralizes equivalent special elements.
CWE-760 — Use of a One-Way Hash with a Predictable Salt The product uses a one-way cryptographic hash against an input that should not be reversible, such as a password,...
CWE-761 — Free of Pointer not at Start of Buffer The product calls free() on a pointer to a memory resource that was allocated on the heap, but the pointer is not at...
CWE-762 — Mismatched Memory Management Routines The product attempts to return a memory resource to the system, but it calls a release function that is not...
CWE-763 — Release of Invalid Pointer or Reference The product attempts to return a memory resource to the system, but it calls the wrong release function or calls the...
CWE-764 — Multiple Locks of a Critical Resource The product locks a critical resource more times than intended, leading to an unexpected state in the system.
CWE-765 — Multiple Unlocks of a Critical Resource The product unlocks a critical resource more times than intended, leading to an unexpected state in the system.
CWE-766 — Critical Data Element Declared Public The product declares a critical variable, field, or member to be public when intended security policy requires it to...
CWE-767 — Access to Critical Private Variable via Public Method The product defines a public method that reads or modifies a private variable.
CWE-768 — Incorrect Short Circuit Evaluation The product contains a conditional statement with multiple logical expressions in which one of the non-leading...
CWE-77 — Improper Neutralization of Special Elements used in a Command ('Command Injection') The product constructs all or part of a command using externally-influenced input from an upstream component, but it...
CWE-770 — Allocation of Resources Without Limits or Throttling The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended...
CWE-771 — Missing Reference to Active Allocated Resource The product does not properly maintain a reference to a resource that has been allocated, which prevents the...
CWE-772 — Missing Release of Resource after Effective Lifetime The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CWE-773 — Missing Reference to Active File Descriptor or Handle The product does not properly maintain references to a file descriptor or handle, which prevents that file...
CWE-774 — Allocation of File Descriptors or Handles Without Limits or Throttling The product allocates file descriptors or handles on behalf of an actor without imposing any restrictions on how...
CWE-775 — Missing Release of File Descriptor or Handle after Effective Lifetime The product does not release a file descriptor or handle after its effective lifetime has ended, i.e., after the...
CWE-776 — Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') The product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but...
CWE-777 — Regular Expression without Anchors The product uses a regular expression to perform neutralization, but the regular expression is not anchored and may...
CWE-778 — Insufficient Logging When a security-critical event occurs, the product either does not record the event or omits important details about...
CWE-779 — Logging of Excessive Data The product logs too much information, making log files hard to process and possibly hindering recovery efforts or...
CWE-78 — Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') The product constructs all or part of an OS command using externally-influenced input from an upstream component,...
CWE-780 — Use of RSA Algorithm without OAEP The product uses the RSA algorithm but does not incorporate Optimal Asymmetric Encryption Padding (OAEP), which...
CWE-781 — Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code The product defines an IOCTL that uses METHOD_NEITHER for I/O, but it does not validate or incorrectly validates the...
CWE-782 — Exposed IOCTL with Insufficient Access Control The product implements an IOCTL with functionality that should be restricted, but it does not properly enforce...
CWE-783 — Operator Precedence Logic Error The product uses an expression in which operator precedence causes incorrect logic to be used.
CWE-784 — Reliance on Cookies without Validation and Integrity Checking in a Security Decision The product uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly...
CWE-785 — Use of Path Manipulation Function without Maximum-sized Buffer The product invokes a function for normalizing paths or file names, but it provides an output buffer that is smaller...
CWE-786 — Access of Memory Location Before Start of Buffer The product reads or writes to a buffer using an index or pointer that references a memory location prior to the...
CWE-787 — Out-of-bounds Write The product writes data past the end, or before the beginning, of the intended buffer.
CWE-788 — Access of Memory Location After End of Buffer The product reads or writes to a buffer using an index or pointer that references a memory location after the end of...
CWE-789 — Memory Allocation with Excessive Size Value The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within...
CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output...
CWE-790 — Improper Filtering of Special Elements The product receives data from an upstream component, but does not filter or incorrectly filters special elements...
CWE-791 — Incomplete Filtering of Special Elements The product receives data from an upstream component, but does not completely filter special elements before sending...
CWE-792 — Incomplete Filtering of One or More Instances of Special Elements The product receives data from an upstream component, but does not completely filter one or more instances of...
CWE-793 — Only Filtering One Instance of a Special Element The product receives data from an upstream component, but only filters a single instance of a special element before...
CWE-794 — Incomplete Filtering of Multiple Instances of Special Elements The product receives data from an upstream component, but does not filter all instances of a special element before...
CWE-795 — Only Filtering Special Elements at a Specified Location The product receives data from an upstream component, but only accounts for special elements at a specified...
CWE-796 — Only Filtering Special Elements Relative to a Marker The product receives data from an upstream component, but only accounts for special elements positioned relative to...
CWE-797 — Only Filtering Special Elements at an Absolute Position The product receives data from an upstream component, but only accounts for special elements at an absolute position...
CWE-798 — Use of Hard-coded Credentials The product contains hard-coded credentials, such as a password or cryptographic key.
CWE-799 — Improper Control of Interaction Frequency The product does not properly limit the number or frequency of interactions that it has with an actor, such as the...
CWE-8 — J2EE Misconfiguration: Entity Bean Declared Remote When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the...
CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-804 — Guessable CAPTCHA The product uses a CAPTCHA challenge, but the challenge can be guessed or automatically recognized by a non-human actor.
CWE-805 — Buffer Access with Incorrect Length Value The product uses a sequential operation to read or write a buffer, but it uses an incorrect length value that causes...
CWE-806 — Buffer Access Using Size of Source Buffer The product uses the size of a source buffer when reading from or writing to a destination buffer, which may cause...
CWE-807 — Reliance on Untrusted Inputs in a Security Decision The product uses a protection mechanism that relies on the existence or values of an input, but the input can be...
CWE-81 — Improper Neutralization of Script in an Error Message Web Page The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-82 — Improper Neutralization of Script in Attributes of IMG Tags in a Web Page The web application does not neutralize or incorrectly neutralizes scripting elements within attributes of HTML IMG...
CWE-820 — Missing Synchronization The product utilizes a shared resource in a concurrent manner but does not attempt to synchronize access to the resource.
CWE-821 — Incorrect Synchronization The product utilizes a shared resource in a concurrent manner, but it does not correctly synchronize access to the resource.
CWE-822 — Untrusted Pointer Dereference The product obtains a value from an untrusted source, converts this value to a pointer, and dereferences the...
CWE-823 — Use of Out-of-range Pointer Offset The product performs pointer arithmetic on a valid pointer, but it uses an offset that can point outside of the...
CWE-824 — Access of Uninitialized Pointer The product accesses or uses a pointer that has not been initialized.
CWE-825 — Expired Pointer Dereference The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.
CWE-826 — Premature Release of Resource During Expected Lifetime The product releases a resource that is still intended to be used by itself or another actor.
CWE-827 — Improper Control of Document Type Definition The product does not restrict a reference to a Document Type Definition (DTD) to the intended control sphere. This...
CWE-828 — Signal Handler with Functionality that is not Asynchronous-Safe The product defines a signal handler that contains code sequences that are not asynchronous-safe, i.e., the...
CWE-829 — Inclusion of Functionality from Untrusted Control Sphere The product imports, requires, or includes executable functionality (such as a library) from a source that is...
CWE-83 — Improper Neutralization of Script in Attributes in a Web Page The product does not neutralize or incorrectly neutralizes 'javascript:' or other URIs from dangerous attributes...
CWE-830 — Inclusion of Web Functionality from an Untrusted Source The product includes web functionality (such as a web widget) from another domain, which causes it to operate within...
CWE-831 — Signal Handler Function Associated with Multiple Signals The product defines a function that is used as a handler for more than one signal.

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.