Weakness classes (CWE)

1,245 pages, showing 401–500, ordered by identifier.

CWE-1382 — ICS Operations (& Maintenance): Emerging Energy Technologies ICS Operations (& Maintenance): Emerging Energy Technologies
CWE-1383 — ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements
CWE-1384 — Improper Handling of Physical or Environmental Conditions The product does not properly handle unexpected physical or environmental conditions that occur naturally or are...
CWE-1385 — Missing Origin Validation in WebSockets The product uses a WebSocket, but it does not properly verify that the source of data or communication is valid.
CWE-1386 — Insecure Operation on Windows Junction / Mount Point The product opens a file or directory, but it does not properly prevent the name from being associated with a...
CWE-1388 — Physical Access Issues and Concerns Physical Access Issues and Concerns
CWE-1389 — Incorrect Parsing of Numbers with Different Radices The product parses numeric input assuming base 10 (decimal) values, but it does not account for inputs that use a...
CWE-1390 — Weak Authentication The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism...
CWE-1391 — Use of Weak Credentials The product uses weak credentials (such as a default key or hard-coded password) that can be calculated, derived,...
CWE-1392 — Use of Default Credentials The product uses default credentials (such as passwords or cryptographic keys) for potentially critical functionality.
CWE-1393 — Use of Default Password The product uses default passwords for potentially critical functionality.
CWE-1394 — Use of Default Cryptographic Key The product uses a default cryptographic key for potentially critical functionality.
CWE-1395 — Dependency on Vulnerable Third-Party Component The product has a dependency on a third-party component that contains one or more known vulnerabilities.
CWE-1396 — Comprehensive Categorization: Access Control Comprehensive Categorization: Access Control
CWE-1397 — Comprehensive Categorization: Comparison Comprehensive Categorization: Comparison
CWE-1398 — Comprehensive Categorization: Component Interaction Comprehensive Categorization: Component Interaction
CWE-1399 — Comprehensive Categorization: Memory Safety Comprehensive Categorization: Memory Safety
CWE-14 — Compiler Removal of Code to Clear Buffers Sensitive memory is cleared according to the source code, but compiler optimizations leave the memory untouched when...
CWE-140 — Improper Neutralization of Delimiters The product does not neutralize or incorrectly neutralizes delimiters.
CWE-1401 — Comprehensive Categorization: Concurrency Comprehensive Categorization: Concurrency
CWE-1402 — Comprehensive Categorization: Encryption Comprehensive Categorization: Encryption
CWE-1403 — Comprehensive Categorization: Exposed Resource Comprehensive Categorization: Exposed Resource
CWE-1404 — Comprehensive Categorization: File Handling Comprehensive Categorization: File Handling
CWE-1405 — Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions
CWE-1406 — Comprehensive Categorization: Improper Input Validation Comprehensive Categorization: Improper Input Validation
CWE-1407 — Comprehensive Categorization: Improper Neutralization Comprehensive Categorization: Improper Neutralization
CWE-1408 — Comprehensive Categorization: Incorrect Calculation Comprehensive Categorization: Incorrect Calculation
CWE-1409 — Comprehensive Categorization: Injection Comprehensive Categorization: Injection
CWE-141 — Improper Neutralization of Parameter/Argument Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-1410 — Comprehensive Categorization: Insufficient Control Flow Management Comprehensive Categorization: Insufficient Control Flow Management
CWE-1411 — Comprehensive Categorization: Insufficient Verification of Data Authenticity Comprehensive Categorization: Insufficient Verification of Data Authenticity
CWE-1412 — Comprehensive Categorization: Poor Coding Practices Comprehensive Categorization: Poor Coding Practices
CWE-1413 — Comprehensive Categorization: Protection Mechanism Failure Comprehensive Categorization: Protection Mechanism Failure
CWE-1414 — Comprehensive Categorization: Randomness Comprehensive Categorization: Randomness
CWE-1415 — Comprehensive Categorization: Resource Control Comprehensive Categorization: Resource Control
CWE-1416 — Comprehensive Categorization: Resource Lifecycle Management Comprehensive Categorization: Resource Lifecycle Management
CWE-1417 — Comprehensive Categorization: Sensitive Information Exposure Comprehensive Categorization: Sensitive Information Exposure
CWE-1418 — Comprehensive Categorization: Violation of Secure Design Principles Comprehensive Categorization: Violation of Secure Design Principles
CWE-1419 — Incorrect Initialization of Resource The product attempts to initialize a resource but does not correctly do so, which might leave the resource in an...
CWE-142 — Improper Neutralization of Value Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-1420 — Exposure of Sensitive Information during Transient Execution A processor event or prediction may allow incorrect operations (or correct operations with incorrect data) to...
CWE-1421 — Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution A processor event may allow transient operations to access architecturally restricted data (for example, in another...
CWE-1422 — Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution A processor event or prediction may allow incorrect or stale data to be forwarded to transient operations,...
CWE-1423 — Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution Shared microarchitectural predictor state may allow code to influence transient execution across a hardware...
CWE-1426 — Improper Validation of Generative AI Output The product invokes a generative AI/ML component whose behaviors and outputs cannot be directly controlled, but the...
CWE-1427 — Improper Neutralization of Input Used for LLM Prompting The product uses externally-provided data to build prompts provided to large language models (LLMs), but the way...
CWE-1428 — Reliance on HTTP instead of HTTPS The product provides or relies on use of HTTP communications when HTTPS is available.
CWE-1429 — Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface The product has a hardware interface that silently discards operations in situations for which feedback would be...
CWE-143 — Improper Neutralization of Record Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-1431 — Driving Intermediate Cryptographic State/Results to Hardware Module Outputs The product uses a hardware module implementing a cryptographic algorithm that writes sensitive information about...
CWE-1434 — Insecure Setting of Generative AI/ML Model Inference Parameters The product has a component that relies on a generative AI/ML model configured with inference parameters that...
CWE-1436 — OWASP Top Ten 2025 Category A01:2025 - Broken Access Control OWASP Top Ten 2025 Category A01:2025 - Broken Access Control
CWE-1437 — OWASP Top Ten 2025 Category A02:2025 - Security Misconfiguration OWASP Top Ten 2025 Category A02:2025 - Security Misconfiguration
CWE-1438 — OWASP Top Ten 2025 Category A03:2025 - Software Supply Chain Failures OWASP Top Ten 2025 Category A03:2025 - Software Supply Chain Failures
CWE-1439 — OWASP Top Ten 2025 Category A04:2025 - Cryptographic Failures OWASP Top Ten 2025 Category A04:2025 - Cryptographic Failures
CWE-144 — Improper Neutralization of Line Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-1440 — OWASP Top Ten 2025 Category A05:2025 - Injection OWASP Top Ten 2025 Category A05:2025 - Injection
CWE-1441 — OWASP Top Ten 2025 Category A06:2025 - Insecure Design OWASP Top Ten 2025 Category A06:2025 - Insecure Design
CWE-1442 — OWASP Top Ten 2025 Category A07:2025 - Authentication Failures OWASP Top Ten 2025 Category A07:2025 - Authentication Failures
CWE-1443 — OWASP Top Ten 2025 Category A08:2025 - Software or Data Integrity Failures OWASP Top Ten 2025 Category A08:2025 - Software or Data Integrity Failures
CWE-1444 — OWASP Top Ten 2025 Category A09:2025 - Logging & Alerting Failures OWASP Top Ten 2025 Category A09:2025 - Logging & Alerting Failures
CWE-1445 — OWASP Top Ten 2025 Category A10:2025 - Mishandling of Exceptional Conditions OWASP Top Ten 2025 Category A10:2025 - Mishandling of Exceptional Conditions
CWE-1446 — Weaknesses That are Specific to AI/ML Technology Weaknesses That are Specific to AI/ML Technology
CWE-1447 — General Software Weaknesses that Appear in Products that Use or Support AI/ML Technology General Software Weaknesses that Appear in Products that Use or Support AI/ML Technology
CWE-145 — Improper Neutralization of Section Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-146 — Improper Neutralization of Expression/Command Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-147 — Improper Neutralization of Input Terminators The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-148 — Improper Neutralization of Input Leaders The product does not properly handle when a leading character or sequence ('leader') is missing or malformed, or if...
CWE-149 — Improper Neutralization of Quoting Syntax Quotes injected into a product can be used to compromise a system. As data are parsed, an...
CWE-15 — External Control of System or Configuration Setting One or more system settings or configuration elements can be externally controlled by a user.
CWE-150 — Improper Neutralization of Escape, Meta, or Control Sequences The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-151 — Improper Neutralization of Comment Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-152 — Improper Neutralization of Macro Symbols The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-153 — Improper Neutralization of Substitution Characters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-154 — Improper Neutralization of Variable Name Delimiters The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-155 — Improper Neutralization of Wildcards or Matching Symbols The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-156 — Improper Neutralization of Whitespace The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special...
CWE-157 — Failure to Sanitize Paired Delimiters The product does not properly handle the characters that are used to mark the beginning and ending of a group of...
CWE-158 — Improper Neutralization of Null Byte or NUL Character The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes NUL...
CWE-159 — Improper Handling of Invalid Use of Special Elements The product does not properly filter, remove, quote, or otherwise manage the invalid use of special elements in...
CWE-160 — Improper Neutralization of Leading Special Elements The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes leading...
CWE-161 — Improper Neutralization of Multiple Leading Special Elements The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes...
CWE-162 — Improper Neutralization of Trailing Special Elements The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes...
CWE-163 — Improper Neutralization of Multiple Trailing Special Elements The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes...
CWE-164 — Improper Neutralization of Internal Special Elements The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes...
CWE-165 — Improper Neutralization of Multiple Internal Special Elements The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes...
CWE-166 — Improper Handling of Missing Special Element The product receives input from an upstream component, but it does not handle or incorrectly handles when an...
CWE-167 — Improper Handling of Additional Special Element The product receives input from an upstream component, but it does not handle or incorrectly handles when an...
CWE-168 — Improper Handling of Inconsistent Special Elements The product does not properly handle input in which an inconsistency exists between two or more special characters...
CWE-170 — Improper Null Termination The product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
CWE-172 — Encoding Error The product does not properly encode or decode the data, resulting in unexpected values.
CWE-173 — Improper Handling of Alternate Encoding The product does not properly handle when an input uses an alternate encoding that is valid for the control sphere...
CWE-174 — Double Decoding of the Same Data The product decodes the same input twice, which can limit the effectiveness of any protection mechanism that occurs...
CWE-175 — Improper Handling of Mixed Encoding The product does not properly handle when the same input uses several different (mixed) encodings.
CWE-176 — Improper Handling of Unicode Encoding The product does not properly handle when an input contains Unicode encoding.
CWE-177 — Improper Handling of URL Encoding (Hex Encoding) The product does not properly handle when all or part of an input has been URL encoded.
CWE-178 — Improper Handling of Case Sensitivity The product does not properly account for differences in case sensitivity when accessing or determining the...
CWE-179 — Incorrect Behavior Order: Early Validation The product validates input before applying protection mechanisms that modify the input, which could allow an...
CWE-180 — Incorrect Behavior Order: Validate Before Canonicalize The product validates input before it is canonicalized, which prevents the product from detecting data that becomes...
CWE-181 — Incorrect Behavior Order: Validate Before Filter The product validates data before it has been filtered, which prevents the product from detecting data that becomes...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.