Weakness classes (CWE)

1,245 pages, showing 101–200, ordered by identifier.

CWE-1098 — Data Element containing Pointer Item without Proper Copy Control Element The code contains a data element with a pointer that does not have an associated copy or constructor method.
CWE-1099 — Inconsistent Naming Conventions for Identifiers The product's code, documentation, or other artifacts do not consistently use the same naming conventions for...
CWE-11 — ASP.NET Misconfiguration: Creating Debug Binary Debugging messages help attackers learn about the system and plan a form of attack.
CWE-110 — Struts: Validator Without Form Field Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.
CWE-1100 — Insufficient Isolation of System-Dependent Functions The product or code does not isolate system-dependent functionality into separate standalone modules.
CWE-1101 — Reliance on Runtime Component in Generated Code The product uses automatically-generated code that cannot be executed without a specific runtime support component.
CWE-1102 — Reliance on Machine-Dependent Data Representation The code uses a data representation that relies on low-level data representation or constructs that may vary across...
CWE-1103 — Use of Platform-Dependent Third Party Components The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.
CWE-1104 — Use of Unmaintained Third Party Components The product relies on third-party components that are not actively supported or maintained by the original developer...
CWE-1105 — Insufficient Encapsulation of Machine-Dependent Functionality The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this...
CWE-1106 — Insufficient Use of Symbolic Constants The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.
CWE-1107 — Insufficient Isolation of Symbolic Constant Definitions The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into...
CWE-1108 — Excessive Reliance on Global Variables The code is structured in a way that relies too much on using or setting global variables throughout various points...
CWE-1109 — Use of Same Variable for Multiple Purposes The code contains a callable, block, or other code element in which the same variable is used to control more than...
CWE-111 — Direct Use of Unsafe JNI When a Java application uses the Java Native Interface (JNI) to call code written in another programming language,...
CWE-1110 — Incomplete Design Documentation The product's design documentation does not adequately describe control flow, data flow, system initialization,...
CWE-1111 — Incomplete I/O Documentation The product's documentation does not adequately define inputs, outputs, or system/software interfaces.
CWE-1112 — Incomplete Documentation of Program Execution The document does not fully define all mechanisms that are used to control or influence how product-specific...
CWE-1113 — Inappropriate Comment Style The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.
CWE-1114 — Inappropriate Whitespace Style The source code contains whitespace that is inconsistent across the code or does not follow expected standards for...
CWE-1115 — Source Code Element without Standard Prologue The source code contains elements such as source files that do not consistently provide a prologue or header that...
CWE-1116 — Inaccurate Source Code Comments The source code contains comments that do not accurately describe or explain aspects of the portion of the code with...
CWE-1117 — Callable with Insufficient Behavioral Summary The code contains a function or method whose signature and/or associated inline documentation does not sufficiently...
CWE-1118 — Insufficient Documentation of Error Handling Techniques The documentation does not sufficiently describe the techniques that are used for error handling, exception...
CWE-1119 — Excessive Use of Unconditional Branching The code uses too many unconditional branches (such as 'goto').
CWE-112 — Missing XML Validation The product accepts XML from an untrusted source but does not validate the XML against the proper schema.
CWE-1120 — Excessive Code Complexity The code is too complex, as calculated using a well-defined, quantitative measure.
CWE-1121 — Excessive McCabe Cyclomatic Complexity The code contains McCabe cyclomatic complexity that exceeds a desirable maximum.
CWE-1122 — Excessive Halstead Complexity The code is structured in a way that a Halstead complexity measure exceeds a desirable maximum.
CWE-1123 — Excessive Use of Self-Modifying Code The product uses too much self-modifying code.
CWE-1124 — Excessively Deep Nesting The code contains a callable or other code grouping in which the nesting / branching is too deep.
CWE-1125 — Excessive Attack Surface The product has an attack surface whose quantitative measurement exceeds a desirable maximum.
CWE-1126 — Declaration of Variable with Unnecessarily Wide Scope The source code declares a variable in one scope, but the variable is only used within a narrower scope.
CWE-1127 — Compilation with Insufficient Warnings or Errors The code is compiled without sufficient warnings enabled, which may prevent the detection of subtle bugs or quality issues.
CWE-1129 — CISQ Quality Measures (2016) - Reliability CISQ Quality Measures (2016) - Reliability
CWE-113 — Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not...
CWE-1130 — CISQ Quality Measures (2016) - Maintainability CISQ Quality Measures (2016) - Maintainability
CWE-1131 — CISQ Quality Measures (2016) - Security CISQ Quality Measures (2016) - Security
CWE-1132 — CISQ Quality Measures (2016) - Performance Efficiency CISQ Quality Measures (2016) - Performance Efficiency
CWE-1134 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)
CWE-1135 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL)
CWE-1136 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)
CWE-1137 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM)
CWE-1138 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR)
CWE-1139 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)
CWE-114 — Process Control Executing commands or loading libraries from an untrusted source or in an untrusted environment can cause an...
CWE-1140 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)
CWE-1141 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR)
CWE-1142 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA)
CWE-1143 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK)
CWE-1144 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI)
CWE-1145 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)
CWE-1146 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM)
CWE-1147 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO)
CWE-1148 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER)
CWE-1149 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC)
CWE-115 — Misinterpretation of Input The product misinterprets an input, whether from an attacker or another product, in a security-relevant fashion.
CWE-1150 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV)
CWE-1151 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI)
CWE-1152 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)
CWE-1153 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD)
CWE-1155 — SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE) SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE)
CWE-1156 — SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL) SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL)
CWE-1157 — SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP) SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)
CWE-1158 — SEI CERT C Coding Standard - Guidelines 04. Integers (INT) SEI CERT C Coding Standard - Guidelines 04. Integers (INT)
CWE-1159 — SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP) SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)
CWE-116 — Improper Encoding or Escaping of Output The product prepares a structured message for communication with another component, but encoding or escaping of the...
CWE-1160 — SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR) SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR)
CWE-1161 — SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR) SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR)
CWE-1162 — SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM) SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
CWE-1163 — SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO) SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)
CWE-1164 — Irrelevant Code The product contains code that is not essential for execution, i.e. makes no state changes and has no side effects...
CWE-1165 — SEI CERT C Coding Standard - Guidelines 10. Environment (ENV) SEI CERT C Coding Standard - Guidelines 10. Environment (ENV)
CWE-1166 — SEI CERT C Coding Standard - Guidelines 11. Signals (SIG) SEI CERT C Coding Standard - Guidelines 11. Signals (SIG)
CWE-1167 — SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR) SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)
CWE-1168 — SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API) SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API)
CWE-1169 — SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON) SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON)
CWE-117 — Improper Output Neutralization for Logs The product constructs a log message from external input, but it does not neutralize or incorrectly neutralizes...
CWE-1170 — SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC) SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)
CWE-1171 — SEI CERT C Coding Standard - Guidelines 50. POSIX (POS) SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
CWE-1172 — SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN) SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN)
CWE-1173 — Improper Use of Validation Framework The product does not use, or incorrectly uses, an input validation framework that is provided by the source language...
CWE-1174 — ASP.NET Misconfiguration: Improper Model Validation The ASP.NET application does not use, or incorrectly uses, the model validation framework.
CWE-1175 — SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON) SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON)
CWE-1176 — Inefficient CPU Computation The product performs CPU computations using algorithms that are not as efficient as they could be for the needs of...
CWE-1177 — Use of Prohibited Code The product uses a function, library, or third party component that has been explicitly prohibited, whether by the...
CWE-1179 — SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS) SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS)
CWE-118 — Incorrect Access of Indexable Resource ('Range Error') The product does not restrict or incorrectly restricts operations within the boundaries of a resource that is...
CWE-1180 — SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL) SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL)
CWE-1181 — SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP) SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP)
CWE-1182 — SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT) SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT)
CWE-1183 — SEI CERT Perl Coding Standard - Guidelines 05. Strings (STR) SEI CERT Perl Coding Standard - Guidelines 05. Strings (STR)
CWE-1184 — SEI CERT Perl Coding Standard - Guidelines 06. Object-Oriented Programming (OOP) SEI CERT Perl Coding Standard - Guidelines 06. Object-Oriented Programming (OOP)
CWE-1185 — SEI CERT Perl Coding Standard - Guidelines 07. File Input and Output (FIO) SEI CERT Perl Coding Standard - Guidelines 07. File Input and Output (FIO)
CWE-1186 — SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC) SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)
CWE-1188 — Initialization of a Resource with an Insecure Default The product initializes or sets a resource with a default that is intended to be changed by the product's installer,...
CWE-1189 — Improper Isolation of Shared Resources on System-on-a-Chip (SoC) The System-On-a-Chip (SoC) does not properly isolate shared resources between trusted and untrusted agents.
CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the...
CWE-1190 — DMA Device Enabled Too Early in Boot Phase The product enables a Direct Memory Access (DMA) capable device before the security configuration settings are...
CWE-1191 — On-Chip Debug and Test Interface With Improper Access Control The chip does not implement or does not correctly perform access control to check whether users are authorized to...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.