CWE - CWE-701: Weaknesses Introduced During Design (2.11)

Home > CWE List > CWE- Individual Dictionary Definition (2.11)

CWE VIEW: Weaknesses Introduced During Design

View ID: 701

Structure: Implicit Slice

Status: Incomplete

Presentation Filter:

View Data

View Objective

This view (slice) lists weaknesses that can be introduced during design.

View Filter: .//Introductory_Phase='Architecture and Design'

Relationships

Weakness Base Absolute Path Traversal - (36)

Weakness Base Acceptance of Extraneous Untrusted Data With Trusted Data - (349)

Weakness Variant

Weakness Variant Access to Critical Private Variable via Public Method - (767)

Weakness Base Addition of Data Structure Sentinel - (464)

Weakness Base Algorithmic Complexity - (407)

Weakness Variant

Weakness Variant Allocation of File Descriptors or Handles Without Limits or Throttling - (774)

Weakness Base Allocation of Resources Without Limits or Throttling - (770)

Weakness Class Always-Incorrect Control Flow Implementation - (670)

Weakness Variant

Weakness Variant Apple '.DS_Store' - (71)

Weakness Base Argument Injection or Modification - (88)

Weakness Variant

Weakness Variant ASP.NET Misconfiguration: Not Using Input Validation Framework - (554)

Weakness Variant

Weakness Variant ASP.NET Misconfiguration: Password in Configuration File - (13)

Weakness Base Assignment of a Fixed Address to a Pointer - (587)

Weakness Class Asymmetric Resource Consumption (Amplification) - (405)

Weakness Variant

Weakness Variant Attempt to Access Child of a Non-structure Pointer - (588)

Weakness Variant

Weakness Variant Authentication Bypass by Alternate Name - (289)

Weakness Variant

Weakness Variant Authentication Bypass by Assumed-Immutable Data - (302)

Weakness Base Authentication Bypass by Capture-replay - (294)

Weakness Base Authentication Bypass by Primary Weakness - (305)

Weakness Base Authentication Bypass by Spoofing - (290)

Weakness Base Authentication Bypass Using an Alternate Path or Channel - (288)

Weakness Variant

Weakness Variant Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created - (593)

Weakness Base Authorization Bypass Through User-Controlled Key - (639)

Weakness Variant

Weakness Variant Authorization Bypass Through User-Controlled SQL Primary Key - (566)

Weakness Base Behavioral Change in New Version or Environment - (439)

Weakness Base Buffer Underwrite ('Buffer Underflow') - (124)

Weakness Variant

Weakness Variant Call to Non-ubiquitous API - (589)

Weakness Class Channel Accessible by Non-Endpoint ('Man-in-the-Middle') - (300)

Weakness Variant

Weakness Variant Cleartext Storage in a File or on Disk - (313)

Weakness Variant

Weakness Variant Cleartext Storage in the Registry - (314)

Weakness Base Cleartext Storage of Sensitive Information - (312)

Weakness Variant

Weakness Variant Cleartext Storage of Sensitive Information in a Cookie - (315)

Weakness Variant

Weakness Variant Cleartext Storage of Sensitive Information in Executable - (318)

Weakness Variant

Weakness Variant Cleartext Storage of Sensitive Information in GUI - (317)

Weakness Variant

Weakness Variant Cleartext Storage of Sensitive Information in Memory - (316)

Weakness Base Cleartext Transmission of Sensitive Information - (319)

Weakness Base Client-Side Enforcement of Server-Side Security - (602)

Weakness Class Coding Standards Violation - (710)

Weakness Class Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') - (362)

Weakness Class Containment Errors (Container Errors) - (216)

Weakness Base Context Switching Race Condition - (368)

Weakness Base Covert Timing Channel - (385)

Weakness Base Creation of Temporary File in Directory with Incorrect Permissions - (379)

Weakness Base Creation of Temporary File With Insecure Permissions - (378)

Weakness Variant

Weakness Variant Critical Variable Declared Public - (766)

Compound Element: Composite

Compound Element: Composite Cross-Site Request Forgery (CSRF) - (352)

Weakness Base Dangerous Signal Handler not Disabled During Sensitive Operations - (432)

Weakness Base Declaration of Catch for Generic Exception - (396)

Weakness Base Declaration of Throws for Generic Exception - (397)

Weakness Base Deletion of Data Structure Sentinel - (463)

Weakness Variant

Weakness Variant Deserialization of Untrusted Data - (502)

Weakness Class Detection of Error Condition Without Action - (390)

Weakness Base Direct Request ('Forced Browsing') - (425)

Weakness Variant

Weakness Variant Double Free - (415)

Weakness Base Download of Code Without Integrity Check - (494)

Weakness Base Duplicate Key in Associative List (Alist) - (462)

Weakness Variant

Weakness Variant EJB Bad Practices: Use of AWT Swing - (575)

Weakness Variant

Weakness Variant EJB Bad Practices: Use of Class Loader - (578)

Weakness Variant

Weakness Variant EJB Bad Practices: Use of Java I/O - (576)

Weakness Variant

Weakness Variant EJB Bad Practices: Use of Sockets - (577)

Weakness Variant

Weakness Variant EJB Bad Practices: Use of Synchronization Primitives - (574)

Weakness Variant

Weakness Variant Empty Password in Configuration File - (258)

Weakness Class Execution with Unnecessary Privileges - (250)

Weakness Base Expected Behavior Violation - (440)

Weakness Base Exposed Dangerous Method or Function - (749)

Weakness Variant

Weakness Variant Exposed IOCTL with Insufficient Access Control - (782)

Weakness Base Exposed Unsafe ActiveX Method - (618)

Weakness Base Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') - (403)

Weakness Class Exposure of Private Information ('Privacy Violation') - (359)

Weakness Class Exposure of Resource to Wrong Sphere - (668)

Weakness Variant

Weakness Variant Exposure of Sensitive Data Through Data Queries - (202)

Weakness Class External Control of Critical State Data - (642)

Weakness Class External Control of File Name or Path - (73)

Weakness Class External Influence of Sphere Definition - (673)

Weakness Base External Initialization of Trusted Variables or Data Stores - (454)

Weakness Class Externally Controlled Reference to a Resource in Another Sphere - (610)

Weakness Variant

Weakness Variant Failure to Handle Incomplete Element - (239)

Weakness Variant

Weakness Variant Failure to Handle Missing Parameter - (234)

Weakness Class Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) - (75)

Category File Descriptor Exhaustion - (769)

Weakness Base Guessable CAPTCHA - (804)

Weakness Variant

Weakness Variant Heap-based Buffer Overflow - (122)

Weakness Class Hidden Functionality - (912)

Weakness Class Improper Access Control - (284)

Weakness Variant

Weakness Variant Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code - (781)

Weakness Class Improper Authentication - (287)

Weakness Class Improper Authorization - (285)

Weakness Base Improper Certificate Validation - (295)

Weakness Variant

Weakness Variant Improper Check for Certificate Revocation - (299)

Weakness Base Improper Check for Dropped Privileges - (273)

Weakness Class Improper Check or Handling of Exceptional Conditions - (703)

Weakness Base Improper Control of Dynamically-Identified Variables - (914)

Weakness Class Improper Control of Dynamically-Managed Code Resources - (913)

Weakness Base Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') - (98)

Weakness Class Improper Control of Generation of Code ('Code Injection') - (94)

Weakness Class Improper Control of Interaction Frequency - (799)

Weakness Base Improper Control of Resource Identifiers ('Resource Injection') - (99)

Weakness Base Improper Cross-boundary Removal of Sensitive Data - (212)

Weakness Class Improper Encoding or Escaping of Output - (116)

Weakness Class Improper Enforcement of Message Integrity During Transmission in a Communication Channel - (924)

Weakness Class Improper Enforcement of Message or Data Structure - (707)

Weakness Variant

Weakness Variant Improper Export of Android Application Components - (926)

Weakness Base Improper Following of a Certificate's Chain of Trust - (296)

Weakness Class Improper Fulfillment of API Contract ('API Abuse') - (227)

Weakness Variant

Weakness Variant Improper Handling of Apple HFS+ Alternate Data Stream Path - (72)

Weakness Variant

Weakness Variant Improper Handling of Extra Parameters - (235)

Weakness Variant

Weakness Variant Improper Handling of Extra Values - (231)

Weakness Base Improper Handling of File Names that Identify Virtual Resources - (66)

Weakness Base Improper Handling of Highly Compressed Data (Data Amplification) - (409)

Weakness Variant

Weakness Variant Improper Handling of Incomplete Structural Elements - (238)

Weakness Variant

Weakness Variant Improper Handling of Inconsistent Structural Elements - (240)

Weakness Variant

Weakness Variant Improper Handling of Insufficient Entropy in TRNG - (333)

Weakness Base Improper Handling of Insufficient Permissions or Privileges - (280)

Weakness Base Improper Handling of Insufficient Privileges - (274)

Weakness Base Improper Handling of Length Parameter Inconsistency - (130)

Weakness Base Improper Handling of Parameters - (233)

Weakness Class Improper Handling of Syntactically Invalid Structure - (228)

Weakness Variant

Weakness Variant Improper Handling of Undefined Parameters - (236)

Weakness Variant

Weakness Variant Improper Handling of Undefined Values - (232)

Weakness Base Improper Handling of Unexpected Data Type - (241)

Weakness Base Improper Handling of Values - (229)

Weakness Variant

Weakness Variant Improper Handling of Windows ::DATA Alternate Data Stream - (69)

Weakness Variant

Weakness Variant Improper Handling of Windows Device Names - (67)

Weakness Class Improper Input Validation - (20)

Weakness Class Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - (22)

Weakness Base Improper Locking - (667)

Weakness Base Improper Neutralization of CRLF Sequences ('CRLF Injection') - (93)

Weakness Base Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - (95)

Weakness Base Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') - (96)

Weakness Variant

Weakness Variant Improper Neutralization of Encoded URI Schemes in a Web Page - (84)

Weakness Base Improper Neutralization of Equivalent Special Elements - (76)

Weakness Variant

Weakness Variant Improper Neutralization of HTTP Headers for Scripting Syntax - (644)

Weakness Base Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - (79)

Weakness Variant

Weakness Variant Improper Neutralization of Server-Side Includes (SSI) Within a Web Page - (97)

Weakness Class Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - (74)

Weakness Class Improper Neutralization of Special Elements used in a Command ('Command Injection') - (77)

Weakness Base Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') - (917)

Weakness Base Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') - (90)

Weakness Base Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - (78)

Weakness Base Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - (89)

Weakness Class Improper Ownership Management - (282)

Weakness Base Improper Preservation of Permissions - (281)

Weakness Base Improper Privilege Management - (269)

Weakness Class Improper Protection of Alternate Path - (424)

Weakness Base Improper Release of Memory Before Removing Last Reference ('Memory Leak') - (401)

Weakness Base Improper Resource Locking - (413)

Weakness Base Improper Resource Shutdown or Release - (404)

Weakness Class Improper Restriction of Communication Channel to Intended Endpoints - (923)

Weakness Base Improper Restriction of Excessive Authentication Attempts - (307)

Weakness Base Improper Restriction of Names for Files and Other Resources - (641)

Weakness Class Improper Restriction of Operations within the Bounds of a Memory Buffer - (119)

Weakness Base Improper Restriction of Power Consumption - (920)

Weakness Base Improper Synchronization - (662)

Weakness Variant

Weakness Variant Improper Validation of Certificate Expiration - (298)

Weakness Variant

Weakness Variant Improper Validation of Certificate with Host Mismatch - (297)

Weakness Base Improper Validation of Integrity Check Value - (354)

Weakness Base Improper Verification of Cryptographic Signature - (347)

Weakness Variant

Weakness Variant Improper Verification of Intent by Broadcast Receiver - (925)

Weakness Base Improper Verification of Source of a Communication Channel - (940)

Weakness Base Improperly Controlled Modification of Dynamically-Determined Object Attributes - (915)

Weakness Base Improperly Implemented Security Check for Standard - (358)

Weakness Class Inadequate Encryption Strength - (326)

Category Inadvertently Introduced Weakness - (518)

Weakness Base Incomplete Blacklist - (184)

Weakness Base Incomplete Cleanup - (459)

Weakness Base Incomplete Internal State Distinction - (372)

Weakness Base Incomplete Model of Endpoint Features - (437)

Weakness Base Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') - (444)

Weakness Class Incorrect Access of Indexable Resource ('Range Error') - (118)

Weakness Class Incorrect Authorization - (863)

Weakness Class Incorrect Behavior Order - (696)

Weakness Base Incorrect Behavior Order: Early Amplification - (408)

Weakness Class Incorrect Calculation - (682)

Weakness Class Incorrect Control Flow Scoping - (705)

Weakness Variant

Weakness Variant Incorrect Default Permissions - (276)

Weakness Variant

Weakness Variant Incorrect Execution-Assigned Permissions - (279)

Weakness Base Incorrect Ownership Assignment - (708)

Weakness Class Incorrect Permission Assignment for Critical Resource - (732)

Weakness Base Incorrect Privilege Assignment - (266)

Weakness Class Incorrect Resource Transfer Between Spheres - (669)

Weakness Class Incorrect Type Conversion or Cast - (704)

Weakness Base Incorrect Use of Privileged APIs - (648)

Weakness Class Incorrect User Management - (286)

Weakness Base Incorrectly Specified Destination in a Communication Channel - (941)

Weakness Class Indicator of Poor Code Quality - (398)

Weakness Class Information Exposure - (200)

Weakness Variant

Weakness Variant Information Exposure of Internal State Through Behavioral Inconsistency - (206)

Weakness Base Information Exposure Through an Error Message - (209)

Weakness Variant

Weakness Variant Information Exposure Through an External Behavioral Inconsistency - (207)

Weakness Base Information Exposure Through Behavioral Discrepancy - (205)

Weakness Variant

Weakness Variant Information Exposure Through Cleanup Log Files - (542)

Weakness Variant

Weakness Variant Information Exposure Through Debug Information - (215)

Weakness Class Information Exposure Through Discrepancy - (203)

Weakness Variant

Weakness Variant Information Exposure Through Environmental Variables - (526)

Weakness Base Information Exposure Through Externally-generated Error Message - (211)

Weakness Variant

Weakness Variant Information Exposure Through Indexing of Private Data - (612)

Weakness Variant

Weakness Variant Information Exposure Through Log Files - (532)

Weakness Variant

Weakness Variant Information Exposure Through Persistent Cookies - (539)

Weakness Variant

Weakness Variant Information Exposure Through Process Environment - (214)

Weakness Variant

Weakness Variant Information Exposure Through Query Strings in GET Request - (598)

Weakness Base Information Exposure Through Self-generated Error Message - (210)

Weakness Variant

Weakness Variant Information Exposure Through Shell Error Message - (535)

Weakness Base Information Exposure Through Timing Discrepancy - (208)

Weakness Variant

Weakness Variant Information Exposure Through WSDL File - (651)

Weakness Class Information Loss or Omission - (221)

Weakness Base Insecure Default Variable Initialization - (453)

Weakness Variant

Weakness Variant Insecure Inherited Permissions - (277)

Weakness Variant

Weakness Variant Insecure Preserved Inherited Permissions - (278)

Weakness Class Insecure Storage of Sensitive Information - (922)

Weakness Base Insecure Temporary File - (377)

Weakness Base Insufficient Compartmentalization - (653)

Weakness Class Insufficient Control Flow Management - (691)

Weakness Base Insufficient Control of Network Message Volume (Network Amplification) - (406)

Weakness Class Insufficient Encapsulation - (485)

Weakness Base Insufficient Entropy - (331)

Weakness Variant

Weakness Variant Insufficient Entropy in PRNG - (332)

Weakness Base Insufficient Psychological Acceptability - (655)

Weakness Base Insufficient Resource Pool - (410)

Weakness Base Insufficient Session Expiration - (613)

Weakness Base Insufficient UI Warning of Dangerous Operations - (357)

Weakness Class Insufficient Verification of Data Authenticity - (345)

Weakness Base Insufficiently Protected Credentials - (522)

Weakness Base Intentional Information Exposure - (213)

Weakness Class Interaction Error - (435)

Weakness Base Interpretation Conflict - (436)

Weakness Variant

Weakness Variant J2EE Bad Practices: Direct Management of Connections - (245)

Weakness Variant

Weakness Variant J2EE Bad Practices: Direct Use of Sockets - (246)

Weakness Variant

Weakness Variant J2EE Bad Practices: Direct Use of Threads - (383)

Weakness Variant

Weakness Variant J2EE Bad Practices: Non-serializable Object Stored in Session - (579)

Weakness Variant

Weakness Variant J2EE Framework: Saving Unserializable Objects to Disk - (594)

Weakness Variant

Weakness Variant J2EE Misconfiguration: Entity Bean Declared Remote - (8)

Weakness Variant

Weakness Variant J2EE Misconfiguration: Insufficient Session-ID Length - (6)

Weakness Variant

Weakness Variant J2EE Misconfiguration: Missing Custom Error Page - (7)

Weakness Variant

Weakness Variant J2EE Misconfiguration: Plaintext Password in Configuration File - (555)

Weakness Variant

Weakness Variant J2EE Misconfiguration: Weak Access Permissions for EJB Methods - (9)

Weakness Base Key Exchange without Entity Authentication - (322)

Weakness Class Lack of Administrator Control over Security - (671)

Weakness Base Least Privilege Violation - (272)

Weakness Base Logic/Time Bomb - (511)

Weakness Base Misinterpretation of Input - (115)

Weakness Variant

Weakness Variant Missing Authentication for Critical Function - (306)

Weakness Class Missing Authorization - (862)

Weakness Base Missing Check for Certificate Revocation after Initial Check - (370)

Weakness Base Missing Critical Step in Authentication - (304)

Weakness Base Missing Encryption of Sensitive Data - (311)

Weakness Base Missing Lock Check - (414)

Weakness Base Missing Reference to Active Allocated Resource - (771)

Weakness Variant

Weakness Variant Missing Reference to Active File Descriptor or Handle - (773)

Weakness Base Missing Release of Resource after Effective Lifetime - (772)

Weakness Base Missing Report of Error Condition - (392)

Weakness Base Missing Required Cryptographic Step - (325)

Weakness Base Missing Standardized Error Handling Mechanism - (544)

Weakness Base Missing Support for Integrity Check - (353)

Weakness Variant

Weakness Variant Missing Validation of OpenSSL Certificate - (599)

Weakness Base Modification of Assumed-Immutable Data (MAID) - (471)

Weakness Base Multiple Binds to the Same Port - (605)

Weakness Base Multiple Interpretations of UI Input - (450)

Weakness Variant

Weakness Variant Multiple Locks of a Critical Resource - (764)

Weakness Variant

Weakness Variant .NET Misconfiguration: Use of Impersonation - (520)

Weakness Base Non-exit on Failed Initialization - (455)

Weakness Class Not Failing Securely ('Failing Open') - (636)

Weakness Variant

Weakness Variant Not Using a Random IV with CBC Mode - (329)

Weakness Class Not Using Complete Mediation - (638)

Weakness Variant

Weakness Variant Not Using Password Aging - (262)

Weakness Base Obscured Security-relevant Information by Alternate Name - (224)

Weakness Base Omission of Security-relevant Information - (223)

Weakness Base Operation on a Resource after Expiration or Release - (672)

Weakness Base Origin Validation Error - (346)

Weakness Variant

Weakness Variant Overly Permissive Cross-domain Whitelist - (942)

Weakness Base Overly Restrictive Account Lockout Mechanism - (645)

Weakness Base Password Aging with Long Expiration - (263)

Weakness Variant

Weakness Variant Password in Configuration File - (260)

Weakness Variant

Weakness Variant Path Traversal: '../filedir' - (24)

Weakness Variant

Weakness Variant Plaintext Storage of a Password - (256)

Weakness Class Predictability Problems - (340)

Weakness Base Predictable Exact Value from Previous Values - (342)

Weakness Base Predictable from Observable State - (341)

Weakness Base Predictable Seed in PRNG - (337)

Weakness Base Predictable Value Range from Previous Values - (343)

Weakness Base Privilege Chaining - (268)

Weakness Base Privilege Context Switching Error - (270)

Weakness Base Privilege Defined With Unsafe Actions - (267)

Weakness Class Privilege Dropping / Lowering Errors - (271)

Weakness Class PRNG Seed Error - (335)

Weakness Base Product UI does not Warn User of Unsafe Actions - (356)

Weakness Class Protection Mechanism Failure - (693)

Weakness Base Race Condition During Access to Alternate Channel - (421)

Weakness Base Race Condition Enabling Link Following - (363)

Weakness Base Race Condition within a Thread - (366)

Weakness Variant

Weakness Variant Reflection Attack in an Authentication Protocol - (301)

Weakness Base Reliance on a Single Factor in a Security Decision - (654)

Weakness Base Reliance on Cookies without Validation and Integrity Checking - (565)

Weakness Variant

Weakness Variant Reliance on Cookies without Validation and Integrity Checking in a Security Decision - (784)

Weakness Base Reliance on Data/Memory Layout - (188)

Weakness Variant

Weakness Variant Reliance on File Name or Extension of Externally-Supplied File - (646)

Weakness Variant

Weakness Variant Reliance on IP Address for Authentication - (291)

Weakness Base Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking - (649)

Weakness Variant

Weakness Variant Reliance on Reverse DNS Resolution for a Security-Critical Action - (350)

Weakness Base Reliance on Security Through Obscurity - (656)

Weakness Base Reliance on Untrusted Inputs in a Security Decision - (807)

Weakness Base Response Discrepancy Information Exposure - (204)

Weakness Base Return of Pointer Value Outside of Expected Range - (466)

Weakness Base Return of Wrong Status Code - (393)

Weakness Base Reusing a Nonce, Key Pair in Encryption - (323)

Weakness Base Reversible One-Way Hash - (328)

Weakness Base Same Seed in PRNG - (336)

Weakness Variant

Weakness Variant Sensitive Cookie Without 'HttpOnly' Flag - (1004)

Weakness Variant

Weakness Variant Sensitive Data Under FTP Root - (220)

Weakness Base Sensitive Information Uncleared Before Release - (226)

Weakness Base Server-Side Request Forgery (SSRF) - (918)

Compound Element: Composite

Compound Element: Composite Session Fixation - (384)

Weakness Base Signal Handler Race Condition - (364)

Weakness Variant

Weakness Variant Signal Handler Use of a Non-reentrant Function - (479)

Weakness Base Small Seed Space in PRNG - (339)

Weakness Base Small Space of Random Values - (334)

Weakness Base Spyware - (512)

Weakness Variant

Weakness Variant SQL Injection: Hibernate - (564)

Weakness Variant

Weakness Variant Stack-based Buffer Overflow - (121)

Weakness Base Storage of Sensitive Data in a Mechanism without Access Control - (921)

Weakness Base Storing Passwords in a Recoverable Format - (257)

Weakness Base Symbolic Name not Mapping to Correct Object - (386)

Category Technology-Specific Input Validation Problems - (100)

Weakness Class Transmission of Private Resources into a New Sphere ('Resource Leak') - (402)

Weakness Base Trapdoor - (510)

Weakness Base Truncation of Security-relevant Information - (222)

Weakness Base Trust Boundary Violation - (501)

Weakness Base Trust of System Event Data - (360)

Weakness Variant

Weakness Variant Trusting HTTP Permission Methods on the Server Side - (650)

Weakness Base UI Discrepancy for Security Feature - (446)

Weakness Base Unchecked Error Condition - (391)

Weakness Variant

Weakness Variant Uncontrolled Memory Allocation - (789)

Weakness Base Uncontrolled Recursion - (674)

Weakness Base Uncontrolled Resource Consumption ('Resource Exhaustion') - (400)

Weakness Base Undefined Behavior for Input to API - (475)

Weakness Base Unexpected Status Code or Return Value - (394)

Weakness Base Unimplemented or Unsupported Feature in UI - (447)

Weakness Class Unintended Proxy or Intermediary ('Confused Deputy') - (441)

Weakness Class Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') - (637)

Weakness Base Unprotected Alternate Channel - (420)

Weakness Base Unprotected Primary Channel - (419)

Weakness Variant

Weakness Variant Unprotected Transport of Credentials - (523)

Weakness Variant

Weakness Variant Unprotected Windows Messaging Channel ('Shatter') - (422)

Weakness Base Unrestricted Externally Accessible Lock - (412)

Weakness Base Unrestricted Upload of File with Dangerous Type - (434)

Weakness Variant

Weakness Variant Unsafe ActiveX Control Marked Safe For Scripting - (623)

Weakness Base Unsynchronized Access to Shared Data in a Multithreaded Context - (567)

Compound Element: Composite

Compound Element: Composite Untrusted Search Path - (426)

Weakness Base Unverified Ownership - (283)

Weakness Variant

Weakness Variant Unverified Password Change - (620)

Weakness Variant

Weakness Variant URL Redirection to Untrusted Site ('Open Redirect') - (601)

Weakness Base Use After Free - (416)

Weakness Base Use of a Broken or Risky Cryptographic Algorithm - (327)

Weakness Base Use of a Key Past its Expiration Date - (324)

Weakness Base Use of a Non-reentrant Function in a Concurrent Context - (663)

Weakness Base Use of Client-Side Authentication - (603)

Weakness Base Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) - (338)

Weakness Base Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') - (470)

Weakness Base Use of Function with Inconsistent Implementations - (474)

Weakness Base Use of Hard-coded Credentials - (798)

Weakness Base Use of Hard-coded Cryptographic Key - (321)

Weakness Base Use of Hard-coded Password - (259)

Weakness Variant

Weakness Variant Use of Implicit Intent for Sensitive Communication - (927)

Weakness Base Use of Incorrect Byte Ordering - (198)

Weakness Class Use of Incorrectly-Resolved Name or Reference - (706)

Weakness Class Use of Insufficiently Random Values - (330)

Weakness Base Use of Invariant Value in Dynamically Changing Context - (344)

Weakness Base Use of Less Trusted Source - (348)

Weakness Base Use of Low-Level Functionality - (695)

Weakness Base Use of Multiple Resources with Duplicate Identifier - (694)

Weakness Variant

Weakness Variant Use of Non-Canonical URL Paths for Authorization Decisions - (647)

Weakness Base Use of Password Hash With Insufficient Computational Effort - (916)

Weakness Base Use of Password System for Primary Authentication - (309)

Weakness Base Use of Potentially Dangerous Function - (676)

Weakness Variant

Weakness Variant Use of RSA Algorithm without OAEP - (780)

Weakness Base Use of Single-factor Authentication - (308)

Weakness Base User Interface (UI) Misrepresentation of Critical Information - (451)

Weakness Variant

Weakness Variant Using Referer Field for Authentication - (293)

Weakness Class Violation of Secure Design Principles - (657)

Weakness Variant

Weakness Variant Weak Cryptography for Passwords - (261)

Weakness Base Weak Password Recovery Mechanism for Forgotten Password - (640)

Weakness Base Weak Password Requirements - (521)

Weakness Base XML Injection (aka Blind XPath Injection) - (91)

Content History

Submissions
Submission Date	Submitter	Organization	Source
2008-09-09		MITRE	Internal CWE Team
2008-09-09
Modifications
Modification Date	Modifier	Organization	Source
2009-02-10 (Critical)	CWE Content Team	MITRE	Internal
2009-02-10 (Critical)	Updated the View_Filter to reflect new structure in CWE Schema v4.2
2009-03-10	CWE Content Team	MITRE	Internal
2009-03-10	updated View_Filter
2017-01-19	CWE Content Team	MITRE	Internal
2017-01-19	updated Relationships

View Metrics

	CWEs in this view		Total CWEs
Total	382	out of	1006
Views	0	out of	33
Categories	3	out of	245
Weaknesses	376	out of	720
Compound_Elements	3	out of	8

More information is available — Please select a different filter.

Page Last Updated: May 05, 2017


	Use of the Common Weakness Enumeration and the associated references from this website are subject to the Terms of Use. For more information, please email cwe@mitre.org. CWE is sponsored by US-CERT in the office of Cybersecurity and Communications at the U.S. Department of Homeland Security. Copyright © 2006-2017, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.	Privacy policy Terms of use Contact us