Weakness classes (CWE)

1,245 pages, showing 601–700, ordered by identifier.

CWE-28 — Path Traversal: '..\filedir' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-280 — Improper Handling of Insufficient Permissions or Privileges The product does not handle or incorrectly handles when it has insufficient privileges to access resources or...
CWE-281 — Improper Preservation of Permissions The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing...
CWE-282 — Improper Ownership Management The product assigns the wrong ownership, or does not properly verify the ownership, of an object or resource.
CWE-283 — Unverified Ownership The product does not properly verify that a critical resource is owned by the proper entity.
CWE-284 — Improper Access Control The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-285 — Improper Authorization The product does not perform or incorrectly performs an authorization check when an actor attempts to access a...
CWE-286 — Incorrect User Management The product does not properly manage a user within its environment.
CWE-287 — Improper Authentication When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-288 — Authentication Bypass Using an Alternate Path or Channel The product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-289 — Authentication Bypass by Alternate Name The product performs authentication based on the name of a resource being accessed, or the name of the actor...
CWE-29 — Path Traversal: '\..\filename' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-290 — Authentication Bypass by Spoofing This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to...
CWE-291 — Reliance on IP Address for Authentication The product uses an IP address for authentication.
CWE-293 — Using Referer Field for Authentication The referer field in HTTP requests can be easily modified and, as such, is not a valid means of message integrity checking.
CWE-294 — Authentication Bypass by Capture-replay A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network...
CWE-295 — Improper Certificate Validation The product does not validate, or incorrectly validates, a certificate.
CWE-296 — Improper Following of a Certificate's Chain of Trust The product does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate.
CWE-297 — Improper Validation of Certificate with Host Mismatch The product communicates with a host that provides a certificate, but the product does not properly ensure that the...
CWE-298 — Improper Validation of Certificate Expiration A certificate expiration is not validated or is incorrectly validated.
CWE-299 — Improper Check for Certificate Revocation The product does not check or incorrectly checks the revocation status of a certificate, which may cause it to use a...
CWE-30 — Path Traversal: '\dir\..\filename' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-300 — Channel Accessible by Non-Endpoint The product does not adequately verify the identity of actors at both ends of a communication channel, or does not...
CWE-301 — Reflection Attack in an Authentication Protocol Simple authentication protocols are subject to reflection attacks if a malicious user can use the target machine to...
CWE-302 — Authentication Bypass by Assumed-Immutable Data The authentication scheme or implementation uses key data elements that are assumed to be immutable, but can be...
CWE-303 — Incorrect Implementation of Authentication Algorithm The requirements for the product dictate the use of an established authentication algorithm, but the implementation...
CWE-304 — Missing Critical Step in Authentication The product implements an authentication technique, but it skips a step that weakens the technique.
CWE-305 — Authentication Bypass by Primary Weakness The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate...
CWE-306 — Missing Authentication for Critical Function The product does not perform any authentication for functionality that requires a provable user identity or consumes...
CWE-307 — Improper Restriction of Excessive Authentication Attempts The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short...
CWE-308 — Use of Single-factor Authentication The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that...
CWE-309 — Use of Password System for Primary Authentication The use of password systems as the primary means of authentication may be subject to several flaws or shortcomings,...
CWE-31 — Path Traversal: 'dir\..\..\filename' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-310 — Cryptographic Issues Cryptographic Issues
CWE-311 — Missing Encryption of Sensitive Data The product does not encrypt sensitive or critical information before storage or transmission.
CWE-312 — Cleartext Storage of Sensitive Information The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-313 — Cleartext Storage in a File or on Disk The product stores sensitive information in cleartext in a file, or on disk.
CWE-314 — Cleartext Storage in the Registry The product stores sensitive information in cleartext in the registry.
CWE-315 — Cleartext Storage of Sensitive Information in a Cookie The product stores sensitive information in cleartext in a cookie.
CWE-316 — Cleartext Storage of Sensitive Information in Memory The product stores sensitive information in cleartext in memory.
CWE-317 — Cleartext Storage of Sensitive Information in GUI The product stores sensitive information in cleartext within the GUI.
CWE-318 — Cleartext Storage of Sensitive Information in Executable The product stores sensitive information in cleartext in an executable.
CWE-319 — Cleartext Transmission of Sensitive Information The product transmits sensitive or security-critical data in cleartext in a communication channel that can be...
CWE-32 — Path Traversal: '...' (Triple Dot) The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-321 — Use of Hard-coded Cryptographic Key The product uses a hard-coded, unchangeable cryptographic key.
CWE-322 — Key Exchange without Entity Authentication The product performs a key exchange with an actor without verifying the identity of that actor.
CWE-323 — Reusing a Nonce, Key Pair in Encryption Nonces should be used for the present occasion and only once.
CWE-324 — Use of a Key Past its Expiration Date The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly...
CWE-325 — Missing Cryptographic Step The product does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than...
CWE-326 — Inadequate Encryption Strength The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not...
CWE-327 — Use of a Broken or Risky Cryptographic Algorithm The product uses a broken or risky cryptographic algorithm or protocol.
CWE-328 — Use of Weak Hash The product uses an algorithm that produces a digest (output value) that does not meet security expectations for a...
CWE-329 — Generation of Predictable IV with CBC Mode The product generates and uses a predictable initialization Vector (IV) with Cipher Block Chaining (CBC) Mode, which...
CWE-33 — Path Traversal: '....' (Multiple Dot) The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-330 — Use of Insufficiently Random Values The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE-331 — Insufficient Entropy The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values...
CWE-332 — Insufficient Entropy in PRNG The lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and...
CWE-333 — Improper Handling of Insufficient Entropy in TRNG True random number generators (TRNG) generally have a limited source of entropy and therefore can fail or block.
CWE-334 — Small Space of Random Values The number of possible random values is smaller than needed by the product, making it more susceptible to brute...
CWE-335 — Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
CWE-336 — Same Seed in Pseudo-Random Number Generator (PRNG) A Pseudo-Random Number Generator (PRNG) uses the same seed each time the product is initialized.
CWE-337 — Predictable Seed in Pseudo-Random Number Generator (PRNG) A Pseudo-Random Number Generator (PRNG) is initialized from a predictable seed, such as the process ID or system time.
CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not...
CWE-339 — Small Seed Space in PRNG A Pseudo-Random Number Generator (PRNG) uses a relatively small seed space, which makes it more susceptible to brute...
CWE-34 — Path Traversal: '....//' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-340 — Generation of Predictable Numbers or Identifiers The product uses a scheme that generates numbers or identifiers that are more predictable than required.
CWE-341 — Predictable from Observable State A number or object is predictable based on observations that the attacker can make about the state of the system or...
CWE-342 — Predictable Exact Value from Previous Values An exact value or random number can be precisely predicted by observing previous values.
CWE-343 — Predictable Value Range from Previous Values The product's random number generator produces a series of values which, when observed, can be used to infer a...
CWE-344 — Use of Invariant Value in Dynamically Changing Context The product uses a constant value, name, or reference, but this value can (or should) vary across different environments.
CWE-345 — Insufficient Verification of Data Authenticity The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-346 — Origin Validation Error The product does not properly verify that the source of data or communication is valid.
CWE-347 — Improper Verification of Cryptographic Signature The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-348 — Use of Less Trusted Source The product has two different sources of the same data or information, but it uses the source that has less support...
CWE-349 — Acceptance of Extraneous Untrusted Data With Trusted Data The product, when processing trusted data, accepts any untrusted data that is also included with the trusted data,...
CWE-35 — Path Traversal: '.../...//' The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-350 — Reliance on Reverse DNS Resolution for a Security-Critical Action The product performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision,...
CWE-351 — Insufficient Type Distinction The product does not properly distinguish between different types of elements in a way that leads to insecure behavior.
CWE-352 — Cross-Site Request Forgery (CSRF) The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the...
CWE-353 — Missing Support for Integrity Check The product uses a transmission protocol that does not include a mechanism for verifying the integrity of the data...
CWE-354 — Improper Validation of Integrity Check Value The product does not validate or incorrectly validates the integrity check values or 'checksums' of a message. This...
CWE-355 — User Interface Security Issues User Interface Security Issues
CWE-356 — Product UI does not Warn User of Unsafe Actions The product's user interface does not warn the user before undertaking an unsafe action on behalf of that user. This...
CWE-357 — Insufficient UI Warning of Dangerous Operations The user interface provides a warning to a user regarding dangerous or sensitive operations, but the warning is not...
CWE-358 — Improperly Implemented Security Check for Standard The product does not implement or incorrectly implements one or more security-relevant checks as specified by the...
CWE-359 — Exposure of Private Personal Information to an Unauthorized Actor The product does not properly prevent a person's private, personal information from being accessed by actors who...
CWE-36 — Absolute Path Traversal The product uses external input to construct a pathname that should be within a restricted directory, but it does...
CWE-360 — Trust of System Event Data Security based on event locations are insecure and can be spoofed.
CWE-361 — 7PK - Time and State 7PK - Time and State
CWE-362 — Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but...
CWE-363 — Race Condition Enabling Link Following The product checks the status of a file or directory before accessing it, which produces a race condition in which...
CWE-364 — Signal Handler Race Condition The product uses a signal handler that introduces a race condition.
CWE-366 — Race Condition within a Thread If two threads of execution use a resource simultaneously, there exists the possibility that resources may be used...
CWE-367 — Time-of-check Time-of-use (TOCTOU) Race Condition The product checks the state of a resource before using that resource, but the resource's state can change between...
CWE-368 — Context Switching Race Condition A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security...
CWE-369 — Divide By Zero The product divides a value by zero.
CWE-37 — Path Traversal: '/absolute/pathname/here' The product accepts input in the form of a slash absolute path ('/absolute/pathname/here') without appropriate...
CWE-370 — Missing Check for Certificate Revocation after Initial Check The product does not check the revocation status of a certificate after its initial revocation check, which can...
CWE-371 — State Issues State Issues
CWE-372 — Incomplete Internal State Distinction The product does not properly determine which state it is in, causing it to assume it is in state X when in fact it...

Browse by topic

Every page in the corpus, grouped. Search finds one page; this shows what else is here.