Weakness classes (CWE)

1,245 pages, showing 1,101–1,200, ordered by identifier.

CWE-832 — Unlock of a Resource that is not Locked The product attempts to unlock a resource that is not locked.
CWE-833 — Deadlock The product contains multiple threads or executable segments that are waiting for each other to release a necessary...
CWE-834 — Excessive Iteration The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CWE-835 — Loop with Unreachable Exit Condition ('Infinite Loop') The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-836 — Use of Password Hash Instead of Password for Authentication The product records password hashes in a data store, receives a hash of a password from a client, and compares the...
CWE-837 — Improper Enforcement of a Single, Unique Action The product requires that an actor should only be able to perform an action once, or to have only one unique action,...
CWE-838 — Inappropriate Encoding for Output Context The product uses or specifies an encoding when generating output to a downstream component, but the specified...
CWE-839 — Numeric Range Comparison Without Minimum Check The product checks a value to ensure that it is less than or equal to a maximum, but it does not also verify that...
CWE-84 — Improper Neutralization of Encoded URI Schemes in a Web Page The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.
CWE-840 — Business Logic Errors Business Logic Errors
CWE-841 — Improper Enforcement of Behavioral Workflow The product supports a session in which more than one behavior must be performed by an actor, but it does not...
CWE-842 — Placement of User into Incorrect Group The product or the administrator places a user into an incorrect group.
CWE-843 — Access of Resource Using Incompatible Type ('Type Confusion') The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later...
CWE-85 — Doubled Character XSS Manipulations The web application does not filter user-controlled input for executable script disguised using doubling of the...
CWE-86 — Improper Neutralization of Invalid Characters in Identifiers in Web Pages The product does not neutralize or incorrectly neutralizes invalid characters or byte sequences in the middle of tag...
CWE-862 — Missing Authorization The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-863 — Incorrect Authorization The product performs an authorization check when an actor attempts to access a resource or perform an action, but it...
CWE-869 — CERT C++ Secure Coding Section 01 - Preprocessor (PRE) CERT C++ Secure Coding Section 01 - Preprocessor (PRE)
CWE-87 — Improper Neutralization of Alternate XSS Syntax The product does not neutralize or incorrectly neutralizes user-controlled input for alternate script syntax.
CWE-870 — CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL) CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL)
CWE-871 — CERT C++ Secure Coding Section 03 - Expressions (EXP) CERT C++ Secure Coding Section 03 - Expressions (EXP)
CWE-872 — CERT C++ Secure Coding Section 04 - Integers (INT) CERT C++ Secure Coding Section 04 - Integers (INT)
CWE-873 — CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP) CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)
CWE-874 — CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR) CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)
CWE-875 — CERT C++ Secure Coding Section 07 - Characters and Strings (STR) CERT C++ Secure Coding Section 07 - Characters and Strings (STR)
CWE-876 — CERT C++ Secure Coding Section 08 - Memory Management (MEM) CERT C++ Secure Coding Section 08 - Memory Management (MEM)
CWE-877 — CERT C++ Secure Coding Section 09 - Input Output (FIO) CERT C++ Secure Coding Section 09 - Input Output (FIO)
CWE-878 — CERT C++ Secure Coding Section 10 - Environment (ENV) CERT C++ Secure Coding Section 10 - Environment (ENV)
CWE-879 — CERT C++ Secure Coding Section 11 - Signals (SIG) CERT C++ Secure Coding Section 11 - Signals (SIG)
CWE-88 — Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') The product constructs a string for a command to be executed by a separate component in another control sphere, but...
CWE-880 — CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR) CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)
CWE-881 — CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP) CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP)
CWE-882 — CERT C++ Secure Coding Section 14 - Concurrency (CON) CERT C++ Secure Coding Section 14 - Concurrency (CON)
CWE-883 — CERT C++ Secure Coding Section 49 - Miscellaneous (MSC) CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)
CWE-885 — SFP Primary Cluster: Risky Values SFP Primary Cluster: Risky Values
CWE-886 — SFP Primary Cluster: Unused entities SFP Primary Cluster: Unused entities
CWE-887 — SFP Primary Cluster: API SFP Primary Cluster: API
CWE-889 — SFP Primary Cluster: Exception Management SFP Primary Cluster: Exception Management
CWE-89 — Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') The product constructs all or part of an SQL command using externally-influenced input from an upstream component,...
CWE-890 — SFP Primary Cluster: Memory Access SFP Primary Cluster: Memory Access
CWE-891 — SFP Primary Cluster: Memory Management SFP Primary Cluster: Memory Management
CWE-892 — SFP Primary Cluster: Resource Management SFP Primary Cluster: Resource Management
CWE-893 — SFP Primary Cluster: Path Resolution SFP Primary Cluster: Path Resolution
CWE-894 — SFP Primary Cluster: Synchronization SFP Primary Cluster: Synchronization
CWE-895 — SFP Primary Cluster: Information Leak SFP Primary Cluster: Information Leak
CWE-896 — SFP Primary Cluster: Tainted Input SFP Primary Cluster: Tainted Input
CWE-897 — SFP Primary Cluster: Entry Points SFP Primary Cluster: Entry Points
CWE-898 — SFP Primary Cluster: Authentication SFP Primary Cluster: Authentication
CWE-899 — SFP Primary Cluster: Access Control SFP Primary Cluster: Access Control
CWE-9 — J2EE Misconfiguration: Weak Access Permissions for EJB Methods If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to...
CWE-90 — Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') The product constructs all or part of an LDAP query using externally-influenced input from an upstream component,...
CWE-901 — SFP Primary Cluster: Privilege SFP Primary Cluster: Privilege
CWE-902 — SFP Primary Cluster: Channel SFP Primary Cluster: Channel
CWE-903 — SFP Primary Cluster: Cryptography SFP Primary Cluster: Cryptography
CWE-904 — SFP Primary Cluster: Malware SFP Primary Cluster: Malware
CWE-905 — SFP Primary Cluster: Predictability SFP Primary Cluster: Predictability
CWE-906 — SFP Primary Cluster: UI SFP Primary Cluster: UI
CWE-907 — SFP Primary Cluster: Other SFP Primary Cluster: Other
CWE-908 — Use of Uninitialized Resource The product uses or accesses a resource that has not been initialized.
CWE-909 — Missing Initialization of Resource The product does not initialize a critical resource.
CWE-91 — XML Injection (aka Blind XPath Injection) The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the...
CWE-910 — Use of Expired File Descriptor The product uses or accesses a file descriptor after it has been closed.
CWE-911 — Improper Update of Reference Count The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.
CWE-912 — Hidden Functionality The product contains functionality that is not documented, not part of the specification, and not accessible through...
CWE-913 — Improper Control of Dynamically-Managed Code Resources The product does not properly restrict reading from or writing to dynamically-managed code resources such as...
CWE-914 — Improper Control of Dynamically-Identified Variables The product does not properly restrict reading from or writing to dynamically-identified variables.
CWE-915 — Improperly Controlled Modification of Dynamically-Determined Object Attributes The product receives input from an upstream component that specifies multiple attributes, properties, or fields that...
CWE-916 — Use of Password Hash With Insufficient Computational Effort The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of...
CWE-917 — Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server...
CWE-918 — Server-Side Request Forgery (SSRF) The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL,...
CWE-920 — Improper Restriction of Power Consumption The product operates in an environment in which power is a limited resource that cannot be automatically...
CWE-921 — Storage of Sensitive Data in a Mechanism without Access Control The product stores sensitive information in a file system or device that does not have built-in access control.
CWE-922 — Insecure Storage of Sensitive Information The product stores sensitive information without properly limiting read or write access by unauthorized actors.
CWE-923 — Improper Restriction of Communication Channel to Intended Endpoints The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but...
CWE-924 — Improper Enforcement of Message Integrity During Transmission in a Communication Channel The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it...
CWE-925 — Improper Verification of Intent by Broadcast Receiver The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the...
CWE-926 — Improper Export of Android Application Components The Android application exports a component for use by other applications, but does not properly restrict which...
CWE-927 — Use of Implicit Intent for Sensitive Communication The Android application uses an implicit intent for transmitting sensitive data to other applications.
CWE-93 — Improper Neutralization of CRLF Sequences ('CRLF Injection') The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it...
CWE-939 — Improper Authorization in Handler for Custom URL Scheme The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the...
CWE-94 — Improper Control of Generation of Code ('Code Injection') The product constructs all or part of a code segment using externally-influenced input from an upstream component,...
CWE-940 — Improper Verification of Source of a Communication Channel The product establishes a communication channel to handle an incoming request that has been initiated by an actor,...
CWE-941 — Incorrectly Specified Destination in a Communication Channel The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly...
CWE-942 — Permissive Cross-domain Security Policy with Untrusted Domains The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy...
CWE-943 — Improper Neutralization of Special Elements in Data Query Logic The product generates a query intended to access or manipulate data in a data store such as a database, but it does...
CWE-944 — SFP Secondary Cluster: Access Management SFP Secondary Cluster: Access Management
CWE-945 — SFP Secondary Cluster: Insecure Resource Access SFP Secondary Cluster: Insecure Resource Access
CWE-946 — SFP Secondary Cluster: Insecure Resource Permissions SFP Secondary Cluster: Insecure Resource Permissions
CWE-947 — SFP Secondary Cluster: Authentication Bypass SFP Secondary Cluster: Authentication Bypass
CWE-948 — SFP Secondary Cluster: Digital Certificate SFP Secondary Cluster: Digital Certificate
CWE-949 — SFP Secondary Cluster: Faulty Endpoint Authentication SFP Secondary Cluster: Faulty Endpoint Authentication
CWE-95 — Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code...
CWE-950 — SFP Secondary Cluster: Hardcoded Sensitive Data SFP Secondary Cluster: Hardcoded Sensitive Data
CWE-951 — SFP Secondary Cluster: Insecure Authentication Policy SFP Secondary Cluster: Insecure Authentication Policy
CWE-952 — SFP Secondary Cluster: Missing Authentication SFP Secondary Cluster: Missing Authentication
CWE-953 — SFP Secondary Cluster: Missing Endpoint Authentication SFP Secondary Cluster: Missing Endpoint Authentication
CWE-954 — SFP Secondary Cluster: Multiple Binds to the Same Port SFP Secondary Cluster: Multiple Binds to the Same Port
CWE-955 — SFP Secondary Cluster: Unrestricted Authentication SFP Secondary Cluster: Unrestricted Authentication
CWE-956 — SFP Secondary Cluster: Channel Attack SFP Secondary Cluster: Channel Attack
CWE-957 — SFP Secondary Cluster: Protocol Error SFP Secondary Cluster: Protocol Error

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.