Weakness classes (CWE)

1,245 pages, showing 501–600, ordered by identifier.

CWE-182 — Collapse of Data into Unsafe Value The product filters data in a way that causes it to be reduced or 'collapsed' into an unsafe value that violates an...
CWE-183 — Permissive List of Allowed Inputs The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are...
CWE-184 — Incomplete List of Disallowed Inputs The product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not...
CWE-185 — Incorrect Regular Expression The product specifies a regular expression in a way that causes data to be improperly matched or compared.
CWE-186 — Overly Restrictive Regular Expression A regular expression is overly restrictive, which prevents dangerous values from being detected.
CWE-187 — Partial String Comparison The product performs a comparison that only examines a portion of a factor before determining whether there is a...
CWE-188 — Reliance on Data/Memory Layout The product makes invalid assumptions about how protocol data or memory is organized at a lower level, resulting in...
CWE-189 — Numeric Errors Numeric Errors
CWE-19 — Data Processing Errors Data Processing Errors
CWE-190 — Integer Overflow or Wraparound The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that...
CWE-191 — Integer Underflow (Wrap or Wraparound) The product subtracts one value from another, such that the result is less than the minimum allowable integer value,...
CWE-192 — Integer Coercion Error Integer coercion refers to a set of flaws pertaining to the type casting, extension, or truncation of primitive data types.
CWE-193 — Off-by-one Error A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-194 — Unexpected Sign Extension The product performs an operation on a number that causes it to be sign extended when it is transformed into a...
CWE-195 — Signed to Unsigned Conversion Error The product uses a signed primitive and performs a cast to an unsigned primitive, which can produce an unexpected...
CWE-196 — Unsigned to Signed Conversion Error The product uses an unsigned primitive and performs a cast to a signed primitive, which can produce an unexpected...
CWE-197 — Numeric Truncation Error Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.
CWE-198 — Use of Incorrect Byte Ordering The product receives input from an upstream component, but it does not account for byte ordering (e.g. big-endian...
CWE-199 — Information Management Errors Information Management Errors
CWE-2 — 7PK - Environment 7PK - Environment
CWE-20 — Improper Input Validation The product receives input or data, but it does not validate or incorrectly validates that the input has the...
CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-201 — Insertion of Sensitive Information Into Sent Data The code transmits data to another actor, but a portion of the data includes sensitive information that should not...
CWE-202 — Exposure of Sensitive Information Through Data Queries When trying to keep information confidential, an attacker can often infer some of the information by using statistics.
CWE-203 — Observable Discrepancy The product behaves differently or sends different responses under different circumstances in a way that is...
CWE-204 — Observable Response Discrepancy The product provides different responses to incoming requests in a way that reveals internal state information to an...
CWE-205 — Observable Behavioral Discrepancy The product's behaviors indicate important differences that may be observed by unauthorized actors in a way that...
CWE-206 — Observable Internal Behavioral Discrepancy The product performs multiple behaviors that are combined to produce a single result, but the individual behaviors...
CWE-207 — Observable Behavioral Discrepancy With Equivalent Products The product operates in an environment in which its existence or specific identity should not be known, but it...
CWE-208 — Observable Timing Discrepancy Two separate operations in a product require different amounts of time to complete, in a way that is observable to...
CWE-209 — Generation of Error Message Containing Sensitive Information The product generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-210 — Self-generated Error Message Containing Sensitive Information The product identifies an error condition and creates its own diagnostic or error messages that contain sensitive...
CWE-211 — Externally-Generated Error Message Containing Sensitive Information The product performs an operation that triggers an external diagnostic or error message that is not directly...
CWE-212 — Improper Removal of Sensitive Information Before Storage or Transfer The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly...
CWE-213 — Exposure of Sensitive Information Due to Incompatible Policies The product's intended functionality exposes information to certain actors in accordance with the developer's...
CWE-214 — Invocation of Process Using Visible Sensitive Information A process is invoked with sensitive command-line arguments, environment variables, or other elements that can be...
CWE-215 — Insertion of Sensitive Information Into Debugging Code The product inserts sensitive information into debugging code, which could expose this information if the debugging...
CWE-219 — Storage of File with Sensitive Data Under Web Root The product stores sensitive data under the web document root with insufficient access control, which might make it...
CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') The product uses external input to construct a pathname that is intended to identify a file or directory that is...
CWE-220 — Storage of File With Sensitive Data Under FTP Root The product stores sensitive data under the FTP server root with insufficient access control, which might make it...
CWE-221 — Information Loss or Omission The product does not record, or improperly records, security-relevant information that leads to an incorrect...
CWE-222 — Truncation of Security-relevant Information The product truncates the display, recording, or processing of security-relevant information in a way that can...
CWE-223 — Omission of Security-relevant Information The product does not record or display information that would be important for identifying the source or nature of...
CWE-224 — Obscured Security-relevant Information by Alternate Name The product records security-relevant information according to an alternate name of the affected entity, instead of...
CWE-226 — Sensitive Information in Resource Not Removed Before Reuse The product releases a resource such as memory or a file so that it can be made available for reuse, but it does not...
CWE-227 — 7PK - API Abuse 7PK - API Abuse
CWE-228 — Improper Handling of Syntactically Invalid Structure The product does not handle or incorrectly handles input that is not syntactically well-formed with respect to the...
CWE-229 — Improper Handling of Values The product does not properly handle when the expected number of values for parameters, fields, or arguments is not...
CWE-23 — Relative Path Traversal The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-230 — Improper Handling of Missing Values The product does not handle or incorrectly handles when a parameter, field, or argument name is specified, but the...
CWE-231 — Improper Handling of Extra Values The product does not handle or incorrectly handles when more values are provided than expected.
CWE-232 — Improper Handling of Undefined Values The product does not handle or incorrectly handles when a value is not defined or supported for the associated...
CWE-233 — Improper Handling of Parameters The product does not properly handle when the expected number of parameters, fields, or arguments is not provided in...
CWE-234 — Failure to Handle Missing Parameter If too few arguments are sent to a function, the function will still pop the expected number of arguments from the...
CWE-235 — Improper Handling of Extra Parameters The product does not handle or incorrectly handles when the number of parameters, fields, or arguments with the same...
CWE-236 — Improper Handling of Undefined Parameters The product does not handle or incorrectly handles when a particular parameter, field, or argument name is not...
CWE-237 — Improper Handling of Structural Elements The product does not handle or incorrectly handles inputs that are related to complex structures.
CWE-238 — Improper Handling of Incomplete Structural Elements The product does not handle or incorrectly handles when a particular structural element is not completely specified.
CWE-239 — Failure to Handle Incomplete Element The product does not properly handle when a particular element is not completely specified.
CWE-24 — Path Traversal: '../filedir' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-240 — Improper Handling of Inconsistent Structural Elements The product does not handle or incorrectly handles when two or more structural elements should be consistent, but are not.
CWE-241 — Improper Handling of Unexpected Data Type The product does not handle or incorrectly handles when a particular element is not the expected type, e.g. it...
CWE-242 — Use of Inherently Dangerous Function The product calls a function that can never be guaranteed to work safely.
CWE-243 — Creation of chroot Jail Without Changing Working Directory The product uses the chroot() system call to create a jail, but does not change the working directory afterward....
CWE-244 — Improper Clearing of Heap Memory Before Release ('Heap Inspection') Using realloc() to resize buffers that store sensitive information can leave the sensitive information exposed to...
CWE-245 — J2EE Bad Practices: Direct Management of Connections The J2EE application directly manages connections, instead of using the container's connection management facilities.
CWE-246 — J2EE Bad Practices: Direct Use of Sockets The J2EE application directly uses sockets instead of using framework method calls.
CWE-248 — Uncaught Exception An exception is thrown from a function, but it is not caught.
CWE-25 — Path Traversal: '/../filedir' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-250 — Execution with Unnecessary Privileges The product performs an operation at a privilege level that is higher than the minimum level required, which creates...
CWE-251 — Often Misused: String Management Often Misused: String Management
CWE-252 — Unchecked Return Value The product does not check the return value from a method or function, which can prevent it from detecting...
CWE-253 — Incorrect Check of Function Return Value The product incorrectly checks a return value from a function, which prevents it from detecting errors or...
CWE-254 — 7PK - Security Features 7PK - Security Features
CWE-255 — Credentials Management Errors Credentials Management Errors
CWE-256 — Plaintext Storage of a Password The product stores a password in plaintext within resources such as memory or files.
CWE-257 — Storing Passwords in a Recoverable Format The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In...
CWE-258 — Empty Password in Configuration File Using an empty string as a password is insecure.
CWE-259 — Use of Hard-coded Password The product contains a hard-coded password, which it uses for its own inbound authentication or for outbound...
CWE-26 — Path Traversal: '/dir/../filename' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-260 — Password in Configuration File The product stores a password in a configuration file that might be accessible to actors who do not know the password.
CWE-261 — Weak Encoding for Password Obscuring a password with a trivial encoding does not protect the password.
CWE-262 — Not Using Password Aging The product does not have a mechanism in place for managing password aging.
CWE-263 — Password Aging with Long Expiration The product supports password aging, but the expiration period is too long.
CWE-265 — Privilege Issues Privilege Issues
CWE-266 — Incorrect Privilege Assignment A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
CWE-267 — Privilege Defined With Unsafe Actions A particular privilege, role, capability, or right can be used to perform unsafe actions that were not intended,...
CWE-268 — Privilege Chaining Two distinct privileges, roles, capabilities, or rights can be combined in a way that allows an entity to perform...
CWE-269 — Improper Privilege Management The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere...
CWE-27 — Path Traversal: 'dir/../../filename' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-270 — Privilege Context Switching Error The product does not properly manage privileges while it is switching between different contexts that have different...
CWE-271 — Privilege Dropping / Lowering Errors The product does not drop privileges before passing control of a resource to an actor that does not have those privileges.
CWE-272 — Least Privilege Violation The elevated privilege level required to perform operations such as chroot() should be dropped immediately after the...
CWE-273 — Improper Check for Dropped Privileges The product attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
CWE-274 — Improper Handling of Insufficient Privileges The product does not handle or incorrectly handles when it has insufficient privileges to perform an operation,...
CWE-275 — Permission Issues Permission Issues
CWE-276 — Incorrect Default Permissions During installation, installed file permissions are set to allow anyone to modify those files.
CWE-277 — Insecure Inherited Permissions A product defines a set of insecure permissions that are inherited by objects that are created by the program.
CWE-278 — Insecure Preserved Inherited Permissions A product inherits a set of insecure permissions for an object, e.g. when copying from an archive file, without user...
CWE-279 — Incorrect Execution-Assigned Permissions While it is executing, the product sets the permissions of an object in a way that violates the intended permissions...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.