CWE
Home > CWE List > VIEW LIST: CWE-677: Weakness Base Elements (Draft 9)   View the CWE List

VIEW LIST: CWE-677: Weakness Base Elements (Draft 9)

Weakness Base Elements
View ID
Status: Draft

677 (View)

ObjectiveThis view (slice) displays only weakness base elements.
View Data

Filter Used: .//@Weakness_Abstraction='Base'

CWEs in this viewTotal CWEs
Total276out of695
Views0out of14
Categories0out of64
Weaknesses276out of605
Compound_Elements0out of12
Back to top
Weakness BaseWeakness Base Absolute Path Traversal - (36)
Weakness BaseWeakness Base Acceptance of Extraneous Untrusted Data With Trusted Data - (349)
Weakness BaseWeakness Base Addition of Data Structure Sentinel - (464)
Weakness BaseWeakness Base Algorithmic Complexity - (407)
Weakness BaseWeakness Base Argument Injection or Modification - (88)
Weakness BaseWeakness Base Assignment of a Fixed Address to a Pointer - (587)
Weakness BaseWeakness Base Authentication Bypass by Capture-replay - (294)
Weakness BaseWeakness Base Authentication Bypass by Primary Weakness - (305)
Weakness BaseWeakness Base Authentication Bypass by Spoofing - (290)
Weakness BaseWeakness Base Behavioral Change in New Version or Environment - (439)
Weakness BaseWeakness Base Behavioral Discrepancy Information Leak - (205)
Weakness BaseWeakness Base Boundary Beginning Violation ('Buffer Underwrite') - (124)
Weakness BaseWeakness Base Collapse of Data Into Unsafe Value - (182)
Weakness BaseWeakness Base Compiler Removal of Code to Clear Buffers - (14)
Weakness BaseWeakness Base Context Switching Race Condition - (368)
Weakness BaseWeakness Base Covert Storage Channel - (515)
Weakness BaseWeakness Base Covert Timing Channel - (385)
Weakness BaseWeakness Base Creation of Temporary File in Directory with Insecure Permissions - (379)
Weakness BaseWeakness Base Creation of Temporary File With Insecure Permissions - (378)
Weakness BaseWeakness Base Cross-boundary Cleansing Information Leak - (212)
Weakness BaseWeakness Base Custom Special Character Injection - (92)
Weakness BaseWeakness Base Dangerous Handler not Disabled During Sensitive Operations - (432)
Weakness BaseWeakness Base Dangling Database Cursor (aka 'Cursor Injection') - (619)
Weakness BaseWeakness Base Declaration of Catch for Generic Exception - (396)
Weakness BaseWeakness Base Declaration of Throws for Generic Exception - (397)
Weakness BaseWeakness Base Deletion of Data Structure Sentinel - (463)
Weakness BaseWeakness Base Deployment of Wrong Handler - (430)
Deprecated DEPRECATED: Incorrect Initialization - (458)
Deprecated DEPRECATED (Duplicate): Covert Timing Channel - (516)
Deprecated DEPRECATED (Duplicate): General Information Management Problems - (225)
Deprecated DEPRECATED (Duplicate): HTTP response splitting - (443)
Weakness BaseWeakness Base Design Principle Violation: Client-Side Enforcement of Server-Side Security - (602)
Weakness BaseWeakness Base Design Principle Violation: Failure to Satisfy Psychological Acceptability - (655)
Weakness BaseWeakness Base Design Principle Violation: Insufficient Compartmentalization - (653)
Weakness BaseWeakness Base Design Principle Violation: Reliance on a Single Factor in a Security Decision - (654)
Weakness BaseWeakness Base Design Principle Violation: Reliance on Security through Obscurity - (656)
Weakness BaseWeakness Base Direct Request ('Forced Browsing') - (425)
Weakness BaseWeakness Base Direct Use of Unsafe JNI - (111)
Weakness BaseWeakness Base Divide By Zero - (369)
Weakness BaseWeakness Base Double-Checked Locking - (609)
Weakness BaseWeakness Base Duplicate Key in Associative List (Alist) - (462)
Weakness BaseWeakness Base Dynamic Variable Evaluation - (627)
Weakness BaseWeakness Base Error Message Information Leaks - (209)
Weakness BaseWeakness Base Executable Regular Expression Error - (624)
Weakness BaseWeakness Base Expected Behavior Violation - (440)
Weakness BaseWeakness Base External Control of Assumed-Immutable Web Parameter - (472)
Weakness BaseWeakness Base External Control of System or Configuration Setting - (15)
Weakness BaseWeakness Base External Control of User State Data - (642)
Weakness BaseWeakness Base External Initialization of Trusted Variables - (454)
Weakness BaseWeakness Base Failure to Add Integrity Check Value - (353)
Weakness BaseWeakness Base Failure to Catch All Exceptions (Missing Catch Block) - (600)
Weakness BaseWeakness Base Failure to Check for Certificate Revocation - (299)
Weakness BaseWeakness Base Failure to Check Integrity Check Value - (354)
Weakness BaseWeakness Base Failure to Check Whether Privileges Were Dropped Successfully - (273)
Weakness BaseWeakness Base Failure to Encrypt Sensitive Data - (311)
Weakness BaseWeakness Base Failure to Follow Chain of Trust in Certificate Validation - (296)
Weakness BaseWeakness Base Failure to Handle Additional Special Element - (167)
Weakness BaseWeakness Base Failure to Handle Extra Parameter - (235)
Weakness BaseWeakness Base Failure to Handle Extra Value - (231)
Weakness BaseWeakness Base Failure to Handle Highly Compressed Data (Data Amplification) - (409)
Weakness BaseWeakness Base Failure to Handle Incomplete Element - (239)
Weakness BaseWeakness Base Failure to Handle Insufficient Permissions or Privileges - (280)
Weakness BaseWeakness Base Failure to Handle Insufficient Privileges - (274)
Weakness BaseWeakness Base Failure to Handle Missing Element - (238)
Weakness BaseWeakness Base Failure to Handle Missing Parameter - (234)
Weakness BaseWeakness Base Failure to Handle Missing Special Element - (166)
Weakness BaseWeakness Base Failure to Handle Missing Value - (230)
Weakness BaseWeakness Base Failure to Handle Undefined Parameter - (236)
Weakness BaseWeakness Base Failure to Handle Undefined Value - (232)
Weakness BaseWeakness Base Failure to Handle Wrong Data Type - (241)
Weakness BaseWeakness Base Failure to Protect Stored Data from Modification - (217)
Weakness BaseWeakness Base Failure to Provide Confidentiality for Stored Data - (218)
Weakness BaseWeakness Base Failure to Provide Specified Functionality - (684)
Weakness VariantWeakness Variant Failure to Release Memory Before Removing Last Reference (aka 'Memory Leak') - (401)
Weakness BaseWeakness Base Failure to Report Error in Status Code - (392)
Weakness BaseWeakness Base Failure to Resolve Case Sensitivity - (178)
Weakness BaseWeakness Base Failure to Resolve Equivalent Special Elements into a Different Plane - (76)
Weakness BaseWeakness Base Failure to Resolve Inconsistent Elements - (240)
Weakness BaseWeakness Base Failure to Resolve Inconsistent Special Elements - (168)
Weakness BaseWeakness Base Failure to Resolve Links Before File Access (aka 'Link Following') - (59)
Weakness BaseWeakness Base Failure to Restrict Excessive Authentication Attempts - (307)
Weakness BaseWeakness Base Failure to Sanitize CRLF Sequences (aka 'CRLF Injection') - (93)
Weakness BaseWeakness Base Failure to Sanitize CRLF Sequences in HTTP Headers (aka 'HTTP Response Splitting') - (113)
Weakness BaseWeakness Base Failure to Sanitize Data into an OS Command (aka 'OS Command Injection') - (78)
Weakness BaseWeakness Base Failure to Sanitize Data into LDAP Queries (aka 'LDAP Injection') - (90)
Weakness BaseWeakness Base Failure to Sanitize Data into SQL Queries (aka 'SQL Injection') - (89)
Weakness BaseWeakness Base Failure to Sanitize Delimiters - (140)
Weakness BaseWeakness Base Failure to Sanitize Directives in a Web Page (aka 'Cross-site scripting' (XSS)) - (79)
Weakness BaseWeakness Base Failure to Sanitize Server-Side Includes (SSI) Within a Web Page - (97)
Weakness BaseWeakness Base Failure to Validate Certificate Expiration - (298)
Weakness BaseWeakness Base Failure to Validate Host-specific Certificate Data - (297)
Weakness BaseWeakness Base Files or Directories Accessible to External Parties - (552)
Weakness BaseWeakness Base Function Call with Incorrectly Specified Arguments - (628)
Weakness BaseWeakness Base Hard-Coded Password - (259)
Weakness BaseWeakness Base Improper Implementation of Authentication Algorithm - (303)
Weakness BaseWeakness Base Improperly Implemented Security Check for Standard - (358)
Weakness BaseWeakness Base Improperly Trusted Reverse DNS - (350)
Weakness BaseWeakness Base Improperly Verified Signature - (347)
Weakness BaseWeakness Base Improper Null Termination - (170)
Weakness BaseWeakness Base Improper Resource Shutdown or Release - (404)
Weakness BaseWeakness Base Improper Use of Privileged APIs - (648)
Weakness BaseWeakness Base Incomplete Blacklist - (184)
Weakness BaseWeakness Base Incomplete Cleanup - (459)
Weakness BaseWeakness Base Incomplete Internal State Distinction - (372)
Weakness BaseWeakness Base Incomplete Model of Endpoint Features - (437)
Weakness BaseWeakness Base Incorrect Behavior Order: Early Amplification - (408)
Weakness BaseWeakness Base Incorrect Behavior Order: Early Validation - (179)
Weakness BaseWeakness Base Incorrect Calculation - (682)
Weakness BaseWeakness Base Incorrect Calculation of Multi-Byte String Length - (135)
Weakness BaseWeakness Base Incorrect Conversion between Numeric Types - (681)
Weakness BaseWeakness Base Incorrect or Incomplete Initialization - (665)
Weakness BaseWeakness Base Incorrect Output Sanitization for Logs - (117)
Weakness BaseWeakness Base Incorrect Pointer Scaling - (468)
Weakness BaseWeakness Base Incorrect Privilege Assignment - (266)
Weakness BaseWeakness Base Incorrect Semantic Object Comparison - (596)
Weakness BaseWeakness Base Incorrect Sign Extension - (194)
Weakness BaseWeakness Base Incorrect Syntactic Object Comparison - (595)
Weakness BaseWeakness Base Information Leak of System Data - (497)
Weakness BaseWeakness Base Insecure Default Variable Initialization - (453)
Weakness BaseWeakness Base Insecure Temporary File - (377)
Weakness BaseWeakness Base Insufficient Control of a Resource Through its Lifetime - (664)
Weakness BaseWeakness Base Insufficient Control of Directives in Dynamically Evaluated Code (aka 'Eval Injection') - (95)
Weakness BaseWeakness Base Insufficient Control of Directives in Statically Saved Code (Static Code Injection) - (96)
Weakness BaseWeakness Base Insufficient Control of Resource Identifiers (aka 'Resource Injection') - (99)
Weakness BaseWeakness Base Insufficient Entropy - (331)
Weakness BaseWeakness Base Insufficient Locking - (667)
Weakness BaseWeakness Base Insufficiently Protected Credentials - (522)
Weakness BaseWeakness Base Insufficient Resource Locking - (413)
Weakness BaseWeakness Base Insufficient Resource Pool - (410)
Weakness BaseWeakness Base Insufficient Session Expiration - (613)
Weakness BaseWeakness Base Insufficient Synchronization - (662)
Weakness BaseWeakness Base Insufficient Type Distinction - (351)
Weakness BaseWeakness Base Insufficient UI Warning of Dangerous Operations - (357)
Weakness BaseWeakness Base Integer Overflow (Wrap or Wraparound) - (190)
Weakness BaseWeakness Base Integer Underflow (Wrap or Wraparound) - (191)
Weakness BaseWeakness Base Intended Information Leak - (213)
Weakness BaseWeakness Base Interpretation Conflict - (436)
Weakness BaseWeakness Base Interpretation Conflict in Web Traffic (aka 'HTTP Request Smuggling') - (444)
Weakness BaseWeakness Base Key Exchange without Entity Authentication - (322)
Weakness BaseWeakness Base Least Privilege Violation - (272)
Weakness BaseWeakness Base Leftover Debug Code - (489)
Weakness BaseWeakness Base Length Parameter Inconsistency - (130)
Weakness BaseWeakness Base Logic/Time Bomb - (511)
Weakness BaseWeakness Base Miscalculated Null Termination - (132)
Weakness BaseWeakness Base Misinterpretation of Input - (115)
Weakness BaseWeakness Base Misinterpreted Function Return Value - (253)
Weakness BaseWeakness Base Missing Critical Step in Authentication - (304)
Weakness BaseWeakness Base Missing Error Handling Mechanism - (544)
Weakness BaseWeakness Base Missing Handler - (431)
Weakness BaseWeakness Base Missing Initialization - (456)
Weakness BaseWeakness Base Missing Lock Check - (414)
Weakness BaseWeakness Base Missing or Inconsistent Access Control - (285)
Weakness BaseWeakness Base Missing Required Cryptographic Step - (325)
Weakness BaseWeakness Base Missing XML Validation - (112)
Weakness BaseWeakness Base Modification of Assumed-Immutable Data (MAID) - (471)
Weakness BaseWeakness Base Multiple Binds to the Same Port - (605)
Weakness BaseWeakness Base Multiple Interpretations of UI Input - (450)
Weakness BaseWeakness Base Mutable Objects Passed by Reference - (374)
Weakness BaseWeakness Base Network Amplification - (406)
Weakness BaseWeakness Base Non-exit on Failed Initialization - (455)
Weakness BaseWeakness Base Non-Replicating Malicious Code - (508)
Weakness BaseWeakness Base NULL Pointer Dereference - (476)
Weakness BaseWeakness Base Numeric Truncation Error - (197)
Weakness BaseWeakness Base Object Model Violation: Just One of Equals and Hashcode Defined - (581)
Weakness BaseWeakness Base Obscured Security-relevant Information by Alternate Name - (224)
Weakness BaseWeakness Base Obsolete Feature in UI - (448)
Weakness BaseWeakness Base Off-by-one Error - (193)
Weakness BaseWeakness Base Omission of Security-relevant Information - (223)
Weakness BaseWeakness Base Omitted Break Statement - (484)
Weakness BaseWeakness Base Operation on Resource in Wrong Phase of Lifetime - (666)
Weakness BaseWeakness Base Origin Validation Error - (346)
Weakness BaseWeakness Base Out-of-bounds Read - (125)
Weakness BaseWeakness Base Overly Restrictive Account Lockout Mechanism - (645)
Weakness BaseWeakness Base Overly Restrictive Regular Expression - (186)
Weakness BaseWeakness Base Partial Comparison - (187)
Weakness BaseWeakness Base Passing Mutable Objects to an Untrusted Method - (375)
Weakness BaseWeakness Base Password Aging with Long Expiration - (263)
Weakness BaseWeakness Base Permission Preservation Failure - (281)
Weakness BaseWeakness Base Permissive Regular Expression - (625)
Weakness BaseWeakness Base Permissive Whitelist - (183)
Weakness BaseWeakness Base Plaintext Storage of Sensitive Information - (312)
Weakness BaseWeakness Base Plaintext Transmission of Sensitive Information - (319)
Weakness BaseWeakness Base Predictable Exact Value from Previous Values - (342)
Weakness BaseWeakness Base Predictable from Observable State - (341)
Weakness BaseWeakness Base Predictable Seed in PRNG - (337)
Weakness BaseWeakness Base Predictable Value Range from Previous Values - (343)
Weakness BaseWeakness Base Privilege Chaining - (268)
Weakness BaseWeakness Base Privilege Context Switching Error - (270)
Weakness BaseWeakness Base Privilege Defined With Unsafe Actions - (267)
Weakness BaseWeakness Base Privilege Management Error - (269)
Weakness BaseWeakness Base Process Control - (114)
Weakness BaseWeakness Base Product-External Error Message Information Leak - (211)
Weakness BaseWeakness Base Product-Generated Error Message Information Leak - (210)
Weakness BaseWeakness Base Product UI does not Warn User of Unsafe Actions - (356)
Weakness BaseWeakness Base Proxied Trusted Channel - (423)
Weakness BaseWeakness Base Race Condition Enabling Link Following - (363)
Weakness BaseWeakness Base Race Condition in Checking for Certificate Revocation - (370)
Weakness BaseWeakness Base Race Condition in Switch - (365)
Weakness BaseWeakness Base Race Condition within a Thread - (366)
Weakness BaseWeakness Base Relative Path Traversal - (23)
Weakness BaseWeakness Base Reliance on Data/Memory Layout - (188)
Weakness BaseWeakness Base Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking - (649)
Weakness BaseWeakness Base Replicating Malicious Code (Virus or Worm) - (509)
Weakness BaseWeakness Base Resource Exhaustion - (400)
Weakness BaseWeakness Base Response Discrepancy Information Leak - (204)
Weakness BaseWeakness Base Return Inside Finally Block - (584)
Weakness BaseWeakness Base Return of Pointer Value Outside of Expected Range - (466)
Weakness BaseWeakness Base Return of Stack Variable Address - (562)
Weakness BaseWeakness Base Return of Wrong Status Code - (393)
Weakness BaseWeakness Base Reusing a Nonce, Key Pair in Encryption - (323)
Weakness BaseWeakness Base Reversible One-Way Hash - (328)
Weakness BaseWeakness Base Same Seed in PRNG - (336)
Weakness BaseWeakness Base Sensitive Information Uncleared Before Release - (226)
Weakness BaseWeakness Base Signal Handler Race Condition - (364)
Weakness BaseWeakness Base Small Seed Space in PRNG - (339)
Weakness BaseWeakness Base Small Space of Random Values - (334)
Weakness BaseWeakness Base Spyware - (512)
Weakness BaseWeakness Base State Synchronization Error - (373)
Weakness BaseWeakness Base Storing Passwords in a Recoverable Format - (257)
Weakness BaseWeakness Base Symbolic Name not Mapping to Correct Object - (386)
Weakness BaseWeakness Base The UI Performs the Wrong Action - (449)
Weakness BaseWeakness Base Time-of-check Time-of-use Race Condition - (367)
Weakness BaseWeakness Base Timing Discrepancy Information Leak - (208)
Weakness BaseWeakness Base Trapdoor - (510)
Weakness BaseWeakness Base Trojan Horse - (507)
Weakness BaseWeakness Base Truncation of Security-relevant Information - (222)
Weakness BaseWeakness Base Trust Boundary Violation - (501)
Weakness BaseWeakness Base Trust of System Event Data - (360)
Weakness BaseWeakness Base UI Misrepresentation of Critical Information - (451)
Weakness BaseWeakness Base Uncaught Exception - (248)
Weakness BaseWeakness Base Unchecked Array Indexing - (129)
Weakness BaseWeakness Base Unchecked Error Condition - (391)
Weakness BaseWeakness Base Unchecked Return Value - (252)
Weakness BaseWeakness Base Uncontrolled Format String - (134)
Weakness BaseWeakness Base Uncontrolled Recursion - (674)
Weakness BaseWeakness Base Uncontrolled Search Path Element - (427)
Weakness BaseWeakness Base Undefined Behavior for Input to API - (475)
Weakness BaseWeakness Base Unexpected Status Code or Return Value - (394)
Weakness BaseWeakness Base Unimplemented or Unsupported Feature in UI - (447)
Weakness BaseWeakness Base Unintended Proxy/Intermediary - (441)
Weakness BaseWeakness Base UNIX File Descriptor Leak - (403)
Weakness BaseWeakness Base Unprotected Alternate Channel - (420)
Weakness BaseWeakness Base Unprotected Primary Channel - (419)
Weakness BaseWeakness Base Unquoted Search Path or Element - (428)
Weakness BaseWeakness Base Unrestricted Lock on Critical Resource - (412)
Weakness BaseWeakness Base Unsafe Treatment of XPath Input - (643)
Weakness BaseWeakness Base Unsafe Treatment of XQuery Input - (652)
Weakness BaseWeakness Base Unsynchronized Access to Shared Data - (567)
Weakness BaseWeakness Base Unverified Ownership - (283)
Weakness BaseWeakness Base Use After Free - (416)
Weakness BaseWeakness Base Use of a Broken or Risky Cryptographic Algorithm - (327)
Weakness BaseWeakness Base Use of a Key Past its Expiration Date - (324)
Weakness BaseWeakness Base Use of a Non-reentrant Function in an Unsynchronized Context - (663)
Weakness BaseWeakness Base Use of a Resource after Expiration or Release - (672)
Weakness BaseWeakness Base Use of Client-Side Authentication - (603)
Weakness BaseWeakness Base Use of Cookies in Security Decision - (565)
Weakness BaseWeakness Base Use of Cryptographically Weak PRNG - (338)
Weakness BaseWeakness Base Use of Externally-Controlled Input to Select Classes or Code (aka 'Unsafe Reflection') - (470)
Weakness BaseWeakness Base Use of Function with Inconsistent Implementations - (474)
Weakness BaseWeakness Base Use of Hard-coded Cryptographic Key - (321)
Weakness BaseWeakness Base Use of Incorrect Byte Ordering - (198)
Weakness BaseWeakness Base Use of Incorrect Operator - (480)
Weakness BaseWeakness Base Use of Invariant Value in Dynamically Changing Context - (344)
Weakness BaseWeakness Base Use of Less Trusted Source - (348)
Weakness BaseWeakness Base Use of NullPointerException Catch to Detect NULL Pointer Dereference - (395)
Weakness BaseWeakness Base Use of Obsolete Functions - (477)
Weakness BaseWeakness Base Use of Password System for Primary Authentication - (309)
Weakness BaseWeakness Base Use of Pointer Subtraction to Determine Size - (469)
Weakness BaseWeakness Base Use of Potentially Dangerous Function - (676)
Weakness BaseWeakness Base Use of Single-factor Authentication - (308)
Weakness BaseWeakness Base Variable Extraction Error - (621)
Weakness BaseWeakness Base Weak Password Recovery Mechanism - (640)
Weakness BaseWeakness Base Weak Password Requirements - (521)
Weakness BaseWeakness Base Wrap-around Error - (128)
Weakness BaseWeakness Base Write-what-where Condition - (123)
Weakness BaseWeakness Base XML Injection (aka Blind XPath Injection) - (91)
Page Last Updated: April 11, 2008
 

CWE is sponsored by the National Cyber Security Division of the U.S. Department of Homeland Security.

This Web site is hosted by The MITRE Corporation.
Copyright 2008, The MITRE Corporation. CWE and the CWE logo are trademarks of The MITRE Corporation.

Contact cwe@mitre.org for more information.
Privacy policy
Terms of use
Contact us