CWE - Differences between Version 4.20 and Version 5.0

Home > CWE List > Reports > Differences between Version 4.20 and Version 5.0

Differences between Version 4.20 and Version 5.0

Summary | Field Change Summary | Important Changes | Detailed Difference Report

Summary

Total weaknesses/chains/composites (Version 5.0)	956
Total weaknesses/chains/composites (Version 4.20)	944
Total new	27
Total deprecated	3
Total with major changes	1179
Total with only minor changes	9
Total unchanged	259

Summary of Entry Types

Type	Version 4.20	Version 5.0
Weakness	944	956
Grouping		396
Category	387
View	55	58
Deprecated	64	67
Total	1450	1477

Field Change Summary

Any change with respect to whitespace is ignored. "Minor" changes are text changes that only affect capitalization and punctuation. Most other changes are marked as "Major." Simple schema changes are treated as Minor, such as the change from AffectedResource to Affected_Resource in Draft 8, or the relationship name change from "IsRequiredBy" to "RequiredBy" in Version 1.0. For each mutual relationship between nodes A and B (such as ParentOf and ChildOf), a relationship change is noted for both A and B.

Field	Major	Minor
Name	53	1
Description	509	1
Mapping_Notes	434	0
Diagram	5	0
Relationships	192	0
Common_Consequences	372	2
Applicable_Platforms	82	0
Time_of_Introduction	28	0
Modes_of_Introduction	104	0
Detection_Factors	113	0
Potential_Mitigations	70	0
Demonstrative_Examples	99	1
Observed_Examples	81	39
Weakness_Ordinalities	14	0
Dimensions	109	0
Technical_Nuance	51	0
Likelihood_of_Exploit	1	0
References	284	0
Terminology_Notes	18	0
Alternate_Terms	34	2
Related_Attack_Patterns	0	0
Relationship_Notes	6	0
Taxonomy_Mappings	82	0
Maintenance_Notes	6	0
Affected_Resources	0	0
Functional_Areas	5	0
Research_Gaps	4	0
Background_Details	123	0
Theoretical_Notes	1	0
Other_Notes	10	0
View_Type	0	0
View_Structure	0	0
View_Filter	0	0
View_Audience	2	0
Type	410	0
Source_Taxonomy	0	0

Form and Abstraction Changes

From	To	Total	CWE IDs
Unchanged		1040
Category	Grouping	387	2, 16, 19, 133, 136, 137, 189, 199, 227, 251, 254, 255, 264, 265, 275, 310, 320, 355, 361, 371, 387, 388, 389, 398, 399, 411, 417, 429, 438, 452, 465, 485, 557, 569, 712, 713, 714, 715, 716, 717, 718, 719, 720, 721, 722, 723, 724, 725, 726, 727, 728, 729, 730, 731, 735, 736, 737, 738, 739, 740, 741, 742, 743, 744, 745, 746, 747, 748, 751, 752, 753, 801, 802, 803, 808, 810, 811, 812, 813, 814, 815, 816, 817, 818, 819, 840, 845, 846, 847, 848, 849, 850, 851, 852, 853, 854, 855, 856, 857, 858, 859, 860, 861, 864, 865, 866, 867, 869, 870, 871, 872, 873, 874, 875, 876, 877, 878, 879, 880, 881, 882, 883, 885, 886, 887, 889, 890, 891, 892, 893, 894, 895, 896, 897, 898, 899, 901, 902, 903, 904, 905, 906, 907, 929, 930, 931, 932, 933, 934, 935, 936, 937, 938, 944, 945, 946, 947, 948, 949, 950, 951, 952, 953, 954, 955, 956, 957, 958, 959, 960, 961, 962, 963, 964, 965, 966, 967, 968, 969, 970, 971, 972, 973, 974, 975, 976, 977, 978, 979, 980, 981, 982, 983, 984, 985, 986, 987, 988, 989, 990, 991, 992, 993, 994, 995, 996, 997, 998, 1001, 1002, 1005, 1006, 1009, 1010, 1011, 1012, 1013, 1014, 1015, 1016, 1017, 1018, 1019, 1020, 1027, 1028, 1029, 1030, 1031, 1032, 1033, 1034, 1035, 1036, 1129, 1130, 1131, 1132, 1134, 1135, 1136, 1137, 1138, 1139, 1140, 1141, 1142, 1143, 1144, 1145, 1146, 1147, 1148, 1149, 1150, 1151, 1152, 1153, 1155, 1156, 1157, 1158, 1159, 1160, 1161, 1162, 1163, 1165, 1166, 1167, 1168, 1169, 1170, 1171, 1172, 1175, 1179, 1180, 1181, 1182, 1183, 1184, 1185, 1186, 1195, 1196, 1197, 1198, 1199, 1201, 1202, 1203, 1205, 1206, 1207, 1208, 1210, 1211, 1212, 1213, 1214, 1215, 1216, 1217, 1218, 1219, 1225, 1226, 1227, 1228, 1237, 1238, 1306, 1307, 1308, 1309, 1345, 1346, 1347, 1348, 1349, 1352, 1353, 1354, 1355, 1356, 1359, 1360, 1361, 1362, 1363, 1364, 1365, 1366, 1367, 1368, 1369, 1370, 1371, 1372, 1373, 1374, 1375, 1376, 1377, 1378, 1379, 1380, 1381, 1382, 1383, 1388, 1396, 1397, 1398, 1399, 1401, 1402, 1403, 1404, 1405, 1406, 1407, 1408, 1409, 1410, 1411, 1412, 1413, 1414, 1415, 1416, 1417, 1418, 1433, 1436, 1437, 1438, 1439, 1440, 1441, 1442, 1443, 1444, 1445, 1446, 1447
Weakness/Base	Deprecated	2	391, 613
Weakness/Base	Weakness/Class	12	240, 372, 455, 501, 757, 1024, 1025, 1041, 1068, 1127, 1250, 1329
Weakness/Base	Weakness/Variant	3	395, 562, 767
Weakness/Class	Deprecated	1	377
Weakness/Class	Weakness/Base	1	185
Weakness/Variant	Weakness/Base	4	174, 546, 646, 768

Status Changes

From	To	Total
Unchanged		1446
Incomplete	Deprecated	3
Incomplete	Obsolete	1

Relationship Changes

The "Version 5.0 Total" lists the total number of relationships in Version 5.0. The "Shared" value is the total number of relationships in entries that were in both Version 5.0 and Version 4.20. The "New" value is the total number of relationships involving entries that did not exist in Version 4.20. Thus, the total number of relationships in Version 5.0 would combine stats from Shared entries and New entries.

Relationship	Version 5.0 Total	Version 4.20 Total	Version 5.0 Shared	Unchanged	Added to Version 5.0	Removed from Version 4.20	Version 5.0 New
ALL	13525	13208	13235	13108	127	100	290
ChildOf	5674	5578	5581	5530	51	48	93
ParentOf	5674	5578	5581	5530	51	48	93
MemberOf	813	764	764	764			49
HasMember	813	764	764	764			49
CanPrecede	148	143	146	142	4	1	2
CanFollow	148	143	146	142	4	1	2
StartsWith	3	3	3	3
Requires	13	13	13	13
RequiredBy	13	13	13	13
Overlaps	6	0	4		4		2
CanAlsoBe	28	27	28	25	3	2
PeerOf	192	182	192	182	10

Nodes Removed in Version 5.0

CWE-ID	CWE Name
None.

Nodes Added to Version 5.0

CWE-ID	CWE Name
1449	Weaknesses Addressed by the OpenSSF Secure Coding Guide for Python (2026)
1451	OpenSSF Secure Coding Guide for Python (2026) - 01 Introduction
1452	OpenSSF Secure Coding Guide for Python (2026) - 02 Encoding and Strings
1453	OpenSSF Secure Coding Guide for Python (2026) - 03 Numbers
1454	OpenSSF Secure Coding Guide for Python (2026) - 04 Neutralization
1455	OpenSSF Secure Coding Guide for Python (2026) - 05 Exception Handling
1456	OpenSSF Secure Coding Guide for Python (2026) - 06 Logging
1457	OpenSSF Secure Coding Guide for Python (2026) - 07 Concurrency
1458	OpenSSF Secure Coding Guide for Python (2026) - 08 Coding Standards
1459	OpenSSF Secure Coding Guide for Python (2026) - 09 Cryptography
1460	Weaknesses Addressed by the Top 20 Secure PLC Coding Practices
1461	Hardware Simulation / Synthesis Mismatch
1462	Improper Session Management
1463	Insufficient Session Timeout Value
1464	Improper Session Invalidation
1465	Improper Session Invalidation after User Logout
1466	Improper Session Invalidation after Authentication Credential Change
1467	Use of Singular Authentication Artifact for Multiple User Sessions
1468	Weaknesses Addressed by the OWASP Golang Secure Coding Practices Guide
1469	Improper Check for Credential Expiration
1470	Improper External Identity Verification
1471	Insufficiently Controlled Parser Differential
1472	Generation of Credential with Long Expiration
1473	Improper Expiration of Cached Data
1474	Non-Equivalent Data Transformation
1475	Incomplete Data/State Propagation
1476	Improper Request Propagation before Data Reception in Write Transactions in a Bus Architecture

Nodes Deprecated in Version 5.0

CWE-ID	CWE Name
377	DEPRECATED: Insecure Temporary File
391	DEPRECATED: Unchecked Error Condition
613	DEPRECATED: Insufficient Session Expiration

Important Changes

A node change is labeled "important" if it is a major field change and the field is critical to the meaning of the node. The critical fields are description, name, and relationships.

Key
D	Description
N	Name
R	Relationships

D			5	J2EE Misconfiguration: Data Transmission Without Encryption
D			6	J2EE Misconfiguration: Insufficient Session-ID Length
D			7	J2EE Misconfiguration: Missing Custom Error Page
D			8	J2EE Misconfiguration: Entity Bean Declared Remote
D			11	ASP.NET Misconfiguration: Creating Debug Binary
D			14	Compiler Removal of Code to Clear Buffers
D			15	External Control of System or Configuration Setting
D		R	20	Improper Input Validation
	N	R	22	Improper Limitation of a Pathname to a Restricted Directory
D			24	Path Traversal: '../filedir'
D			25	Path Traversal: '/../filedir'
D			26	Path Traversal: '/dir/../filename'
D			27	Path Traversal: 'dir/../../filename'
D			28	Path Traversal: '..\filedir'
D			29	Path Traversal: '\..\filename'
D			30	Path Traversal: '\dir\..\filename'
D			31	Path Traversal: 'dir\..\..\filename'
D			32	Path Traversal: '...' (Triple Dot)
D			33	Path Traversal: '....' (Multiple Dot)
D			34	Path Traversal: '....//'
D			36	Absolute Path Traversal
D			37	Path Traversal: '/absolute/pathname/here'
D			38	Path Traversal: '\absolute\pathname\here'
		R	41	Improper Resolution of Path Equivalence
		R	50	Path Equivalence: '//multiple/leading/slash'
	N		59	Improper Link Resolution Before File Access
D			61	UNIX Symbolic Link (Symlink) Following
D			62	UNIX Hard Link
D			65	Windows Hard Link
D			66	Improper Handling of File Names that Identify Virtual Resources
D			67	Improper Handling of Windows Device Names
D			69	Improper Handling of Windows ::DATA Alternate Data Stream
D			72	Improper Handling of Apple HFS+ Alternate Data Stream Path
D			73	External Control of File Name or Path
	N		74	Improper Neutralization of Special Elements in Output Used by a Downstream Component
	N		75	Failure to Sanitize Special Elements into a Different Plane
	N		77	Improper Neutralization of Special Elements used in a Command
D	N	R	78	Improper Neutralization of Special Elements used in an OS Command
D	N	R	79	Improper Neutralization of Input During Web Page Generation
	N		80	Improper Neutralization of Script-Related HTML Tags in a Web Page
D			81	Improper Neutralization of Script in an Error Message Web Page
D			82	Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
D			86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages
D	N		88	Improper Neutralization of Argument Delimiters in a Command
	N	R	89	Improper Neutralization of Special Elements used in an SQL Command
	N		90	Improper Neutralization of Special Elements used in an LDAP Query
	N		91	XML Injection
	N		93	Improper Neutralization of CRLF Sequences
	N		94	Improper Control of Generation of Code
	N		95	Improper Neutralization of Directives in Dynamically Evaluated Code
	N		96	Improper Neutralization of Directives in Statically Saved Code
D	N		98	Improper Control of Filename for Include/Require Statement in PHP Program
D	N		99	Improper Control of Resource Identifiers
D			102	Struts: Duplicate Validation Forms
D			105	Struts: Form Field Without Validator
		R	107	Struts: Unused Validation Form
D			108	Struts: Unvalidated Action Form
D			110	Struts: Validator Without Form Field
D			111	Direct Use of Unsafe JNI
D			112	Missing XML Validation
D	N		113	Improper Neutralization of CRLF Sequences in HTTP Headers
D			114	Process Control
D		R	116	Improper Encoding or Escaping of Output
		R	117	Improper Output Neutralization for Logs
	N		118	Incorrect Access of Indexable Resource
D			119	Improper Restriction of Operations within the Bounds of a Memory Buffer
	N	R	120	Buffer Copy without Checking Size of Input
D			121	Stack-based Buffer Overflow
D			122	Heap-based Buffer Overflow
	N	R	124	Buffer Underwrite
		R	125	Out-of-bounds Read
		R	126	Buffer Over-read
		R	128	Wrap-around Error
		R	129	Improper Validation of Array Index
D			131	Incorrect Calculation of Buffer Size
		R	134	Use of Externally-Controlled Format String
D			141	Improper Neutralization of Parameter/Argument Delimiters
D			142	Improper Neutralization of Value Delimiters
D			143	Improper Neutralization of Record Delimiters
D			144	Improper Neutralization of Line Delimiters
D			145	Improper Neutralization of Section Delimiters
D			146	Improper Neutralization of Expression/Command Delimiters
D			147	Improper Neutralization of Input Terminators
D			154	Improper Neutralization of Variable Name Delimiters
D			155	Improper Neutralization of Wildcards or Matching Symbols
D			156	Improper Neutralization of Whitespace
D			158	Improper Neutralization of Null Byte or NUL Character
D			160	Improper Neutralization of Leading Special Elements
D			161	Improper Neutralization of Multiple Leading Special Elements
D			162	Improper Neutralization of Trailing Special Elements
D			163	Improper Neutralization of Multiple Trailing Special Elements
D			164	Improper Neutralization of Internal Special Elements
D			165	Improper Neutralization of Multiple Internal Special Elements
D		R	170	Improper Null Termination
D	N		172	Improper Encoding or Decoding of Data
D			174	Double Decoding of the Same Data
		R	175	Improper Handling of Mixed Encoding
		R	176	Improper Handling of Unicode Encoding
D			178	Improper Handling of Case Sensitivity
D			179	Incorrect Behavior Order: Early Validation
D		R	180	Incorrect Behavior Order: Validate Before Canonicalize
D			181	Incorrect Behavior Order: Validate Before Filter
		R	182	Collapse of Data into Unsafe Value
		R	184	Incomplete List of Disallowed Inputs
D			185	Incorrect Regular Expression
D			186	Overly Restrictive Regular Expression
D			187	Partial String Comparison
D			188	Reliance on Data/Memory Layout
		R	190	Integer Overflow or Wraparound
		R	191	Integer Underflow (Wrap or Wraparound)
D			192	Integer Coercion Error
D			194	Unexpected Sign Extension
D			195	Signed to Unsigned Conversion Error
D		R	196	Unsigned to Signed Conversion Error
D		R	197	Numeric Truncation Error
D		R	200	Exposure of Sensitive Information to an Unauthorized Actor
		R	201	Insertion of Sensitive Information Into Sent Data
D			202	Exposure of Sensitive Information Through Data Queries
		R	203	Observable Discrepancy
		R	204	Observable Response Discrepancy
D			205	Observable Behavioral Discrepancy
D			206	Observable Internal Behavioral Discrepancy
D			207	Observable Behavioral Discrepancy With Equivalent Products
D			208	Observable Timing Discrepancy
		R	209	Generation of Error Message Containing Sensitive Information
		R	212	Improper Removal of Sensitive Information Before Storage or Transfer
D			213	Exposure of Sensitive Information Due to Incompatible Policies
D			214	Invocation of Process Using Visible Sensitive Information
D		R	215	Insertion of Sensitive Information Into Debugging Code
D			219	Storage of File with Sensitive Data Under Web Root
		R	221	Information Loss or Omission
D		R	226	Sensitive Information in Resource Not Removed Before Reuse
D			242	Use of Inherently Dangerous Function
D			243	Creation of chroot Jail Without Changing Working Directory
D	N		244	Improper Clearing of Heap Memory Before Release
D			245	J2EE Bad Practices: Direct Management of Connections
D			246	J2EE Bad Practices: Direct Use of Sockets
D			248	Uncaught Exception
D		R	252	Unchecked Return Value
D			253	Incorrect Check of Function Return Value
D			259	Use of Hard-coded Password
D			260	Password in Configuration File
D			261	Weak Encoding for Password
D		R	262	Not Using Password Aging
D		R	263	Password Aging with Long Expiration
D			271	Privilege Dropping / Lowering Errors
D			273	Improper Check for Dropped Privileges
D			274	Improper Handling of Insufficient Privileges
D		R	284	Improper Access Control
		R	285	Improper Authorization
D			286	Incorrect User Management
		R	287	Improper Authentication
D			291	Reliance on IP Address for Authentication
		R	295	Improper Certificate Validation
D			297	Improper Validation of Certificate with Host Mismatch
D			299	Improper Check for Certificate Revocation
D			300	Channel Accessible by Non-Endpoint
D			303	Incorrect Implementation of Authentication Algorithm
D			304	Missing Critical Step in Authentication
	N	R	306	Missing Authentication for Critical Functionality
		R	307	Improper Restriction of Excessive Authentication Attempts
		R	309	Use of Password System for Primary Authentication
		R	311	Missing Encryption of Sensitive Data
		R	312	Cleartext Storage of Sensitive Information
D			313	Cleartext Storage in a File or on Disk
D			314	Cleartext Storage in the Registry
D			315	Cleartext Storage of Sensitive Information in a Cookie
D			316	Cleartext Storage of Sensitive Information in Memory
D			317	Cleartext Storage of Sensitive Information in GUI
D			318	Cleartext Storage of Sensitive Information in Executable
		R	319	Cleartext Transmission of Sensitive Information
		R	321	Use of Hard-coded Cryptographic Key
D			322	Key Exchange without Entity Authentication
D			324	Use of a Key Past its Expiration Date
		R	325	Missing Cryptographic Step
D			326	Inadequate Encryption Strength
		R	328	Use of Weak Hash
		R	330	Use of Insufficiently Random Values
D			333	Improper Handling of Insufficient Entropy in TRNG
D			336	Same Seed in Pseudo-Random Number Generator (PRNG)
D			337	Predictable Seed in Pseudo-Random Number Generator (PRNG)
D			343	Predictable Value Range from Previous Values
		R	345	Insufficient Verification of Data Authenticity
D			350	Reliance on Reverse DNS Resolution for a Security-Critical Action
	N	R	352	Cross-Site Request Forgery
D		R	353	Missing Support for Integrity Check
D		R	354	Improper Validation of Integrity Check Value
D	N	R	356	Missing User Interaction for Potentially Unsafe Action
D			360	Trust of System Event Data
D	N	R	362	Concurrent Execution using Shared Resource with Improper Synchronization
D			363	Race Condition Enabling Link Following
D			364	Signal Handler Race Condition
D			365	DEPRECATED: Race Condition in Switch
D		R	369	Divide By Zero
D			370	Missing Check for Certificate Revocation after Initial Check
D			374	Passing Mutable Objects to an Untrusted Method
D			375	Returning a Mutable Object to an Untrusted Caller
D	N	R	377	DEPRECATED: Insecure Temporary File
D			379	Creation of Temporary File in Directory with Insecure Permissions
D			382	J2EE Bad Practices: Use of System.exit()
D			383	J2EE Bad Practices: Direct Use of Threads
		R	384	Session Fixation
D			385	Covert Timing Channel
D	N	R	391	DEPRECATED: Unchecked Error Condition
		R	392	Missing Report of Error Condition
D			393	Return of Wrong Status Code
D			395	Use of NullPointerException Catch to Detect NULL Pointer Dereference
D		R	396	Declaration of Catch for Generic Exception
D		R	397	Declaration of Throws for Generic Exception
		R	400	Uncontrolled Resource Consumption
	N		402	Transmission of Private Resources into a New Sphere
D	N		403	Exposure of File Descriptor to Unintended Control Sphere
		R	404	Improper Resource Shutdown or Release
D			405	Asymmetric Resource Consumption (Amplification)
D		R	409	Improper Handling of Highly Compressed Data (Data Amplification)
D		R	410	Insufficient Resource Pool
D			413	Improper Resource Locking
D			418	DEPRECATED: Channel Errors
D			421	Race Condition During Access to Alternate Channel
	N		422	Unprotected Windows Messaging Channel
	N		425	Direct Request
D		R	426	Untrusted Search Path
D			428	Unquoted Search Path or Element
D			430	Deployment of Wrong Handler
D			432	Dangerous Signal Handler not Disabled During Sensitive Operations
		R	435	Improper Interaction Between Multiple Correctly-Behaving Entities
D		R	436	Interpretation Conflict
D	N		441	Unintended Proxy or Intermediary
	N	R	444	Inconsistent Interpretation of HTTP Requests
D			446	UI Discrepancy for Security Feature
D		R	451	User Interface (UI) Misrepresentation of Critical Information
D			454	External Initialization of Trusted Variables or Data Stores
D			456	Missing Initialization of a Variable
D			457	Use of Uninitialized Variable
		R	459	Incomplete Cleanup
D		R	460	Improper Cleanup on Thrown Exception
D			462	Duplicate Key in Associative List (Alist)
D			467	Use of sizeof() on a Pointer Type
D	N		470	Use of Externally-Controlled Input to Select Classes or Code
D			471	Modification of Assumed-Immutable Data (MAID)
D		R	472	External Control of Assumed-Immutable Web Parameter
D			474	Use of Function with Inconsistent Implementations
		R	476	NULL Pointer Dereference
D			478	Missing Default Case in Multiple Condition Expression
D			479	Signal Handler Use of a Non-reentrant Function
D		R	480	Use of Incorrect Operator
D			481	Assigning instead of Comparing
D			482	Comparing instead of Assigning
D			483	Incorrect Block Delimitation
D			484	Omitted Break Statement in Switch
D			486	Comparison of Classes by Name
D			487	Reliance on Package-level Scope
D			488	Exposure of Data Element to Wrong Session
		R	489	Active Debug Code
	N		491	Public cloneable() Method Without Final
D		R	493	Critical Public Variable Without Final Modifier
D			494	Download of Code Without Integrity Check
		R	495	Private Data Structure Returned From A Public Method
		R	496	Public Data Assigned to Private Array-Typed Field
D		R	497	Exposure of Sensitive System Information to an Unauthorized Control Sphere
D			498	Cloneable Class Containing Sensitive Information
D			499	Serializable Class Containing Sensitive Data
D			500	Public Static Field Not Marked Final
D		R	501	Trust Boundary Violation
		R	502	Deserialization of Untrusted Data
D			506	Embedded Malicious Code
D			511	Logic/Time Bomb
D			512	Spyware
D			514	Covert Channel
D			515	Covert Storage Channel
D			520	.NET Misconfiguration: Use of Impersonation
D			524	Use of Cache Containing Sensitive Information
D			526	Cleartext Storage of Sensitive Information in an Environment Variable
D			527	Exposure of Version-Control Repository to an Unauthorized Control Sphere
D			529	Exposure of Access Control List Files to an Unauthorized Control Sphere
D			530	Exposure of Backup File to an Unauthorized Control Sphere
		R	532	Insertion of Sensitive Information into Log File
D			539	Use of Persistent Cookies Containing Sensitive Information
D			540	Inclusion of Sensitive Information in Source Code
D			543	Use of Singleton Pattern Without Synchronization in a Multithreaded Context
D			544	Missing Standardized Error Handling Mechanism
D			546	Suspicious Comment
D			547	Use of Hard-coded, Security-relevant Constants
D			550	Server-generated Error Message Containing Sensitive Information
D			552	Files or Directories Accessible to External Parties
D			555	J2EE Misconfiguration: Plaintext Password in Configuration File
D			556	ASP.NET Misconfiguration: Use of Identity Impersonation
D			558	Use of getlogin() in Multithreaded Application
D		R	561	Dead Code
D			562	Return of Stack Variable Address
D			563	Assignment to Variable without Use
D	N		564	Use of Hibernate with HQL/SQL Query String Containing External Input
D			566	Authorization Bypass Through User-Controlled SQL Primary Key
D			568	finalize() Method Without super.finalize()
D			572	Call to Thread run() instead of start()
D		R	573	Improper Following of Specification by Caller
D			574	EJB Bad Practices: Use of Synchronization Primitives
D			575	EJB Bad Practices: Use of AWT Swing
D		R	577	EJB Bad Practices: Use of Sockets
D		R	578	EJB Bad Practices: Use of Class Loader
D			579	J2EE Bad Practices: Non-serializable Object Stored in Session
D			580	clone() Method Without super.clone()
D			581	Object Model Violation: Just One of Equals and Hashcode Defined
		R	582	Array Declared Public, Final, and Static
D		R	583	finalize() Method Declared Public
D		R	584	Return Inside Finally Block
D			585	Empty Synchronized Block
D			586	Explicit Call to Finalize()
D			587	Assignment of a Fixed Address to a Pointer
D			588	Attempt to Access Child of a Non-structure Pointer
D			589	Call to Non-ubiquitous API
D			590	Free of Memory not on the Heap
D			591	Sensitive Data Storage in Improperly Locked Memory
D			593	Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
D			594	J2EE Framework: Saving Unserializable Objects to Disk
		R	595	Comparison of Object References Instead of Object Contents
D			597	Use of Wrong Operator in String Comparison
D			600	Uncaught Exception in Servlet
	N	R	601	URL Redirection to Untrusted Site
D			602	Client-Side Enforcement of Server-Side Security
D			603	Use of Client-Side Authentication
D			605	Multiple Binds to the Same Port
D		R	608	Struts: Non-private Field in ActionForm Class
D			612	Improper Authorization of Index Containing Sensitive Information
D	N	R	613	DEPRECATED: Insufficient Session Expiration
D			615	Inclusion of Sensitive Information in Source Code Comments
D			616	Incomplete Identification of Uploaded File Variables (PHP)
D		R	617	Reachable Assertion
D			618	Exposed Unsafe ActiveX Method
D	N		619	Dangling Database Cursor
D			620	Unverified Password Change
D			621	Variable Extraction Error
D			622	Improper Validation of Function Hook Arguments
D			623	Unsafe ActiveX Control Marked Safe For Scripting
D			625	Permissive Regular Expression
D			627	Dynamic Variable Evaluation
D			628	Function Call with Incorrectly Specified Arguments
D	N		636	Not Failing Securely
D			637	Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
D			639	Authorization Bypass Through User-Controlled Key
D			640	Weak Password Recovery Mechanism for Forgotten Password
D	N		643	Improper Neutralization of Data within XPath Expressions
D			644	Improper Neutralization of HTTP Headers for Scripting Syntax
D			645	Overly Restrictive Account Lockout Mechanism
D			646	Reliance on File Name or Extension of Externally-Supplied File
D			647	Use of Non-Canonical URL Paths for Authorization Decisions
D			650	Trusting HTTP Permission Methods on the Server Side
D			651	Exposure of WSDL File Containing Sensitive Information
D	N		652	Improper Neutralization of Data within XQuery Expressions
D		R	653	Improper Isolation or Compartmentalization
D			656	Reliance on Security Through Obscurity
D			657	Violation of Secure Design Principles
D			662	Improper Synchronization
D		R	664	Improper Control of a Resource Through its Lifetime
D		R	665	Improper Initialization
D			666	Operation on Resource in Wrong Phase of Lifetime
D			667	Improper Locking
		R	668	Exposure of Resource to Wrong Sphere
D			671	Lack of Administrator Control over Security
		R	672	Operation on a Resource after Expiration or Release
D			673	External Influence of Sphere Definition
		R	681	Incorrect Conversion between Numeric Types
D			682	Incorrect Calculation
D			683	Function Call With Incorrect Order of Arguments
D			684	Incorrect Provision of Specified Functionality
D			686	Function Call With Incorrect Argument Type
D			690	Unchecked Return Value to NULL Pointer Dereference
		R	691	Insufficient Control Flow Management
D			692	Incomplete Denylist to Cross-Site Scripting
D		R	693	Protection Mechanism Failure
D			694	Use of Multiple Resources with Duplicate Identifier
D		R	695	Use of Low-Level Functionality
D			697	Incorrect Comparison
		R	703	Improper Check or Handling of Exceptional Conditions
		R	704	Incorrect Type Conversion or Cast
		R	705	Incorrect Control Flow Scoping
D		R	707	Improper Neutralization
D			708	Incorrect Ownership Assignment
D		R	710	Improper Adherence to Coding Standards
D		R	732	Incorrect Permission Assignment for Critical Resource
D			749	Exposed Dangerous Method or Function
D		R	754	Improper Check for Unusual or Exceptional Conditions
		R	755	Improper Handling of Exceptional Conditions
D	N		757	Selection of Less-Secure Algorithm During Negotiation
D			758	Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
D			759	Use of a One-Way Hash without a Salt
D			760	Use of a One-Way Hash with a Predictable Salt
D			761	Free of Pointer not at Start of Buffer
D			762	Mismatched Memory Management Routines
D			763	Release of Invalid Pointer or Reference
D			764	Multiple Locks of a Critical Resource
D			765	Multiple Unlocks of a Critical Resource
D			766	Critical Data Element Declared Public
D			767	Access to Critical Private Variable via Public Method
D		R	768	Incorrect Short Circuit Evaluation
D			771	Missing Reference to Active Allocated Resource
D			773	Missing Reference to Active File Descriptor or Handle
D			774	Allocation of File Descriptors or Handles Without Limits or Throttling
D			775	Missing Release of File Descriptor or Handle after Effective Lifetime
D	N		776	Improper Restriction of Recursive Entity References in DTDs
D			777	Regular Expression without Anchors
D		R	778	Insufficient Logging
D			779	Logging of Excessive Data
D			780	Use of RSA Algorithm without OAEP
D			781	Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
D		R	783	Operator Precedence Logic Error
D			784	Reliance on Cookies without Validation and Integrity Checking in a Security Decision
D		R	785	Use of Path Manipulation Function without Maximum-sized Buffer
D			786	Access of Memory Location Before Start of Buffer
		R	787	Out-of-bounds Write
D		R	788	Access of Memory Location After End of Buffer
D		R	790	Improper Filtering of Special Elements
D			791	Incomplete Filtering of Special Elements
D			792	Incomplete Filtering of One or More Instances of Special Elements
D			793	Only Filtering One Instance of a Special Element
D			794	Incomplete Filtering of Multiple Instances of Special Elements
D			795	Only Filtering Special Elements at a Specified Location
D		R	798	Use of Hard-coded Credentials
D			799	Improper Control of Interaction Frequency
D			804	Guessable CAPTCHA
D			805	Buffer Access with Incorrect Length Value
D			806	Buffer Access Using Size of Source Buffer
D			807	Reliance on Untrusted Inputs in a Security Decision
D			820	Missing Synchronization
D			821	Incorrect Synchronization
D			822	Untrusted Pointer Dereference
D			823	Use of Out-of-range Pointer Offset
D			824	Access of Uninitialized Pointer
D			825	Expired Pointer Dereference
D			826	Premature Release of Resource During Expected Lifetime
D			830	Inclusion of Web Functionality from an Untrusted Source
D			832	Unlock of a Resource that is not Locked
		R	833	Deadlock
D			834	Excessive Iteration
	N		835	Loop with Unreachable Exit Condition
D			836	Use of Password Hash Instead of Password for Authentication
D			837	Improper Enforcement of a Single, Unique Action
D			838	Inappropriate Encoding for Output Context
D		R	839	Numeric Range Comparison Without Minimum Check
D		R	841	Improper Enforcement of Behavioral Workflow
D			842	Placement of User into Incorrect Group
D	N	R	843	Access of Resource Using Incompatible Type
		R	862	Missing Authorization
		R	863	Incorrect Authorization
D			908	Use of Uninitialized Resource
D			909	Missing Initialization of Resource
D			910	Use of Expired File Descriptor
D			911	Improper Update of Reference Count
D			912	Hidden Functionality
D			913	Improper Control of Dynamically-Managed Code Resources
D			914	Improper Control of Dynamically-Identified Variables
D			915	Improperly Controlled Modification of Dynamically-Determined Object Attributes
D	N		917	Improper Neutralization of Special Elements used in an Expression Language Statement
	N		918	Server-Side Request Forgery
D			920	Improper Restriction of Power Consumption
D			922	Insecure Storage of Sensitive Information
D		R	923	Improper Restriction of Communication Channel to Intended Endpoints
D			924	Improper Enforcement of Message Integrity During Transmission in a Communication Channel
D			925	Improper Verification of Intent by Broadcast Receiver
D			926	Improper Export of Android Application Components
		R	927	Use of Implicit Intent for Sensitive Communication
D			940	Improper Verification of Source of a Communication Channel
D			941	Incorrectly Specified Destination in a Communication Channel
D			942	Permissive Cross-domain Security Policy with Untrusted Domains
D			943	Improper Neutralization of Special Elements in Data Query Logic
D	N		1000	Complete Weakness Hierarchy
D			1007	Insufficient Visual Distinction of Homoglyphs Presented to User
D			1008	Architectural Concepts
D			1022	Use of Web Link to Untrusted Target with window.opener Access
D			1025	Comparison Using Wrong Factors
D			1039	Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
D			1041	Use of Redundant Code
D			1043	Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
D			1044	Architecture with Number of Horizontal Layers Outside of Expected Range
D			1046	Creation of Immutable Text Using String Concatenation
D			1048	Invokable Control Element with Large Number of Outward Calls
D			1049	Excessive Data Query Operations in a Large Data Table
D			1059	Insufficient Technical Documentation
D			1060	Excessive Number of Inefficient Server-Side Data Accesses
D			1061	Insufficient Encapsulation
D			1064	Invokable Control Element with Signature Containing an Excessive Number of Parameters
		R	1065	Runtime Resource Management Control Element in a Component Built to Run on Application Servers
D			1071	Empty Code Block
D			1073	Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
D			1074	Class with Excessively Deep Inheritance
D		R	1077	Floating Point Comparison with Incorrect Operator
D			1080	Source Code File with Excessive Number of Lines of Code
D			1082	Class Instance Self Destruction Control Element
D			1083	Data Access from Outside Expected Data Manager Component
D			1084	Invokable Control Element with Excessive File or Data Access Operations
D			1085	Invokable Control Element with Excessive Volume of Commented-out Code
D			1086	Class with Excessive Number of Child Classes
D			1089	Large Data Table with Excessive Number of Indices
D			1094	Excessive Index Range Scan for a Data Resource
		R	1095	Loop Condition Value Update within the Loop
		R	1109	Use of Same Variable for Multiple Purposes
D			1112	Incomplete Documentation of Program Execution
D			1115	Source Code Element without Standard Prologue
D			1118	Insufficient Documentation of Error Handling Techniques
		R	1120	Excessive Code Complexity
D			1122	Excessive Halstead Complexity
D			1125	Excessive Attack Surface
D			1127	Compilation with Insufficient Warnings or Errors
D		R	1164	Irrelevant Code
D			1173	Improper Use of Validation Framework
D			1177	Use of Prohibited Code
D			1190	DMA Device Enabled Too Early in Boot Phase
D			1191	On-Chip Debug and Test Interface With Improper Access Control
D			1192	Improper Identifier for IP Block used in System-On-Chip (SOC)
D			1193	Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
		R	1198	Privilege Separation and Access Control Issues
		R	1199	General Circuit and Logic Design Concerns
		R	1201	Core and Compute Issues
		R	1202	Memory and Storage Issues
		R	1203	Peripherals, On-chip Fabric, and Interface/IO Problems
D			1204	Generation of Weak Initialization Vector (IV)
		R	1205	Security Primitives and Cryptography Issues
		R	1206	Power, Clock, Thermal, and Reset Concerns
		R	1208	Cross-Cutting Problems
D			1209	Failure to Disable Reserved Bits
		R	1217	User Session Errors
D		R	1220	Insufficient Granularity of Access Control
D			1221	Incorrect Register Defaults or Module Parameters
D			1222	Insufficient Granularity of Address Regions Protected by Register Locks
D			1223	Race Condition for Write-Once Attributes
D			1224	Improper Restriction of Write-Once Bit Fields
D			1231	Improper Prevention of Lock Bit Modification
D			1232	Improper Lock Behavior After Power State Transition
D			1233	Security-Sensitive Hardware Controls with Missing Lock Bit Protection
D			1234	Hardware Internal or Debug Modes Allow Override of Locks
D		R	1239	Improper Zeroization of Hardware Register
D			1244	Internal Asset Exposed to Unsafe Debug Access Level or State
D			1246	Improper Write Handling in Limited-write Non-Volatile Memories
D			1247	Improper Protection Against Voltage and Clock Glitches
D			1248	Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
D			1251	Mirrored Regions with Different Values
D			1252	CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
D			1255	Comparison Logic is Vulnerable to Power Side-Channel Attacks
D			1257	Improper Access Control Applied to Mirrored or Aliased Memory Regions
D		R	1258	Exposure of Sensitive System Information Due to Uncleared Debug Information
D		R	1259	Improper Restriction of Security Token Assignment
D			1260	Improper Handling of Overlap Between Protected Memory Ranges
		R	1262	Improper Access Control for Register Interface
D			1263	Improper Physical Access Control
		R	1264	Hardware Logic with Insecure De-Synchronization between Control and Data Channels
D			1265	Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
D		R	1266	Improper Scrubbing of Sensitive Data from Decommissioned Device
D			1267	Policy Uses Obsolete Encoding
D			1268	Policy Privileges are not Assigned Consistently Between Control and Data Agents
D			1269	Product Released in Non-Release Configuration
		R	1270	Generation of Incorrect Security Tokens
D			1271	Uninitialized Value on Reset for Registers Holding Security Settings
D		R	1272	Sensitive Information Uncleared Before Debug/Power State Transition
D			1274	Improper Access Control for Volatile Memory Containing Boot Code
D			1275	Sensitive Cookie with Improper SameSite Attribute
D			1276	Hardware Child Block Incorrectly Connected to Parent System
D			1277	Firmware Not Updateable
D			1278	Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
D			1279	Cryptographic Operations are Run Before Supporting Units are Ready
D			1282	Assumed-Immutable Data is Stored in Writable Memory
D			1283	Mutable Attestation or Measurement Reporting Data
D		R	1284	Improper Validation of Specified Quantity in Input
D			1286	Improper Validation of Syntactic Correctness of Input
D			1287	Improper Validation of Specified Type of Input
D			1288	Improper Validation of Consistency within Input
D			1289	Improper Validation of Unsafe Equivalence in Input
D		R	1290	Incorrect Decoding of Security Identifiers
D		R	1292	Incorrect Conversion of Security Identifiers
D			1293	Missing Source Correlation of Multiple Independent Data
D		R	1294	Insecure Security Identifier Mechanism
		R	1295	Debug Messages Revealing Unnecessary Information
D			1296	Incorrect Chaining or Granularity of Debug Components
D			1297	Unprotected Confidential Information on Device is Accessible by OSAT Vendors
D			1298	Hardware Logic Contains Race Conditions
		R	1299	Missing Protection Mechanism for Alternate Hardware Interface
D		R	1300	Improper Protection of Physical Side Channels
D		R	1301	Insufficient or Incomplete Data Removal within Hardware Component
D			1302	Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
D			1304	Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
D			1310	Missing Ability to Patch ROM Code
D			1311	Improper Translation of Security Attributes by Fabric Bridge
D			1313	Hardware Allows Activation of Test or Debug Logic at Runtime
D			1314	Missing Write Protection for Parametric Data Values
D			1316	Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
D			1317	Improper Access Control in Fabric Bridge
D			1318	Missing Support for Security Features in On-chip Fabrics or Buses
D			1319	Improper Protection against Electromagnetic Fault Injection (EM-FI)
D		R	1320	Improper Protection for Outbound Error Messages and Alert Signals
	N		1321	Improperly Controlled Modification of Object Prototype Attributes
D			1322	Use of Blocking Code in Single-threaded, Non-blocking Context
D			1323	Improper Management of Sensitive Trace Data
D			1326	Missing Immutable Root of Trust in Hardware
D		R	1327	Binding to an Unrestricted IP Address
D			1328	Security Version Number Mutable to Older Versions
		R	1329	Reliance on Component That is Not Updateable
D		R	1330	Remanent Data Readable after Memory Erase
D			1332	Improper Handling of Faults that Lead to Instruction Skips
		R	1333	Inefficient Regular Expression Complexity
D			1334	Unauthorized Error Injection Can Degrade Hardware Redundancy
D		R	1335	Incorrect Bitwise Shift of Integer
D			1336	Improper Neutralization of Special Elements Used in a Template Engine
		R	1338	Improper Protections Against Hardware Overheating
D		R	1339	Insufficient Precision or Accuracy of a Real Number
D			1341	Multiple Releases of Same Resource or Handle
		R	1342	Information Exposure through Microarchitectural State after Transient Execution
D		R	1351	Improper Handling of Hardware Behavior in Exceptionally Cold Environments
D		R	1357	Reliance on Insufficiently Trustworthy Component
D		R	1384	Improper Handling of Physical or Environmental Conditions
D		R	1385	Missing Origin Validation in WebSockets
D			1386	Insecure Operation on Windows Junction / Mount Point
D			1389	Incorrect Parsing of Numbers with Different Radices
D		R	1390	Weak Authentication
D			1391	Use of Weak Credentials
D			1392	Use of Default Credentials
D		R	1393	Use of Default Password
D			1394	Use of Default Cryptographic Key
D			1395	Dependency on Vulnerable Third-Party Component
		R	1396	Comprehensive Categorization: Access Control
		R	1398	Comprehensive Categorization: Component Interaction
		R	1407	Comprehensive Categorization: Improper Neutralization
		R	1410	Comprehensive Categorization: Insufficient Control Flow Management
		R	1413	Comprehensive Categorization: Protection Mechanism Failure
		R	1416	Comprehensive Categorization: Resource Lifecycle Management
D			1419	Incorrect Initialization of Resource
		R	1420	Exposure of Sensitive Information during Transient Execution
		R	1421	Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
		R	1422	Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
		R	1423	Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
D			1428	Reliance on HTTP instead of HTTPS
		R	1431	Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
		R	1447	General Software Weaknesses that Appear in Products that Use or Support AI/ML Technology

Detailed Difference Report

1	DEPRECATED: Location
	Major	Mapping_Notes
	Minor	None
2	7PK - Environment
	Major	Mapping_Notes, References, Type
	Minor	None
3	DEPRECATED: Technology-specific Environment Issues
	Major	Mapping_Notes
	Minor	None
4	DEPRECATED: J2EE Environment Issues
	Major	Mapping_Notes
	Minor	None
5	J2EE Misconfiguration: Data Transmission Without Encryption
	Major	Common_Consequences, Description, Detection_Factors, References
	Minor	None
6	J2EE Misconfiguration: Insufficient Session-ID Length
	Major	Background_Details, Common_Consequences, Description, Detection_Factors, Functional_Areas, Potential_Mitigations, References
	Minor	None
7	J2EE Misconfiguration: Missing Custom Error Page
	Major	Common_Consequences, Description, Detection_Factors, Modes_of_Introduction, Potential_Mitigations, References
	Minor	None
8	J2EE Misconfiguration: Entity Bean Declared Remote
	Major	Common_Consequences, Description, Detection_Factors, References
	Minor	None
9	J2EE Misconfiguration: Weak Access Permissions for EJB Methods
	Major	Detection_Factors, References
	Minor	None
10	DEPRECATED: ASP.NET Environment Issues
	Major	Mapping_Notes
	Minor	None
11	ASP.NET Misconfiguration: Creating Debug Binary
	Major	Background_Details, Common_Consequences, Description, References
	Minor	None
12	ASP.NET Misconfiguration: Missing Custom Error Page
	Major	Detection_Factors, References
	Minor	None
13	ASP.NET Misconfiguration: Password in Configuration File
	Major	Detection_Factors, References
	Minor	None
14	Compiler Removal of Code to Clear Buffers
	Major	Description, Modes_of_Introduction, Potential_Mitigations, References
	Minor	None
15	External Control of System or Configuration Setting
	Major	Common_Consequences, Description, References
	Minor	None
16	Configuration
	Major	Maintenance_Notes, Mapping_Notes, Type
	Minor	None
17	DEPRECATED: Code
	Major	Mapping_Notes
	Minor	None
18	DEPRECATED: Source Code
	Major	Mapping_Notes
	Minor	None
19	Data Processing Errors
	Major	Mapping_Notes, Type
	Minor	None
20	Improper Input Validation
	Major	Applicable_Platforms, Description, Dimensions, Mapping_Notes, Observed_Examples, References, Relationships, Taxonomy_Mappings, Technical_Nuance
	Minor	None
21	DEPRECATED: Pathname Traversal and Equivalence Errors
	Major	Mapping_Notes
	Minor	None
22	Improper Limitation of a Pathname to a Restricted Directory
	Major	Applicable_Platforms, Common_Consequences, Name, References, Relationships, Taxonomy_Mappings
	Minor	None
23	Relative Path Traversal
	Major	Common_Consequences, References
	Minor	Observed_Examples
24	Path Traversal: '../filedir'
	Major	Common_Consequences, Description
	Minor	None
25	Path Traversal: '/../filedir'
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
26	Path Traversal: '/dir/../filename'
	Major	Common_Consequences, Description
	Minor	None
27	Path Traversal: 'dir/../../filename'
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
28	Path Traversal: '..\filedir'
	Major	Common_Consequences, Description, Time_of_Introduction
	Minor	None
29	Path Traversal: '\..\filename'
	Major	Common_Consequences, Description, Relationship_Notes
	Minor	None
30	Path Traversal: '\dir\..\filename'
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
31	Path Traversal: 'dir\..\..\filename'
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
32	Path Traversal: '...' (Triple Dot)
	Major	Common_Consequences, Description
	Minor	None
33	Path Traversal: '....' (Multiple Dot)
	Major	Common_Consequences, Description
	Minor	None
34	Path Traversal: '....//'
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
35	Path Traversal: '.../...//'
	Major	None
	Minor	Observed_Examples
36	Absolute Path Traversal
	Major	Applicable_Platforms, Common_Consequences, Description, References
	Minor	None
37	Path Traversal: '/absolute/pathname/here'
	Major	Common_Consequences, Description
	Minor	None
38	Path Traversal: '\absolute\pathname\here'
	Major	Common_Consequences, Description
	Minor	None
39	Path Traversal: 'C:dirname'
	Major	Common_Consequences
	Minor	None
41	Improper Resolution of Path Equivalence
	Major	Observed_Examples, Relationships
	Minor	None
42	Path Equivalence: 'filename.' (Trailing Dot)
	Major	Observed_Examples
	Minor	None
46	Path Equivalence: 'filename ' (Trailing Space)
	Major	Observed_Examples
	Minor	None
50	Path Equivalence: '//multiple/leading/slash'
	Major	Relationships
	Minor	None
58	Path Equivalence: Windows 8.3 Filename
	Major	Observed_Examples
	Minor	None
59	Improper Link Resolution Before File Access
	Major	Alternate_Terms, Name, Observed_Examples
	Minor	None
60	DEPRECATED: UNIX Path Link Problems
	Major	Mapping_Notes
	Minor	None
61	UNIX Symbolic Link (Symlink) Following
	Major	Common_Consequences, Description
	Minor	None
62	UNIX Hard Link
	Major	Common_Consequences, Description
	Minor	None
63	DEPRECATED: Windows Path Link Problems
	Major	Mapping_Notes
	Minor	None
65	Windows Hard Link
	Major	Common_Consequences, Description, Observed_Examples
	Minor	None
66	Improper Handling of File Names that Identify Virtual Resources
	Major	Background_Details, Common_Consequences, Description
	Minor	None
67	Improper Handling of Windows Device Names
	Major	Common_Consequences, Description
	Minor	None
68	DEPRECATED: Windows Virtual File Problems
	Major	Mapping_Notes
	Minor	None
69	Improper Handling of Windows ::DATA Alternate Data Stream
	Major	Common_Consequences, Description
	Minor	None
70	DEPRECATED: Mac Virtual File Problems
	Major	Mapping_Notes
	Minor	None
72	Improper Handling of Apple HFS+ Alternate Data Stream Path
	Major	Common_Consequences, Description
	Minor	None
73	External Control of File Name or Path
	Major	Common_Consequences, Description, Modes_of_Introduction, References
	Minor	None
74	Improper Neutralization of Special Elements in Output Used by a Downstream Component
	Major	Alternate_Terms, Demonstrative_Examples, Dimensions, Name, Observed_Examples, Weakness_Ordinalities
	Minor	None
75	Failure to Sanitize Special Elements into a Different Plane
	Major	Alternate_Terms, Mapping_Notes, Name
	Minor	None
77	Improper Neutralization of Special Elements used in a Command
	Major	Demonstrative_Examples, Dimensions, Name, Observed_Examples, References
	Minor	None
78	Improper Neutralization of Special Elements used in an OS Command
	Major	Applicable_Platforms, Description, Dimensions, Modes_of_Introduction, Name, References, Relationships, Taxonomy_Mappings, Technical_Nuance
	Minor	None
79	Improper Neutralization of Input During Web Page Generation
	Major	Alternate_Terms, Applicable_Platforms, Demonstrative_Examples, Description, Dimensions, Name, Other_Notes, References, Relationships, Taxonomy_Mappings, Technical_Nuance
	Minor	None
80	Improper Neutralization of Script-Related HTML Tags in a Web Page
	Major	Alternate_Terms, Name
	Minor	None
81	Improper Neutralization of Script in an Error Message Web Page
	Major	Background_Details, Common_Consequences, Description
	Minor	None
82	Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
	Major	Common_Consequences, Description, Detection_Factors
	Minor	None
86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages
	Major	Description, Technical_Nuance
	Minor	None
87	Improper Neutralization of Alternate XSS Syntax
	Major	Detection_Factors
	Minor	None
88	Improper Neutralization of Argument Delimiters in a Command
	Major	Alternate_Terms, Common_Consequences, Description, Dimensions, Modes_of_Introduction, Name, Observed_Examples, References
	Minor	None
89	Improper Neutralization of Special Elements used in an SQL Command
	Major	Applicable_Platforms, Demonstrative_Examples, Dimensions, Name, References, Relationships, Taxonomy_Mappings
	Minor	Alternate_Terms, Observed_Examples
90	Improper Neutralization of Special Elements used in an LDAP Query
	Major	Alternate_Terms, Name, References
	Minor	None
91	XML Injection
	Major	Alternate_Terms, Name, References
	Minor	None
93	Improper Neutralization of CRLF Sequences
	Major	Alternate_Terms, Name
	Minor	None
94	Improper Control of Generation of Code
	Major	Applicable_Platforms, Name
	Minor	Observed_Examples
95	Improper Neutralization of Directives in Dynamically Evaluated Code
	Major	Alternate_Terms, Name, Observed_Examples
	Minor	None
96	Improper Neutralization of Directives in Statically Saved Code
	Major	Alternate_Terms, Name
	Minor	Observed_Examples
97	Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
	Major	Detection_Factors
	Minor	None
98	Improper Control of Filename for Include/Require Statement in PHP Program
	Major	Alternate_Terms, Common_Consequences, Description, Dimensions, Name, Potential_Mitigations
	Minor	Observed_Examples
99	Improper Control of Resource Identifiers
	Major	Alternate_Terms, Description, Modes_of_Introduction, Name, References
	Minor	Observed_Examples
100	DEPRECATED: Technology-Specific Input Validation Problems
	Major	Mapping_Notes
	Minor	None
101	DEPRECATED: Struts Validation Problems
	Major	Mapping_Notes
	Minor	None
102	Struts: Duplicate Validation Forms
	Major	Common_Consequences, Description, Detection_Factors, References
	Minor	None
103	Struts: Incomplete validate() Method Definition
	Major	References
	Minor	None
104	Struts: Form Bean Does Not Extend Validation Class
	Major	References
	Minor	None
105	Struts: Form Field Without Validator
	Major	Common_Consequences, Description, Detection_Factors, References
	Minor	None
106	Struts: Plug-in Framework not in Use
	Major	Detection_Factors, References
	Minor	None
107	Struts: Unused Validation Form
	Major	Detection_Factors, References, Relationships
	Minor	None
108	Struts: Unvalidated Action Form
	Major	Description, Detection_Factors, Potential_Mitigations, References
	Minor	None
109	Struts: Validator Turned Off
	Major	Detection_Factors, References
	Minor	None
110	Struts: Validator Without Form Field
	Major	Demonstrative_Examples, Description, Modes_of_Introduction, References
	Minor	None
111	Direct Use of Unsafe JNI
	Major	Description, Modes_of_Introduction, Potential_Mitigations, References
	Minor	None
112	Missing XML Validation
	Major	Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, References
	Minor	None
113	Improper Neutralization of CRLF Sequences in HTTP Headers
	Major	Demonstrative_Examples, Description, Modes_of_Introduction, Name
	Minor	None
114	Process Control
	Major	Description, References, Technical_Nuance
	Minor	None
116	Improper Encoding or Escaping of Output
	Major	Applicable_Platforms, Background_Details, Common_Consequences, Description, Dimensions, References, Relationship_Notes, Relationships, Taxonomy_Mappings
	Minor	None
117	Improper Output Neutralization for Logs
	Major	Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
118	Incorrect Access of Indexable Resource
	Major	Alternate_Terms, Dimensions, Name
	Minor	None
119	Improper Restriction of Operations within the Bounds of a Memory Buffer
	Major	Common_Consequences, Description, Dimensions, References
	Minor	Observed_Examples
120	Buffer Copy without Checking Size of Input
	Major	Name, References, Relationships
	Minor	None
121	Stack-based Buffer Overflow
	Major	Description, Diagram
	Minor	None
122	Heap-based Buffer Overflow
	Major	Description, Diagram
	Minor	None
123	Write-what-where Condition
	Major	References
	Minor	None
124	Buffer Underwrite
	Major	Alternate_Terms, Name, Relationships
	Minor	None
125	Out-of-bounds Read
	Major	Applicable_Platforms, Demonstrative_Examples, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
126	Buffer Over-read
	Major	Demonstrative_Examples, Observed_Examples, Relationships
	Minor	None
128	Wrap-around Error
	Major	References, Relationships, Taxonomy_Mappings
	Minor	None
129	Improper Validation of Array Index
	Major	References, Relationships, Taxonomy_Mappings
	Minor	None
130	Improper Handling of Length Parameter Inconsistency
	Major	Demonstrative_Examples, Observed_Examples, References
	Minor	None
131	Incorrect Calculation of Buffer Size
	Major	Description, References
	Minor	None
133	String Errors
	Major	Mapping_Notes, Type
	Minor	None
134	Use of Externally-Controlled Format String
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	Observed_Examples
136	Type Errors
	Major	Mapping_Notes, Type
	Minor	None
137	Data Neutralization Issues
	Major	Mapping_Notes, Type
	Minor	None
139	DEPRECATED: General Special Element Problems
	Major	Mapping_Notes
	Minor	None
141	Improper Neutralization of Parameter/Argument Delimiters
	Major	Common_Consequences, Description
	Minor	None
142	Improper Neutralization of Value Delimiters
	Major	Common_Consequences, Description
	Minor	None
143	Improper Neutralization of Record Delimiters
	Major	Common_Consequences, Description
	Minor	None
144	Improper Neutralization of Line Delimiters
	Major	Common_Consequences, Description
	Minor	None
145	Improper Neutralization of Section Delimiters
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
146	Improper Neutralization of Expression/Command Delimiters
	Major	Common_Consequences, Description
	Minor	None
147	Improper Neutralization of Input Terminators
	Major	Description, Technical_Nuance
	Minor	None
154	Improper Neutralization of Variable Name Delimiters
	Major	Common_Consequences, Description
	Minor	None
155	Improper Neutralization of Wildcards or Matching Symbols
	Major	Common_Consequences, Description
	Minor	None
156	Improper Neutralization of Whitespace
	Major	Description
	Minor	None
158	Improper Neutralization of Null Byte or NUL Character
	Major	Common_Consequences, Description, Observed_Examples
	Minor	None
160	Improper Neutralization of Leading Special Elements
	Major	Common_Consequences, Description
	Minor	None
161	Improper Neutralization of Multiple Leading Special Elements
	Major	Common_Consequences, Description
	Minor	None
162	Improper Neutralization of Trailing Special Elements
	Major	Common_Consequences, Description
	Minor	None
163	Improper Neutralization of Multiple Trailing Special Elements
	Major	Common_Consequences, Description
	Minor	None
164	Improper Neutralization of Internal Special Elements
	Major	Common_Consequences, Description
	Minor	None
165	Improper Neutralization of Multiple Internal Special Elements
	Major	Common_Consequences, Description
	Minor	None
166	Improper Handling of Missing Special Element
	Major	None
	Minor	Observed_Examples
169	DEPRECATED: Technology-Specific Special Elements
	Major	Mapping_Notes
	Minor	None
170	Improper Null Termination
	Major	Demonstrative_Examples, Description, Dimensions, Modes_of_Introduction, References, Relationships, Weakness_Ordinalities
	Minor	None
171	DEPRECATED: Cleansing, Canonicalization, and Comparison Errors
	Major	Mapping_Notes
	Minor	None
172	Improper Encoding or Decoding of Data
	Major	Common_Consequences, Description, Maintenance_Notes, Name
	Minor	None
174	Double Decoding of the Same Data
	Major	Common_Consequences, Description, Type
	Minor	None
175	Improper Handling of Mixed Encoding
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
176	Improper Handling of Unicode Encoding
	Major	Applicable_Platforms, Detection_Factors, References, Relationships, Taxonomy_Mappings
	Minor	None
178	Improper Handling of Case Sensitivity
	Major	Common_Consequences, Description, Detection_Factors, Observed_Examples
	Minor	None
179	Incorrect Behavior Order: Early Validation
	Major	Common_Consequences, Description, Dimensions
	Minor	None
180	Incorrect Behavior Order: Validate Before Canonicalize
	Major	Applicable_Platforms, Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
181	Incorrect Behavior Order: Validate Before Filter
	Major	Common_Consequences, Description
	Minor	None
182	Collapse of Data into Unsafe Value
	Major	Observed_Examples, Relationships
	Minor	None
183	Permissive List of Allowed Inputs
	Major	Observed_Examples
	Minor	None
184	Incomplete List of Disallowed Inputs
	Major	Applicable_Platforms, Demonstrative_Examples, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
185	Incorrect Regular Expression
	Major	Applicable_Platforms, Common_Consequences, Description, Dimensions, Observed_Examples, Type
	Minor	None
186	Overly Restrictive Regular Expression
	Major	Common_Consequences, Demonstrative_Examples, Description
	Minor	None
187	Partial String Comparison
	Major	Common_Consequences, Description, Observed_Examples
	Minor	None
188	Reliance on Data/Memory Layout
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
189	Numeric Errors
	Major	Mapping_Notes, Type
	Minor	None
190	Integer Overflow or Wraparound
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Modes_of_Introduction, Observed_Examples, Other_Notes, References, Relationships, Taxonomy_Mappings, Technical_Nuance
	Minor	None
191	Integer Underflow (Wrap or Wraparound)
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
192	Integer Coercion Error
	Major	Common_Consequences, Description, Maintenance_Notes, Potential_Mitigations
	Minor	None
194	Unexpected Sign Extension
	Major	Common_Consequences, Description, References
	Minor	Observed_Examples
195	Signed to Unsigned Conversion Error
	Major	Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, References
	Minor	None
196	Unsigned to Signed Conversion Error
	Major	Common_Consequences, Description, References, Relationships
	Minor	None
197	Numeric Truncation Error
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
199	Information Management Errors
	Major	Mapping_Notes, Type
	Minor	None
200	Exposure of Sensitive Information to an Unauthorized Actor
	Major	Alternate_Terms, Description, Mapping_Notes, Relationships, Technical_Nuance
	Minor	None
201	Insertion of Sensitive Information Into Sent Data
	Major	Dimensions, Relationships
	Minor	None
202	Exposure of Sensitive Information Through Data Queries
	Major	Common_Consequences, Description, Dimensions
	Minor	None
203	Observable Discrepancy
	Major	Demonstrative_Examples, Dimensions, Relationships
	Minor	None
204	Observable Response Discrepancy
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
205	Observable Behavioral Discrepancy
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
206	Observable Internal Behavioral Discrepancy
	Major	Description, Potential_Mitigations
	Minor	None
207	Observable Behavioral Discrepancy With Equivalent Products
	Major	Common_Consequences, Description
	Minor	None
208	Observable Timing Discrepancy
	Major	Common_Consequences, Description
	Minor	None
209	Generation of Error Message Containing Sensitive Information
	Major	Applicable_Platforms, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
211	Externally-Generated Error Message Containing Sensitive Information
	Major	None
	Minor	Observed_Examples
212	Improper Removal of Sensitive Information Before Storage or Transfer
	Major	Relationships
	Minor	None
213	Exposure of Sensitive Information Due to Incompatible Policies
	Major	Description, Potential_Mitigations
	Minor	None
214	Invocation of Process Using Visible Sensitive Information
	Major	Background_Details, Common_Consequences, Description
	Minor	None
215	Insertion of Sensitive Information Into Debugging Code
	Major	Common_Consequences, Description, Dimensions, Modes_of_Introduction, Relationships
	Minor	None
219	Storage of File with Sensitive Data Under Web Root
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
221	Information Loss or Omission
	Major	Observed_Examples, Relationships
	Minor	None
224	Obscured Security-relevant Information by Alternate Name
	Major	Observed_Examples
	Minor	None
226	Sensitive Information in Resource Not Removed Before Reuse
	Major	Demonstrative_Examples, Description, Potential_Mitigations, Relationships
	Minor	None
227	7PK - API Abuse
	Major	Mapping_Notes, References, Type
	Minor	None
228	Improper Handling of Syntactically Invalid Structure
	Major	Dimensions, Observed_Examples
	Minor	None
229	Improper Handling of Values
	Major	Detection_Factors
	Minor	None
230	Improper Handling of Missing Values
	Major	Detection_Factors
	Minor	None
237	Improper Handling of Structural Elements
	Major	Demonstrative_Examples
	Minor	None
240	Improper Handling of Inconsistent Structural Elements
	Major	Common_Consequences, Demonstrative_Examples, Dimensions, Type
	Minor	None
241	Improper Handling of Unexpected Data Type
	Major	Observed_Examples
	Minor	None
242	Use of Inherently Dangerous Function
	Major	Common_Consequences, Description, Diagram, References
	Minor	None
243	Creation of chroot Jail Without Changing Working Directory
	Major	Background_Details, Common_Consequences, Description, References
	Minor	None
244	Improper Clearing of Heap Memory Before Release
	Major	Alternate_Terms, Background_Details, Common_Consequences, Description, Name, References
	Minor	None
245	J2EE Bad Practices: Direct Management of Connections
	Major	Background_Details, Description, References
	Minor	None
246	J2EE Bad Practices: Direct Use of Sockets
	Major	Background_Details, Description, References
	Minor	None
248	Uncaught Exception
	Major	Description, Potential_Mitigations, References
	Minor	Common_Consequences
250	Execution with Unnecessary Privileges
	Major	Applicable_Platforms, References
	Minor	None
251	Often Misused: String Management
	Major	Mapping_Notes, References, Type
	Minor	None
252	Unchecked Return Value
	Major	Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	Observed_Examples
253	Incorrect Check of Function Return Value
	Major	Background_Details, Description
	Minor	None
254	7PK - Security Features
	Major	Mapping_Notes, References, Type
	Minor	None
255	Credentials Management Errors
	Major	Mapping_Notes, Type
	Minor	None
256	Plaintext Storage of a Password
	Major	References
	Minor	None
258	Empty Password in Configuration File
	Major	Detection_Factors, References
	Minor	None
259	Use of Hard-coded Password
	Major	Description, References, Technical_Nuance
	Minor	None
260	Password in Configuration File
	Major	Common_Consequences, Description, References
	Minor	None
261	Weak Encoding for Password
	Major	Description, Modes_of_Introduction, References
	Minor	None
262	Not Using Password Aging
	Major	Background_Details, Description, Relationships
	Minor	None
263	Password Aging with Long Expiration
	Major	Background_Details, Common_Consequences, Description, Relationships
	Minor	None
264	Permissions, Privileges, and Access Controls
	Major	Mapping_Notes, Type
	Minor	None
265	Privilege Issues
	Major	Mapping_Notes, Type
	Minor	None
268	Privilege Chaining
	Major	Demonstrative_Examples
	Minor	None
269	Improper Privilege Management
	Major	Demonstrative_Examples, Dimensions
	Minor	None
271	Privilege Dropping / Lowering Errors
	Major	Background_Details, Description, Detection_Factors
	Minor	None
272	Least Privilege Violation
	Major	References
	Minor	None
273	Improper Check for Dropped Privileges
	Major	Common_Consequences, Description
	Minor	None
274	Improper Handling of Insufficient Privileges
	Major	Common_Consequences, Description
	Minor	None
275	Permission Issues
	Major	Mapping_Notes, Type
	Minor	None
276	Incorrect Default Permissions
	Major	Time_of_Introduction
	Minor	None
280	Improper Handling of Insufficient Permissions or Privileges
	Major	Observed_Examples
	Minor	None
282	Improper Ownership Management
	Major	Dimensions
	Minor	None
284	Improper Access Control
	Major	Common_Consequences, Description, Dimensions, Relationships, Technical_Nuance
	Minor	None
285	Improper Authorization
	Major	Dimensions, References, Relationships
	Minor	None
286	Incorrect User Management
	Major	Common_Consequences, Description, Dimensions
	Minor	None
287	Improper Authentication
	Major	Demonstrative_Examples, Dimensions, Observed_Examples, References, Relationships
	Minor	None
291	Reliance on IP Address for Authentication
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
294	Authentication Bypass by Capture-replay
	Major	Research_Gaps
	Minor	None
295	Improper Certificate Validation
	Major	Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
296	Improper Following of a Certificate's Chain of Trust
	Major	None
	Minor	Observed_Examples
297	Improper Validation of Certificate with Host Mismatch
	Major	Description, Potential_Mitigations, Technical_Nuance
	Minor	None
298	Improper Validation of Certificate Expiration
	Major	Detection_Factors, Observed_Examples
	Minor	None
299	Improper Check for Certificate Revocation
	Major	Common_Consequences, Description, Diagram, Other_Notes
	Minor	Observed_Examples
300	Channel Accessible by Non-Endpoint
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
301	Reflection Attack in an Authentication Protocol
	Major	Research_Gaps
	Minor	None
303	Incorrect Implementation of Authentication Algorithm
	Major	Common_Consequences, Description
	Minor	None
304	Missing Critical Step in Authentication
	Major	Background_Details, Description
	Minor	None
305	Authentication Bypass by Primary Weakness
	Major	Observed_Examples
	Minor	None
306	Missing Authentication for Critical Functionality
	Major	Applicable_Platforms, Name, References, Relationships, Taxonomy_Mappings
	Minor	None
307	Improper Restriction of Excessive Authentication Attempts
	Major	Applicable_Platforms, Demonstrative_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
309	Use of Password System for Primary Authentication
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
310	Cryptographic Issues
	Major	Mapping_Notes, Type
	Minor	None
311	Missing Encryption of Sensitive Data
	Major	Applicable_Platforms, Detection_Factors, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
312	Cleartext Storage of Sensitive Information
	Major	Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
313	Cleartext Storage in a File or on Disk
	Major	Common_Consequences, Description
	Minor	None
314	Cleartext Storage in the Registry
	Major	Common_Consequences, Description
	Minor	None
315	Cleartext Storage of Sensitive Information in a Cookie
	Major	Common_Consequences, Description
	Minor	None
316	Cleartext Storage of Sensitive Information in Memory
	Major	Common_Consequences, Description
	Minor	None
317	Cleartext Storage of Sensitive Information in GUI
	Major	Common_Consequences, Description
	Minor	None
318	Cleartext Storage of Sensitive Information in Executable
	Major	Common_Consequences, Description, Detection_Factors
	Minor	None
319	Cleartext Transmission of Sensitive Information
	Major	Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
320	Key Management Errors
	Major	Mapping_Notes, Type
	Minor	None
321	Use of Hard-coded Cryptographic Key
	Major	Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
322	Key Exchange without Entity Authentication
	Major	Background_Details, Common_Consequences, Description
	Minor	None
324	Use of a Key Past its Expiration Date
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
325	Missing Cryptographic Step
	Major	Demonstrative_Examples, Relationships
	Minor	None
326	Inadequate Encryption Strength
	Major	Common_Consequences, Description
	Minor	None
328	Use of Weak Hash
	Major	Applicable_Platforms, Demonstrative_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
330	Use of Insufficiently Random Values
	Major	Applicable_Platforms, Demonstrative_Examples, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
333	Improper Handling of Insufficient Entropy in TRNG
	Major	Description, Potential_Mitigations
	Minor	None
334	Small Space of Random Values
	Major	Observed_Examples
	Minor	None
336	Same Seed in Pseudo-Random Number Generator (PRNG)
	Major	Common_Consequences, Description
	Minor	None
337	Predictable Seed in Pseudo-Random Number Generator (PRNG)
	Major	Common_Consequences, Description
	Minor	None
341	Predictable from Observable State
	Major	Common_Consequences
	Minor	None
343	Predictable Value Range from Previous Values
	Major	Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations
	Minor	None
345	Insufficient Verification of Data Authenticity
	Major	Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
346	Origin Validation Error
	Major	None
	Minor	Observed_Examples
350	Reliance on Reverse DNS Resolution for a Security-Critical Action
	Major	Common_Consequences, Description
	Minor	None
352	Cross-Site Request Forgery
	Major	Applicable_Platforms, Name, References, Relationships, Taxonomy_Mappings
	Minor	Common_Consequences
353	Missing Support for Integrity Check
	Major	Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
354	Improper Validation of Integrity Check Value
	Major	Description, Detection_Factors, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
	Minor	None
355	User Interface Security Issues
	Major	Mapping_Notes, Type
	Minor	None
356	Missing User Interaction for Potentially Unsafe Action
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, Name, Observed_Examples, Potential_Mitigations, References, Relationships
	Minor	None
358	Improperly Implemented Security Check for Standard
	Major	Detection_Factors
	Minor	None
359	Exposure of Private Personal Information to an Unauthorized Actor
	Major	References
	Minor	None
360	Trust of System Event Data
	Major	Description, Potential_Mitigations
	Minor	None
361	7PK - Time and State
	Major	Mapping_Notes, References, Type
	Minor	None
362	Concurrent Execution using Shared Resource with Improper Synchronization
	Major	Applicable_Platforms, Background_Details, Demonstrative_Examples, Description, Name, Observed_Examples, References, Relationships, Taxonomy_Mappings, Technical_Nuance
	Minor	None
363	Race Condition Enabling Link Following
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
364	Signal Handler Race Condition
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	Observed_Examples
365	DEPRECATED: Race Condition in Switch
	Major	Description, Other_Notes
	Minor	None
366	Race Condition within a Thread
	Major	References
	Minor	None
367	Time-of-check Time-of-use (TOCTOU) Race Condition
	Major	Demonstrative_Examples
	Minor	Observed_Examples
369	Divide By Zero
	Major	Demonstrative_Examples, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
370	Missing Check for Certificate Revocation after Initial Check
	Major	Common_Consequences, Description
	Minor	None
371	State Issues
	Major	Mapping_Notes, Type
	Minor	None
372	Incomplete Internal State Distinction
	Major	Type
	Minor	None
374	Passing Mutable Objects to an Untrusted Method
	Major	Common_Consequences, Description
	Minor	None
375	Returning a Mutable Object to an Untrusted Caller
	Major	Common_Consequences, Description
	Minor	None
376	DEPRECATED: Temporary File Issues
	Major	Mapping_Notes
	Minor	None
377	DEPRECATED: Insecure Temporary File
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Mapping_Notes, Name, Observed_Examples, Other_Notes, References, Relationships, Time_of_Introduction, Type, Weakness_Ordinalities
	Minor	None
378	Creation of Temporary File With Insecure Permissions
	Major	Observed_Examples
	Minor	None
379	Creation of Temporary File in Directory with Insecure Permissions
	Major	Common_Consequences, Description
	Minor	None
380	DEPRECATED: Technology-Specific Time and State Issues
	Major	Mapping_Notes
	Minor	None
381	DEPRECATED: J2EE Time and State Issues
	Major	Mapping_Notes
	Minor	None
382	J2EE Bad Practices: Use of System.exit()
	Major	Common_Consequences, Description, Dimensions, Potential_Mitigations, References
	Minor	None
383	J2EE Bad Practices: Direct Use of Threads
	Major	Background_Details, Common_Consequences, Description, References
	Minor	None
384	Session Fixation
	Major	Functional_Areas, Observed_Examples, References, Relationships
	Minor	None
385	Covert Timing Channel
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
387	Signal Errors
	Major	Mapping_Notes, Type
	Minor	None
388	7PK - Errors
	Major	Mapping_Notes, References, Type
	Minor	None
389	Error Conditions, Return Values, Status Codes
	Major	Mapping_Notes, Type
	Minor	None
390	Detection of Error Condition Without Action
	Major	References
	Minor	None
391	DEPRECATED: Unchecked Error Condition
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Dimensions, Likelihood_of_Exploit, Maintenance_Notes, Mapping_Notes, Modes_of_Introduction, Name, Other_Notes, Potential_Mitigations, Relationships, Time_of_Introduction, Type, Weakness_Ordinalities
	Minor	None
392	Missing Report of Error Condition
	Major	Applicable_Platforms, Detection_Factors, References, Relationships, Taxonomy_Mappings
	Minor	None
393	Return of Wrong Status Code
	Major	Common_Consequences, Description
	Minor	None
394	Unexpected Status Code or Return Value
	Major	References
	Minor	None
395	Use of NullPointerException Catch to Detect NULL Pointer Dereference
	Major	Common_Consequences, Description, Modes_of_Introduction, References, Type
	Minor	None
396	Declaration of Catch for Generic Exception
	Major	Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
397	Declaration of Throws for Generic Exception
	Major	Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
398	7PK - Code Quality
	Major	Mapping_Notes, References, Type
	Minor	None
399	Resource Management Errors
	Major	Mapping_Notes, Type
	Minor	None
400	Uncontrolled Resource Consumption
	Major	Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
401	Missing Release of Memory after Effective Lifetime
	Major	Dimensions, Observed_Examples, References
	Minor	None
402	Transmission of Private Resources into a New Sphere
	Major	Name
	Minor	None
403	Exposure of File Descriptor to Unintended Control Sphere
	Major	Background_Details, Description, Modes_of_Introduction, Name
	Minor	None
404	Improper Resource Shutdown or Release
	Major	Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
405	Asymmetric Resource Consumption (Amplification)
	Major	Common_Consequences, Demonstrative_Examples, Description, Dimensions
	Minor	None
407	Inefficient Algorithmic Complexity
	Major	Detection_Factors, References
	Minor	None
409	Improper Handling of Highly Compressed Data (Data Amplification)
	Major	Applicable_Platforms, Demonstrative_Examples, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
410	Insufficient Resource Pool
	Major	Applicable_Platforms, Common_Consequences, Description, Mapping_Notes, References, Relationships, Taxonomy_Mappings
	Minor	None
411	Resource Locking Problems
	Major	Mapping_Notes, Type
	Minor	None
413	Improper Resource Locking
	Major	Common_Consequences, Description, Observed_Examples
	Minor	None
414	Missing Lock Check
	Major	Observed_Examples
	Minor	None
415	Double Free
	Major	References
	Minor	None
416	Use After Free
	Major	Observed_Examples, References
	Minor	None
417	Communication Channel Errors
	Major	Mapping_Notes, Type
	Minor	None
418	DEPRECATED: Channel Errors
	Major	Description, Mapping_Notes
	Minor	None
419	Unprotected Primary Channel
	Major	Potential_Mitigations
	Minor	None
421	Race Condition During Access to Alternate Channel
	Major	Common_Consequences, Description
	Minor	None
422	Unprotected Windows Messaging Channel
	Major	Alternate_Terms, Name
	Minor	None
424	Improper Protection of Alternate Path
	Major	Detection_Factors, References
	Minor	None
425	Direct Request
	Major	Name
	Minor	Alternate_Terms
426	Untrusted Search Path
	Major	Applicable_Platforms, Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
427	Uncontrolled Search Path Element
	Major	Demonstrative_Examples, Observed_Examples
	Minor	None
428	Unquoted Search Path or Element
	Major	Common_Consequences, Description
	Minor	None
429	Handler Errors
	Major	Mapping_Notes, Type
	Minor	None
430	Deployment of Wrong Handler
	Major	Applicable_Platforms, Common_Consequences, Description, Dimensions, Modes_of_Introduction
	Minor	None
431	Missing Handler
	Major	Detection_Factors, Dimensions
	Minor	None
432	Dangerous Signal Handler not Disabled During Sensitive Operations
	Major	Background_Details, Common_Consequences, Description
	Minor	None
434	Unrestricted Upload of File with Dangerous Type
	Major	Observed_Examples, References
	Minor	None
435	Improper Interaction Between Multiple Correctly-Behaving Entities
	Major	Dimensions, Relationships
	Minor	Observed_Examples
436	Interpretation Conflict
	Major	Description, Modes_of_Introduction, Relationships, Time_of_Introduction
	Minor	None
438	Behavioral Problems
	Major	Mapping_Notes, Type
	Minor	None
439	Behavioral Change in New Version or Environment
	Major	None
	Minor	Observed_Examples
440	Expected Behavior Violation
	Major	Demonstrative_Examples
	Minor	None
441	Unintended Proxy or Intermediary
	Major	Common_Consequences, Description, Modes_of_Introduction, Name
	Minor	None
442	DEPRECATED: Web Problems
	Major	Mapping_Notes
	Minor	None
444	Inconsistent Interpretation of HTTP Requests
	Major	Demonstrative_Examples, Name, Relationships
	Minor	None
445	DEPRECATED: User Interface Errors
	Major	Mapping_Notes
	Minor	None
446	UI Discrepancy for Security Feature
	Major	Common_Consequences, Description, Weakness_Ordinalities
	Minor	None
451	User Interface (UI) Misrepresentation of Critical Information
	Major	Common_Consequences, Description, Relationships, Technical_Nuance
	Minor	None
452	Initialization and Cleanup Errors
	Major	Mapping_Notes, Type
	Minor	None
454	External Initialization of Trusted Variables or Data Stores
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	Demonstrative_Examples
455	Non-exit on Failed Initialization
	Major	Dimensions, Type
	Minor	None
456	Missing Initialization of a Variable
	Major	Common_Consequences, Description, References
	Minor	Observed_Examples
457	Use of Uninitialized Variable
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, References
	Minor	None
459	Incomplete Cleanup
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
460	Improper Cleanup on Thrown Exception
	Major	Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
461	DEPRECATED: Data Structure Issues
	Major	Mapping_Notes
	Minor	None
462	Duplicate Key in Associative List (Alist)
	Major	Background_Details, Common_Consequences, Description, Detection_Factors, Modes_of_Introduction, Potential_Mitigations, References
	Minor	None
463	Deletion of Data Structure Sentinel
	Major	Dimensions
	Minor	None
464	Addition of Data Structure Sentinel
	Major	Dimensions
	Minor	None
465	Pointer Issues
	Major	Mapping_Notes, Type
	Minor	None
466	Return of Pointer Value Outside of Expected Range
	Major	References
	Minor	None
467	Use of sizeof() on a Pointer Type
	Major	Description, Modes_of_Introduction, Observed_Examples
	Minor	None
470	Use of Externally-Controlled Input to Select Classes or Code
	Major	Alternate_Terms, Description, Modes_of_Introduction, Name, References, Time_of_Introduction
	Minor	None
471	Modification of Assumed-Immutable Data (MAID)
	Major	Description, Modes_of_Introduction
	Minor	None
472	External Control of Assumed-Immutable Web Parameter
	Major	Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
473	PHP External Variable Modification
	Major	Detection_Factors
	Minor	None
474	Use of Function with Inconsistent Implementations
	Major	Common_Consequences, Description, Potential_Mitigations, References
	Minor	None
475	Undefined Behavior for Input to API
	Major	References
	Minor	None
476	NULL Pointer Dereference
	Major	Applicable_Platforms, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
477	Use of Obsolete Function
	Major	References
	Minor	None
478	Missing Default Case in Multiple Condition Expression
	Major	Common_Consequences, Demonstrative_Examples, Description, References
	Minor	None
479	Signal Handler Use of a Non-reentrant Function
	Major	Background_Details, Common_Consequences, Description
	Minor	None
480	Use of Incorrect Operator
	Major	Demonstrative_Examples, Description, Modes_of_Introduction, References, Relationships
	Minor	None
481	Assigning instead of Comparing
	Major	Description, Detection_Factors, Dimensions, Modes_of_Introduction
	Minor	None
482	Comparing instead of Assigning
	Major	Description, Detection_Factors, Modes_of_Introduction
	Minor	None
483	Incorrect Block Delimitation
	Major	Background_Details, Common_Consequences, Description
	Minor	None
484	Omitted Break Statement in Switch
	Major	Common_Consequences, Demonstrative_Examples, Description, References
	Minor	None
485	7PK - Encapsulation
	Major	Mapping_Notes, References, Type
	Minor	None
486	Comparison of Classes by Name
	Major	Common_Consequences, Description, References
	Minor	None
487	Reliance on Package-level Scope
	Major	Background_Details, Description
	Minor	None
488	Exposure of Data Element to Wrong Session
	Major	Common_Consequences, Description, Functional_Areas, Modes_of_Introduction, References
	Minor	None
489	Active Debug Code
	Major	Applicable_Platforms, Common_Consequences, References, Relationships, Taxonomy_Mappings
	Minor	None
490	DEPRECATED: Mobile Code Issues
	Major	Mapping_Notes
	Minor	None
491	Public cloneable() Method Without Final
	Major	Alternate_Terms, Name, References
	Minor	None
492	Use of Inner Class Containing Sensitive Data
	Major	References
	Minor	None
493	Critical Public Variable Without Final Modifier
	Major	Common_Consequences, Description, References, Relationships
	Minor	None
494	Download of Code Without Integrity Check
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
495	Private Data Structure Returned From A Public Method
	Major	References, Relationships
	Minor	None
496	Public Data Assigned to Private Array-Typed Field
	Major	References, Relationships
	Minor	None
497	Exposure of Sensitive System Information to an Unauthorized Control Sphere
	Major	Applicable_Platforms, Background_Details, Common_Consequences, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
498	Cloneable Class Containing Sensitive Information
	Major	Common_Consequences, Description
	Minor	None
499	Serializable Class Containing Sensitive Data
	Major	Common_Consequences, Description
	Minor	None
500	Public Static Field Not Marked Final
	Major	Common_Consequences, Description
	Minor	None
501	Trust Boundary Violation
	Major	Applicable_Platforms, Description, References, Relationships, Taxonomy_Mappings, Technical_Nuance, Type
	Minor	None
502	Deserialization of Untrusted Data
	Major	Applicable_Platforms, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
503	DEPRECATED: Byte/Object Code
	Major	Mapping_Notes
	Minor	None
504	DEPRECATED: Motivation/Intent
	Major	Mapping_Notes
	Minor	None
505	DEPRECATED: Intentionally Introduced Weakness
	Major	Mapping_Notes
	Minor	None
506	Embedded Malicious Code
	Major	Background_Details, Demonstrative_Examples, Description
	Minor	None
511	Logic/Time Bomb
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
512	Spyware
	Major	Alternate_Terms, Description
	Minor	None
513	DEPRECATED: Intentionally Introduced Nonmalicious Weakness
	Major	Mapping_Notes
	Minor	None
514	Covert Channel
	Major	Common_Consequences, Description
	Minor	None
515	Covert Storage Channel
	Major	Description
	Minor	None
517	DEPRECATED: Other Intentional, Nonmalicious Weakness
	Major	Mapping_Notes
	Minor	None
518	DEPRECATED: Inadvertently Introduced Weakness
	Major	Mapping_Notes
	Minor	None
519	DEPRECATED: .NET Environment Issues
	Major	Mapping_Notes
	Minor	None
520	.NET Misconfiguration: Use of Impersonation
	Major	Background_Details, Description, Detection_Factors
	Minor	None
521	Weak Password Requirements
	Major	Potential_Mitigations
	Minor	None
522	Insufficiently Protected Credentials
	Major	None
	Minor	Observed_Examples
524	Use of Cache Containing Sensitive Information
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
525	Use of Web Browser Cache Containing Sensitive Information
	Major	Detection_Factors, Observed_Examples
	Minor	None
526	Cleartext Storage of Sensitive Information in an Environment Variable
	Major	Common_Consequences, Description
	Minor	None
527	Exposure of Version-Control Repository to an Unauthorized Control Sphere
	Major	Description
	Minor	None
529	Exposure of Access Control List Files to an Unauthorized Control Sphere
	Major	Common_Consequences, Description
	Minor	None
530	Exposure of Backup File to an Unauthorized Control Sphere
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
531	Inclusion of Sensitive Information in Test Code
	Major	Detection_Factors
	Minor	None
532	Insertion of Sensitive Information into Log File
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
539	Use of Persistent Cookies Containing Sensitive Information
	Major	Background_Details, Common_Consequences, Description
	Minor	None
540	Inclusion of Sensitive Information in Source Code
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
541	Inclusion of Sensitive Information in an Include File
	Major	Detection_Factors
	Minor	None
543	Use of Singleton Pattern Without Synchronization in a Multithreaded Context
	Major	Common_Consequences, Description, References
	Minor	None
544	Missing Standardized Error Handling Mechanism
	Major	Common_Consequences, Description
	Minor	None
546	Suspicious Comment
	Major	Description, Modes_of_Introduction, Type
	Minor	None
547	Use of Hard-coded, Security-relevant Constants
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
550	Server-generated Error Message Containing Sensitive Information
	Major	Common_Consequences, Description
	Minor	None
552	Files or Directories Accessible to External Parties
	Major	Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
554	ASP.NET Misconfiguration: Not Using Input Validation Framework
	Major	Detection_Factors, Potential_Mitigations
	Minor	None
555	J2EE Misconfiguration: Plaintext Password in Configuration File
	Major	Common_Consequences, Description, Detection_Factors
	Minor	None
556	ASP.NET Misconfiguration: Use of Identity Impersonation
	Major	Background_Details, Description, Detection_Factors
	Minor	None
557	Concurrency Issues
	Major	Mapping_Notes, Type
	Minor	None
558	Use of getlogin() in Multithreaded Application
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
559	DEPRECATED: Often Misused: Arguments and Parameters
	Major	Mapping_Notes
	Minor	None
561	Dead Code
	Major	Common_Consequences, Description, Mapping_Notes, References, Relationships, Technical_Nuance, Terminology_Notes
	Minor	None
562	Return of Stack Variable Address
	Major	Description, References, Type
	Minor	None
563	Assignment to Variable without Use
	Major	Description, Modes_of_Introduction
	Minor	None
564	Use of Hibernate with HQL/SQL Query String Containing External Input
	Major	Alternate_Terms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Name, Observed_Examples, Potential_Mitigations, References, Terminology_Notes
	Minor	None
566	Authorization Bypass Through User-Controlled SQL Primary Key
	Major	Common_Consequences, Description, Modes_of_Introduction, Potential_Mitigations
	Minor	None
567	Unsynchronized Access to Shared Data in a Multithreaded Context
	Major	Demonstrative_Examples, References
	Minor	None
568	finalize() Method Without super.finalize()
	Major	Background_Details, Description
	Minor	None
569	Expression Issues
	Major	Mapping_Notes, Type
	Minor	None
570	Expression is Always False
	Major	Functional_Areas, References
	Minor	None
571	Expression is Always True
	Major	References
	Minor	None
572	Call to Thread run() instead of start()
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
573	Improper Following of Specification by Caller
	Major	Common_Consequences, Description, Potential_Mitigations, Relationships
	Minor	None
574	EJB Bad Practices: Use of Synchronization Primitives
	Major	Description, Detection_Factors, References
	Minor	None
575	EJB Bad Practices: Use of AWT Swing
	Major	Description, Detection_Factors, References
	Minor	None
576	EJB Bad Practices: Use of Java I/O
	Major	Detection_Factors
	Minor	None
577	EJB Bad Practices: Use of Sockets
	Major	Background_Details, Description, Detection_Factors, References, Relationships
	Minor	None
578	EJB Bad Practices: Use of Class Loader
	Major	Common_Consequences, Description, Detection_Factors, References, Relationships, Technical_Nuance
	Minor	None
579	J2EE Bad Practices: Non-serializable Object Stored in Session
	Major	Background_Details, Common_Consequences, Description
	Minor	None
580	clone() Method Without super.clone()
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
581	Object Model Violation: Just One of Equals and Hashcode Defined
	Major	Background_Details, Description
	Minor	None
582	Array Declared Public, Final, and Static
	Major	Relationships
	Minor	None
583	finalize() Method Declared Public
	Major	Common_Consequences, Description, Potential_Mitigations, Relationships
	Minor	None
584	Return Inside Finally Block
	Major	Applicable_Platforms, Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
585	Empty Synchronized Block
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
586	Explicit Call to Finalize()
	Major	Common_Consequences, Description
	Minor	None
587	Assignment of a Fixed Address to a Pointer
	Major	Description
	Minor	None
588	Attempt to Access Child of a Non-structure Pointer
	Major	Common_Consequences, Description
	Minor	None
589	Call to Non-ubiquitous API
	Major	Common_Consequences, Description
	Minor	None
590	Free of Memory not on the Heap
	Major	Common_Consequences, Description
	Minor	None
591	Sensitive Data Storage in Improperly Locked Memory
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, Potential_Mitigations
	Minor	None
593	Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
	Major	Common_Consequences, Description
	Minor	None
594	J2EE Framework: Saving Unserializable Objects to Disk
	Major	Common_Consequences, Description
	Minor	None
595	Comparison of Object References Instead of Object Contents
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
597	Use of Wrong Operator in String Comparison
	Major	Background_Details, Common_Consequences, Description, References
	Minor	None
600	Uncaught Exception in Servlet
	Major	Common_Consequences, Description
	Minor	None
601	URL Redirection to Untrusted Site
	Major	Common_Consequences, Name, Relationships
	Minor	None
602	Client-Side Enforcement of Server-Side Security
	Major	Common_Consequences, Description, Dimensions, Observed_Examples
	Minor	None
603	Use of Client-Side Authentication
	Major	Common_Consequences, Description
	Minor	None
605	Multiple Binds to the Same Port
	Major	Background_Details, Common_Consequences, Description
	Minor	None
606	Unchecked Input for Loop Condition
	Major	Demonstrative_Examples, References
	Minor	None
608	Struts: Non-private Field in ActionForm Class
	Major	Common_Consequences, Description, Relationships
	Minor	None
611	Improper Restriction of XML External Entity Reference
	Major	References
	Minor	None
612	Improper Authorization of Index Containing Sensitive Information
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
613	DEPRECATED: Insufficient Session Expiration
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors, Maintenance_Notes, Mapping_Notes, Modes_of_Introduction, Name, Observed_Examples, Other_Notes, Potential_Mitigations, References, Relationships, Taxonomy_Mappings, Time_of_Introduction, Type, Weakness_Ordinalities
	Minor	None
614	Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
	Major	Functional_Areas, Observed_Examples
	Minor	None
615	Inclusion of Sensitive Information in Source Code Comments
	Major	Common_Consequences, Description
	Minor	None
616	Incomplete Identification of Uploaded File Variables (PHP)
	Major	Common_Consequences, Description, Dimensions
	Minor	None
617	Reachable Assertion
	Major	Applicable_Platforms, Common_Consequences, Description, Observed_Examples, Potential_Mitigations, References, Relationships, Taxonomy_Mappings
	Minor	None
618	Exposed Unsafe ActiveX Method
	Major	Common_Consequences, Description
	Minor	None
619	Dangling Database Cursor
	Major	Alternate_Terms, Common_Consequences, Description, Detection_Factors, Name, Weakness_Ordinalities
	Minor	None
620	Unverified Password Change
	Major	Common_Consequences, Description
	Minor	None
621	Variable Extraction Error
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description
	Minor	None
622	Improper Validation of Function Hook Arguments
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
623	Unsafe ActiveX Control Marked Safe For Scripting
	Major	Common_Consequences, Description
	Minor	None
625	Permissive Regular Expression
	Major	Applicable_Platforms, Common_Consequences, Description, Technical_Nuance
	Minor	None
627	Dynamic Variable Evaluation
	Major	Common_Consequences, Description
	Minor	None
628	Function Call with Incorrectly Specified Arguments
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
632	DEPRECATED: Weaknesses that Affect Files or Directories
	Major	Mapping_Notes
	Minor	None
633	DEPRECATED: Weaknesses that Affect Memory
	Major	Mapping_Notes
	Minor	None
634	DEPRECATED: Weaknesses that Affect System Processes
	Major	Mapping_Notes
	Minor	None
636	Not Failing Securely
	Major	Common_Consequences, Description, Modes_of_Introduction, Name
	Minor	None
637	Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
	Major	Description, Potential_Mitigations
	Minor	None
639	Authorization Bypass Through User-Controlled Key
	Major	Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
640	Weak Password Recovery Mechanism for Forgotten Password
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
641	Improper Restriction of Names for Files and Other Resources
	Major	Detection_Factors
	Minor	None
643	Improper Neutralization of Data within XPath Expressions
	Major	Alternate_Terms, Common_Consequences, Description, Name, References
	Minor	None
644	Improper Neutralization of HTTP Headers for Scripting Syntax
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
645	Overly Restrictive Account Lockout Mechanism
	Major	Background_Details, Common_Consequences, Description, Potential_Mitigations
	Minor	None
646	Reliance on File Name or Extension of Externally-Supplied File
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction, Type, Weakness_Ordinalities
	Minor	None
647	Use of Non-Canonical URL Paths for Authorization Decisions
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
648	Incorrect Use of Privileged APIs
	Major	Detection_Factors
	Minor	None
650	Trusting HTTP Permission Methods on the Server Side
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, Potential_Mitigations, Time_of_Introduction
	Minor	None
651	Exposure of WSDL File Containing Sensitive Information
	Major	Description, Detection_Factors, Modes_of_Introduction, Time_of_Introduction
	Minor	None
652	Improper Neutralization of Data within XQuery Expressions
	Major	Alternate_Terms, Common_Consequences, Description, Detection_Factors, Name, References
	Minor	None
653	Improper Isolation or Compartmentalization
	Major	Common_Consequences, Description, Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
656	Reliance on Security Through Obscurity
	Major	Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations
	Minor	None
657	Violation of Secure Design Principles
	Major	Common_Consequences, Demonstrative_Examples, Description
	Minor	None
662	Improper Synchronization
	Major	Background_Details, Common_Consequences, Description, References
	Minor	None
664	Improper Control of a Resource Through its Lifetime
	Major	Background_Details, Common_Consequences, Description, Dimensions, Relationships
	Minor	None
665	Improper Initialization
	Major	Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings, Weakness_Ordinalities
	Minor	None
666	Operation on Resource in Wrong Phase of Lifetime
	Major	Common_Consequences, Description, Potential_Mitigations, Theoretical_Notes
	Minor	None
667	Improper Locking
	Major	Background_Details, Common_Consequences, Description, References
	Minor	Observed_Examples
668	Exposure of Resource to Wrong Sphere
	Major	Mapping_Notes, Relationships
	Minor	None
670	Always-Incorrect Control Flow Implementation
	Major	Demonstrative_Examples, Dimensions
	Minor	None
671	Lack of Administrator Control over Security
	Major	Common_Consequences, Description
	Minor	None
672	Operation on a Resource after Expiration or Release
	Major	References, Relationships
	Minor	None
673	External Influence of Sphere Definition
	Major	Description, Weakness_Ordinalities
	Minor	None
674	Uncontrolled Recursion
	Major	Common_Consequences
	Minor	None
675	Multiple Operations on Resource in Single-Operation Context
	Major	Common_Consequences, Detection_Factors
	Minor	None
676	Use of Potentially Dangerous Function
	Major	Diagram, References
	Minor	None
680	Integer Overflow to Buffer Overflow
	Major	None
	Minor	Observed_Examples
681	Incorrect Conversion between Numeric Types
	Major	Applicable_Platforms, Demonstrative_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
682	Incorrect Calculation
	Major	Description, Dimensions, Observed_Examples, References
	Minor	None
683	Function Call With Incorrect Order of Arguments
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
684	Incorrect Provision of Specified Functionality
	Major	Common_Consequences, Description
	Minor	None
686	Function Call With Incorrect Argument Type
	Major	Description, Modes_of_Introduction
	Minor	None
690	Unchecked Return Value to NULL Pointer Dereference
	Major	Background_Details, Description
	Minor	Observed_Examples
691	Insufficient Control Flow Management
	Major	Detection_Factors, Dimensions, Relationships
	Minor	None
692	Incomplete Denylist to Cross-Site Scripting
	Major	Common_Consequences, Description
	Minor	None
693	Protection Mechanism Failure
	Major	Description, Dimensions, Relationships, Technical_Nuance
	Minor	None
694	Use of Multiple Resources with Duplicate Identifier
	Major	Common_Consequences, Description
	Minor	Observed_Examples
695	Use of Low-Level Functionality
	Major	Common_Consequences, Description, Relationships
	Minor	None
697	Incorrect Comparison
	Major	Description, Dimensions, Technical_Nuance
	Minor	None
698	Execution After Redirect (EAR)
	Major	Observed_Examples
	Minor	None
700	Seven Pernicious Kingdoms
	Major	References
	Minor	None
703	Improper Check or Handling of Exceptional Conditions
	Major	Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
704	Incorrect Type Conversion or Cast
	Major	Demonstrative_Examples, Dimensions, References, Relationships
	Minor	None
705	Incorrect Control Flow Scoping
	Major	Relationships
	Minor	None
707	Improper Neutralization
	Major	Common_Consequences, Description, Dimensions, Modes_of_Introduction, Relationships, Terminology_Notes
	Minor	None
708	Incorrect Ownership Assignment
	Major	Common_Consequences, Description
	Minor	None
710	Improper Adherence to Coding Standards
	Major	Common_Consequences, Description, Dimensions, Relationships
	Minor	None
712	OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)
	Major	Mapping_Notes, Type
	Minor	None
713	OWASP Top Ten 2007 Category A2 - Injection Flaws
	Major	Mapping_Notes, Type
	Minor	None
714	OWASP Top Ten 2007 Category A3 - Malicious File Execution
	Major	Mapping_Notes, Type
	Minor	None
715	OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference
	Major	Mapping_Notes, Type
	Minor	None
716	OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)
	Major	Mapping_Notes, Type
	Minor	None
717	OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling
	Major	Mapping_Notes, Type
	Minor	None
718	OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management
	Major	Mapping_Notes, Type
	Minor	None
719	OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage
	Major	Mapping_Notes, Type
	Minor	None
720	OWASP Top Ten 2007 Category A9 - Insecure Communications
	Major	Mapping_Notes, Type
	Minor	None
721	OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access
	Major	Mapping_Notes, Type
	Minor	None
722	OWASP Top Ten 2004 Category A1 - Unvalidated Input
	Major	Mapping_Notes, Type
	Minor	None
723	OWASP Top Ten 2004 Category A2 - Broken Access Control
	Major	Mapping_Notes, Type
	Minor	None
724	OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
	Major	Mapping_Notes, Type
	Minor	None
725	OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws
	Major	Mapping_Notes, Type
	Minor	None
726	OWASP Top Ten 2004 Category A5 - Buffer Overflows
	Major	Mapping_Notes, Type
	Minor	None
727	OWASP Top Ten 2004 Category A6 - Injection Flaws
	Major	Mapping_Notes, Type
	Minor	None
728	OWASP Top Ten 2004 Category A7 - Improper Error Handling
	Major	Mapping_Notes, Type
	Minor	None
729	OWASP Top Ten 2004 Category A8 - Insecure Storage
	Major	Mapping_Notes, Type
	Minor	None
730	OWASP Top Ten 2004 Category A9 - Denial of Service
	Major	Mapping_Notes, Type
	Minor	None
731	OWASP Top Ten 2004 Category A10 - Insecure Configuration Management
	Major	Mapping_Notes, Type
	Minor	None
732	Incorrect Permission Assignment for Critical Resource
	Major	Common_Consequences, Description, Observed_Examples, References, Relationships
	Minor	None
733	Compiler Optimization Removal or Modification of Security-critical Code
	Major	Dimensions
	Minor	None
735	CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE)
	Major	Mapping_Notes, Type
	Minor	None
736	CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL)
	Major	Mapping_Notes, Type
	Minor	None
737	CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)
	Major	Mapping_Notes, Type
	Minor	None
738	CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT)
	Major	Mapping_Notes, Type
	Minor	None
739	CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP)
	Major	Mapping_Notes, Type
	Minor	None
740	CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)
	Major	Mapping_Notes, Type
	Minor	None
741	CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)
	Major	Mapping_Notes, Type
	Minor	None
742	CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)
	Major	Mapping_Notes, Type
	Minor	None
743	CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)
	Major	Mapping_Notes, Type
	Minor	None
744	CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)
	Major	Mapping_Notes, Type
	Minor	None
745	CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)
	Major	Mapping_Notes, Type
	Minor	None
746	CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR)
	Major	Mapping_Notes, Type
	Minor	None
747	CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)
	Major	Mapping_Notes, Type
	Minor	None
748	CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)
	Major	Mapping_Notes, Type
	Minor	None
749	Exposed Dangerous Method or Function
	Major	Common_Consequences, Description, Dimensions
	Minor	None
751	2009 Top 25 - Insecure Interaction Between Components
	Major	Mapping_Notes, Type
	Minor	None
752	2009 Top 25 - Risky Resource Management
	Major	Mapping_Notes, Type
	Minor	None
753	2009 Top 25 - Porous Defenses
	Major	Mapping_Notes, Type
	Minor	None
754	Improper Check for Unusual or Exceptional Conditions
	Major	Applicable_Platforms, Common_Consequences, Description, Mapping_Notes, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
755	Improper Handling of Exceptional Conditions
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
757	Selection of Less-Secure Algorithm During Negotiation
	Major	Alternate_Terms, Common_Consequences, Description, Dimensions, Name, Type
	Minor	Observed_Examples
758	Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
	Major	Description, Modes_of_Introduction, References, Time_of_Introduction
	Minor	None
759	Use of a One-Way Hash without a Salt
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	None
760	Use of a One-Way Hash with a Predictable Salt
	Major	Common_Consequences, Description, Potential_Mitigations
	Minor	Observed_Examples
761	Free of Pointer not at Start of Buffer
	Major	Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction
	Minor	None
762	Mismatched Memory Management Routines
	Major	Common_Consequences, Description, Observed_Examples, Technical_Nuance
	Minor	None
763	Release of Invalid Pointer or Reference
	Major	Demonstrative_Examples, Description, Observed_Examples, Technical_Nuance
	Minor	None
764	Multiple Locks of a Critical Resource
	Major	Common_Consequences, Description, References
	Minor	None
765	Multiple Unlocks of a Critical Resource
	Major	Common_Consequences, Description
	Minor	None
766	Critical Data Element Declared Public
	Major	Common_Consequences, Description
	Minor	None
767	Access to Critical Private Variable via Public Method
	Major	Common_Consequences, Description, Type
	Minor	None
768	Incorrect Short Circuit Evaluation
	Major	Common_Consequences, Description, Relationships, Type
	Minor	None
770	Allocation of Resources Without Limits or Throttling
	Major	Demonstrative_Examples, Dimensions
	Minor	None
771	Missing Reference to Active Allocated Resource
	Major	Common_Consequences, Description, Other_Notes
	Minor	None
772	Missing Release of Resource after Effective Lifetime
	Major	Dimensions, References
	Minor	None
773	Missing Reference to Active File Descriptor or Handle
	Major	Common_Consequences, Description
	Minor	None
774	Allocation of File Descriptors or Handles Without Limits or Throttling
	Major	Common_Consequences, Description
	Minor	None
775	Missing Release of File Descriptor or Handle after Effective Lifetime
	Major	Common_Consequences, Description, Dimensions, References
	Minor	None
776	Improper Restriction of Recursive Entity References in DTDs
	Major	Common_Consequences, Description, Name
	Minor	None
777	Regular Expression without Anchors
	Major	Applicable_Platforms, Background_Details, Common_Consequences, Description
	Minor	None
778	Insufficient Logging
	Major	Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings, Time_of_Introduction
	Minor	None
779	Logging of Excessive Data
	Major	Common_Consequences, Description, Dimensions
	Minor	Observed_Examples
780	Use of RSA Algorithm without OAEP
	Major	Background_Details, Common_Consequences, Description
	Minor	None
781	Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
	Major	Common_Consequences, Description
	Minor	Observed_Examples
783	Operator Precedence Logic Error
	Major	Applicable_Platforms, Common_Consequences, Description, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
784	Reliance on Cookies without Validation and Integrity Checking in a Security Decision
	Major	Common_Consequences, Description
	Minor	None
785	Use of Path Manipulation Function without Maximum-sized Buffer
	Major	Common_Consequences, Description, References, Relationships
	Minor	None
786	Access of Memory Location Before Start of Buffer
	Major	Description, Dimensions, Modes_of_Introduction, References
	Minor	None
787	Out-of-bounds Write
	Major	Dimensions, Observed_Examples, References, Relationships, Taxonomy_Mappings
	Minor	None
788	Access of Memory Location After End of Buffer
	Major	Demonstrative_Examples, Description, Dimensions, Modes_of_Introduction, References, Relationships
	Minor	None
789	Memory Allocation with Excessive Size Value
	Major	References
	Minor	None
790	Improper Filtering of Special Elements
	Major	Description, Relationships
	Minor	None
791	Incomplete Filtering of Special Elements
	Major	Description
	Minor	None
792	Incomplete Filtering of One or More Instances of Special Elements
	Major	Description, Technical_Nuance
	Minor	None
793	Only Filtering One Instance of a Special Element
	Major	Description
	Minor	None
794	Incomplete Filtering of Multiple Instances of Special Elements
	Major	Description
	Minor	None
795	Only Filtering Special Elements at a Specified Location
	Major	Description, Technical_Nuance
	Minor	None
798	Use of Hard-coded Credentials
	Major	Applicable_Platforms, Demonstrative_Examples, Description, Observed_Examples, References, Relationships, Taxonomy_Mappings, Technical_Nuance
	Minor	None
799	Improper Control of Interaction Frequency
	Major	Alternate_Terms, Common_Consequences, Description, Observed_Examples
	Minor	None
801	2010 Top 25 - Insecure Interaction Between Components
	Major	Mapping_Notes, Type
	Minor	None
802	2010 Top 25 - Risky Resource Management
	Major	Mapping_Notes, Type
	Minor	None
803	2010 Top 25 - Porous Defenses
	Major	Mapping_Notes, Type
	Minor	None
804	Guessable CAPTCHA
	Major	Description, Mapping_Notes, Technical_Nuance, Weakness_Ordinalities
	Minor	None
805	Buffer Access with Incorrect Length Value
	Major	Common_Consequences, Description, Dimensions, References
	Minor	None
806	Buffer Access Using Size of Source Buffer
	Major	Description
	Minor	None
807	Reliance on Untrusted Inputs in a Security Decision
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
808	2010 Top 25 - Weaknesses On the Cusp
	Major	Mapping_Notes, Type
	Minor	None
810	OWASP Top Ten 2010 Category A1 - Injection
	Major	Mapping_Notes, Type
	Minor	None
811	OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)
	Major	Mapping_Notes, Type
	Minor	None
812	OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management
	Major	Mapping_Notes, Type
	Minor	None
813	OWASP Top Ten 2010 Category A4 - Insecure Direct Object References
	Major	Mapping_Notes, Type
	Minor	None
814	OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)
	Major	Mapping_Notes, Type
	Minor	None
815	OWASP Top Ten 2010 Category A6 - Security Misconfiguration
	Major	Mapping_Notes, Type
	Minor	None
816	OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage
	Major	Mapping_Notes, Type
	Minor	None
817	OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access
	Major	Mapping_Notes, Type
	Minor	None
818	OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection
	Major	Mapping_Notes, Type
	Minor	None
819	OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards
	Major	Mapping_Notes, Type
	Minor	None
820	Missing Synchronization
	Major	Common_Consequences, Description, Detection_Factors, References
	Minor	None
821	Incorrect Synchronization
	Major	Common_Consequences, Description, References
	Minor	None
822	Untrusted Pointer Dereference
	Major	Common_Consequences, Description, Dimensions, Observed_Examples, References, Technical_Nuance
	Minor	None
823	Use of Out-of-range Pointer Offset
	Major	Background_Details, Description, Observed_Examples, References
	Minor	None
824	Access of Uninitialized Pointer
	Major	Common_Consequences, Description, Observed_Examples, References
	Minor	None
825	Expired Pointer Dereference
	Major	Background_Details, Description, References
	Minor	None
826	Premature Release of Resource During Expected Lifetime
	Major	Common_Consequences, Description, Relationship_Notes
	Minor	None
830	Inclusion of Web Functionality from an Untrusted Source
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
832	Unlock of a Resource that is not Locked
	Major	Common_Consequences, Description
	Minor	None
833	Deadlock
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	Observed_Examples
834	Excessive Iteration
	Major	Common_Consequences, Description, Dimensions
	Minor	None
835	Loop with Unreachable Exit Condition
	Major	Alternate_Terms, Name, References
	Minor	None
836	Use of Password Hash Instead of Password for Authentication
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
837	Improper Enforcement of a Single, Unique Action
	Major	Background_Details, Demonstrative_Examples, Description
	Minor	None
838	Inappropriate Encoding for Output Context
	Major	Common_Consequences, Description
	Minor	None
839	Numeric Range Comparison Without Minimum Check
	Major	Common_Consequences, Description, Modes_of_Introduction, Relationships
	Minor	Observed_Examples
840	Business Logic Errors
	Major	Mapping_Notes, Type
	Minor	None
841	Improper Enforcement of Behavioral Workflow
	Major	Common_Consequences, Demonstrative_Examples, Description, Dimensions, Relationship_Notes, Relationships, Technical_Nuance
	Minor	None
842	Placement of User into Incorrect Group
	Major	Common_Consequences, Description
	Minor	None
843	Access of Resource Using Incompatible Type
	Major	Alternate_Terms, Applicable_Platforms, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, Name, References, Relationships, Taxonomy_Mappings
	Minor	None
845	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS)
	Major	Mapping_Notes, Type
	Minor	None
846	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL)
	Major	Mapping_Notes, Type
	Minor	None
847	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP)
	Major	Mapping_Notes, Type
	Minor	None
848	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM)
	Major	Mapping_Notes, Type
	Minor	None
849	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ)
	Major	Mapping_Notes, Type
	Minor	None
850	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)
	Major	Mapping_Notes, Type
	Minor	None
851	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)
	Major	Mapping_Notes, Type
	Minor	None
852	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA)
	Major	Mapping_Notes, Type
	Minor	None
853	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK)
	Major	Mapping_Notes, Type
	Minor	None
854	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI)
	Major	Mapping_Notes, Type
	Minor	None
855	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)
	Major	Mapping_Notes, Type
	Minor	None
856	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 13 - Thread-Safety Miscellaneous (TSM)
	Major	Mapping_Notes, Type
	Minor	None
857	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO)
	Major	Mapping_Notes, Type
	Minor	None
858	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER)
	Major	Mapping_Notes, Type
	Minor	None
859	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC)
	Major	Mapping_Notes, Type
	Minor	None
860	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV)
	Major	Mapping_Notes, Type
	Minor	None
861	The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC)
	Major	Mapping_Notes, Type
	Minor	None
862	Missing Authorization
	Major	Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
863	Incorrect Authorization
	Major	Applicable_Platforms, Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
864	2011 Top 25 - Insecure Interaction Between Components
	Major	Mapping_Notes, Type
	Minor	None
865	2011 Top 25 - Risky Resource Management
	Major	Mapping_Notes, Type
	Minor	None
866	2011 Top 25 - Porous Defenses
	Major	Mapping_Notes, Type
	Minor	None
867	2011 Top 25 - Weaknesses On the Cusp
	Major	Mapping_Notes, Type
	Minor	None
869	CERT C++ Secure Coding Section 01 - Preprocessor (PRE)
	Major	Mapping_Notes, Type
	Minor	None
870	CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL)
	Major	Mapping_Notes, Type
	Minor	None
871	CERT C++ Secure Coding Section 03 - Expressions (EXP)
	Major	Mapping_Notes, Type
	Minor	None
872	CERT C++ Secure Coding Section 04 - Integers (INT)
	Major	Mapping_Notes, Type
	Minor	None
873	CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)
	Major	Mapping_Notes, Type
	Minor	None
874	CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)
	Major	Mapping_Notes, Type
	Minor	None
875	CERT C++ Secure Coding Section 07 - Characters and Strings (STR)
	Major	Mapping_Notes, Type
	Minor	None
876	CERT C++ Secure Coding Section 08 - Memory Management (MEM)
	Major	Mapping_Notes, Type
	Minor	None
877	CERT C++ Secure Coding Section 09 - Input Output (FIO)
	Major	Mapping_Notes, Type
	Minor	None
878	CERT C++ Secure Coding Section 10 - Environment (ENV)
	Major	Mapping_Notes, Type
	Minor	None
879	CERT C++ Secure Coding Section 11 - Signals (SIG)
	Major	Mapping_Notes, Type
	Minor	None
880	CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)
	Major	Mapping_Notes, Type
	Minor	None
881	CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP)
	Major	Mapping_Notes, Type
	Minor	None
882	CERT C++ Secure Coding Section 14 - Concurrency (CON)
	Major	Mapping_Notes, Type
	Minor	None
883	CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)
	Major	Mapping_Notes, Type
	Minor	None
885	SFP Primary Cluster: Risky Values
	Major	Mapping_Notes, Type
	Minor	None
886	SFP Primary Cluster: Unused entities
	Major	Mapping_Notes, Type
	Minor	None
887	SFP Primary Cluster: API
	Major	Mapping_Notes, Type
	Minor	None
889	SFP Primary Cluster: Exception Management
	Major	Mapping_Notes, Type
	Minor	None
890	SFP Primary Cluster: Memory Access
	Major	Mapping_Notes, Type
	Minor	None
891	SFP Primary Cluster: Memory Management
	Major	Mapping_Notes, Type
	Minor	None
892	SFP Primary Cluster: Resource Management
	Major	Mapping_Notes, Type
	Minor	None
893	SFP Primary Cluster: Path Resolution
	Major	Mapping_Notes, Type
	Minor	None
894	SFP Primary Cluster: Synchronization
	Major	Mapping_Notes, Type
	Minor	None
895	SFP Primary Cluster: Information Leak
	Major	Mapping_Notes, Type
	Minor	None
896	SFP Primary Cluster: Tainted Input
	Major	Mapping_Notes, Type
	Minor	None
897	SFP Primary Cluster: Entry Points
	Major	Mapping_Notes, Type
	Minor	None
898	SFP Primary Cluster: Authentication
	Major	Mapping_Notes, Type
	Minor	None
899	SFP Primary Cluster: Access Control
	Major	Mapping_Notes, Type
	Minor	None
901	SFP Primary Cluster: Privilege
	Major	Mapping_Notes, Type
	Minor	None
902	SFP Primary Cluster: Channel
	Major	Mapping_Notes, Type
	Minor	None
903	SFP Primary Cluster: Cryptography
	Major	Mapping_Notes, Type
	Minor	None
904	SFP Primary Cluster: Malware
	Major	Mapping_Notes, Type
	Minor	None
905	SFP Primary Cluster: Predictability
	Major	Mapping_Notes, Type
	Minor	None
906	SFP Primary Cluster: UI
	Major	Mapping_Notes, Type
	Minor	None
907	SFP Primary Cluster: Other
	Major	Mapping_Notes, Type
	Minor	None
908	Use of Uninitialized Resource
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, References
	Minor	None
909	Missing Initialization of Resource
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description
	Minor	None
910	Use of Expired File Descriptor
	Major	Background_Details, Common_Consequences, Description, Weakness_Ordinalities
	Minor	None
911	Improper Update of Reference Count
	Major	Background_Details, Common_Consequences, Description
	Minor	Observed_Examples
912	Hidden Functionality
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction
	Minor	None
913	Improper Control of Dynamically-Managed Code Resources
	Major	Background_Details, Description
	Minor	None
914	Improper Control of Dynamically-Identified Variables
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction
	Minor	None
915	Improperly Controlled Modification of Dynamically-Determined Object Attributes
	Major	Description, Modes_of_Introduction, Observed_Examples
	Minor	None
916	Use of Password Hash With Insufficient Computational Effort
	Major	None
	Minor	Observed_Examples
917	Improper Neutralization of Special Elements used in an Expression Language Statement
	Major	Alternate_Terms, Background_Details, Common_Consequences, Description, Name, References
	Minor	None
918	Server-Side Request Forgery
	Major	Name, Potential_Mitigations
	Minor	None
920	Improper Restriction of Power Consumption
	Major	Common_Consequences, Description, Dimensions, Technical_Nuance
	Minor	None
921	Storage of Sensitive Data in a Mechanism without Access Control
	Major	Detection_Factors
	Minor	None
922	Insecure Storage of Sensitive Information
	Major	Common_Consequences, Description, Dimensions
	Minor	None
923	Improper Restriction of Communication Channel to Intended Endpoints
	Major	Common_Consequences, Description, Relationships
	Minor	None
924	Improper Enforcement of Message Integrity During Transmission in a Communication Channel
	Major	Common_Consequences, Description
	Minor	None
925	Improper Verification of Intent by Broadcast Receiver
	Major	Description
	Minor	None
926	Improper Export of Android Application Components
	Major	Common_Consequences, Description
	Minor	None
927	Use of Implicit Intent for Sensitive Communication
	Major	Relationships
	Minor	None
929	OWASP Top Ten 2013 Category A1 - Injection
	Major	Mapping_Notes, Type
	Minor	None
930	OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management
	Major	Mapping_Notes, Type
	Minor	None
931	OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)
	Major	Mapping_Notes, Type
	Minor	None
932	OWASP Top Ten 2013 Category A4 - Insecure Direct Object References
	Major	Mapping_Notes, Type
	Minor	None
933	OWASP Top Ten 2013 Category A5 - Security Misconfiguration
	Major	Mapping_Notes, Type
	Minor	None
934	OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure
	Major	Mapping_Notes, Type
	Minor	None
935	OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control
	Major	Mapping_Notes, Type
	Minor	None
936	OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF)
	Major	Mapping_Notes, Type
	Minor	None
937	OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
	Major	Mapping_Notes, Type
	Minor	None
938	OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards
	Major	Mapping_Notes, Type
	Minor	None
940	Improper Verification of Source of a Communication Channel
	Major	Common_Consequences, Description
	Minor	None
941	Incorrectly Specified Destination in a Communication Channel
	Major	Common_Consequences, Description, Modes_of_Introduction, Technical_Nuance, Time_of_Introduction, Weakness_Ordinalities
	Minor	None
942	Permissive Cross-domain Security Policy with Untrusted Domains
	Major	Common_Consequences, Description, Observed_Examples
	Minor	None
943	Improper Neutralization of Special Elements in Data Query Logic
	Major	Common_Consequences, Description, Dimensions, Technical_Nuance
	Minor	None
944	SFP Secondary Cluster: Access Management
	Major	Mapping_Notes, Type
	Minor	None
945	SFP Secondary Cluster: Insecure Resource Access
	Major	Mapping_Notes, Type
	Minor	None
946	SFP Secondary Cluster: Insecure Resource Permissions
	Major	Mapping_Notes, Type
	Minor	None
947	SFP Secondary Cluster: Authentication Bypass
	Major	Mapping_Notes, Type
	Minor	None
948	SFP Secondary Cluster: Digital Certificate
	Major	Mapping_Notes, Type
	Minor	None
949	SFP Secondary Cluster: Faulty Endpoint Authentication
	Major	Mapping_Notes, Type
	Minor	None
950	SFP Secondary Cluster: Hardcoded Sensitive Data
	Major	Mapping_Notes, Type
	Minor	None
951	SFP Secondary Cluster: Insecure Authentication Policy
	Major	Mapping_Notes, Type
	Minor	None
952	SFP Secondary Cluster: Missing Authentication
	Major	Mapping_Notes, Type
	Minor	None
953	SFP Secondary Cluster: Missing Endpoint Authentication
	Major	Mapping_Notes, Type
	Minor	None
954	SFP Secondary Cluster: Multiple Binds to the Same Port
	Major	Mapping_Notes, Type
	Minor	None
955	SFP Secondary Cluster: Unrestricted Authentication
	Major	Mapping_Notes, Type
	Minor	None
956	SFP Secondary Cluster: Channel Attack
	Major	Mapping_Notes, Type
	Minor	None
957	SFP Secondary Cluster: Protocol Error
	Major	Mapping_Notes, Type
	Minor	None
958	SFP Secondary Cluster: Broken Cryptography
	Major	Mapping_Notes, Type
	Minor	None
959	SFP Secondary Cluster: Weak Cryptography
	Major	Mapping_Notes, Type
	Minor	None
960	SFP Secondary Cluster: Ambiguous Exception Type
	Major	Mapping_Notes, Type
	Minor	None
961	SFP Secondary Cluster: Incorrect Exception Behavior
	Major	Mapping_Notes, Type
	Minor	None
962	SFP Secondary Cluster: Unchecked Status Condition
	Major	Mapping_Notes, Type
	Minor	None
963	SFP Secondary Cluster: Exposed Data
	Major	Mapping_Notes, Type
	Minor	None
964	SFP Secondary Cluster: Exposure Temporary File
	Major	Mapping_Notes, Type
	Minor	None
965	SFP Secondary Cluster: Insecure Session Management
	Major	Mapping_Notes, Type
	Minor	None
966	SFP Secondary Cluster: Other Exposures
	Major	Mapping_Notes, Type
	Minor	None
967	SFP Secondary Cluster: State Disclosure
	Major	Mapping_Notes, Type
	Minor	None
968	SFP Secondary Cluster: Covert Channel
	Major	Mapping_Notes, Type
	Minor	None
969	SFP Secondary Cluster: Faulty Memory Release
	Major	Mapping_Notes, Type
	Minor	None
970	SFP Secondary Cluster: Faulty Buffer Access
	Major	Mapping_Notes, Type
	Minor	None
971	SFP Secondary Cluster: Faulty Pointer Use
	Major	Mapping_Notes, Type
	Minor	None
972	SFP Secondary Cluster: Faulty String Expansion
	Major	Mapping_Notes, Type
	Minor	None
973	SFP Secondary Cluster: Improper NULL Termination
	Major	Mapping_Notes, Type
	Minor	None
974	SFP Secondary Cluster: Incorrect Buffer Length Computation
	Major	Mapping_Notes, Type
	Minor	None
975	SFP Secondary Cluster: Architecture
	Major	Mapping_Notes, Type
	Minor	None
976	SFP Secondary Cluster: Compiler
	Major	Mapping_Notes, Type
	Minor	None
977	SFP Secondary Cluster: Design
	Major	Mapping_Notes, Type
	Minor	None
978	SFP Secondary Cluster: Implementation
	Major	Mapping_Notes, Type
	Minor	None
979	SFP Secondary Cluster: Failed Chroot Jail
	Major	Mapping_Notes, Type
	Minor	None
980	SFP Secondary Cluster: Link in Resource Name Resolution
	Major	Mapping_Notes, Type
	Minor	None
981	SFP Secondary Cluster: Path Traversal
	Major	Mapping_Notes, Type
	Minor	None
982	SFP Secondary Cluster: Failure to Release Resource
	Major	Mapping_Notes, Type
	Minor	None
983	SFP Secondary Cluster: Faulty Resource Use
	Major	Mapping_Notes, Type
	Minor	None
984	SFP Secondary Cluster: Life Cycle
	Major	Mapping_Notes, Type
	Minor	None
985	SFP Secondary Cluster: Unrestricted Consumption
	Major	Mapping_Notes, Type
	Minor	None
986	SFP Secondary Cluster: Missing Lock
	Major	Mapping_Notes, Type
	Minor	None
987	SFP Secondary Cluster: Multiple Locks/Unlocks
	Major	Mapping_Notes, Type
	Minor	None
988	SFP Secondary Cluster: Race Condition Window
	Major	Mapping_Notes, Type
	Minor	None
989	SFP Secondary Cluster: Unrestricted Lock
	Major	Mapping_Notes, Type
	Minor	None
990	SFP Secondary Cluster: Tainted Input to Command
	Major	Mapping_Notes, Type
	Minor	None
991	SFP Secondary Cluster: Tainted Input to Environment
	Major	Mapping_Notes, Type
	Minor	None
992	SFP Secondary Cluster: Faulty Input Transformation
	Major	Mapping_Notes, Type
	Minor	None
993	SFP Secondary Cluster: Incorrect Input Handling
	Major	Mapping_Notes, Type
	Minor	None
994	SFP Secondary Cluster: Tainted Input to Variable
	Major	Mapping_Notes, Type
	Minor	None
995	SFP Secondary Cluster: Feature
	Major	Mapping_Notes, Type
	Minor	None
996	SFP Secondary Cluster: Security
	Major	Mapping_Notes, Type
	Minor	None
997	SFP Secondary Cluster: Information Loss
	Major	Mapping_Notes, Type
	Minor	None
998	SFP Secondary Cluster: Glitch in Computation
	Major	Mapping_Notes, Type
	Minor	None
1000	Complete Weakness Hierarchy
	Major	Description, Name, Other_Notes, Relationship_Notes, View_Audience
	Minor	None
1001	SFP Secondary Cluster: Use of an Improper API
	Major	Mapping_Notes, Type
	Minor	None
1002	SFP Secondary Cluster: Unexpected Entry Points
	Major	Mapping_Notes, Type
	Minor	None
1004	Sensitive Cookie Without 'HttpOnly' Flag
	Major	Observed_Examples
	Minor	None
1005	7PK - Input Validation and Representation
	Major	Mapping_Notes, References, Type
	Minor	None
1006	Bad Coding Practices
	Major	Mapping_Notes, Type
	Minor	None
1007	Insufficient Visual Distinction of Homoglyphs Presented to User
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1008	Architectural Concepts
	Major	Description, References, View_Audience
	Minor	None
1009	Audit
	Major	Mapping_Notes, References, Type
	Minor	None
1010	Authenticate Actors
	Major	Mapping_Notes, References, Type
	Minor	None
1011	Authorize Actors
	Major	Mapping_Notes, References, Type
	Minor	None
1012	Cross Cutting
	Major	Mapping_Notes, References, Type
	Minor	None
1013	Encrypt Data
	Major	Mapping_Notes, References, Type
	Minor	None
1014	Identify Actors
	Major	Mapping_Notes, References, Type
	Minor	None
1015	Limit Access
	Major	Mapping_Notes, References, Type
	Minor	None
1016	Limit Exposure
	Major	Mapping_Notes, References, Type
	Minor	None
1017	Lock Computer
	Major	Mapping_Notes, References, Type
	Minor	None
1018	Manage User Sessions
	Major	Mapping_Notes, References, Type
	Minor	None
1019	Validate Inputs
	Major	Mapping_Notes, References, Type
	Minor	None
1020	Verify Message Integrity
	Major	Mapping_Notes, References, Type
	Minor	None
1021	Improper Restriction of Rendered UI Layers or Frames
	Major	Potential_Mitigations, References
	Minor	None
1022	Use of Web Link to Untrusted Target with window.opener Access
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1024	Comparison of Incompatible Types
	Major	Dimensions, Type
	Minor	None
1025	Comparison Using Wrong Factors
	Major	Description, Type
	Minor	None
1027	OWASP Top Ten 2017 Category A1 - Injection
	Major	Mapping_Notes, Type
	Minor	None
1028	OWASP Top Ten 2017 Category A2 - Broken Authentication
	Major	Mapping_Notes, Type
	Minor	None
1029	OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure
	Major	Mapping_Notes, Type
	Minor	None
1030	OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)
	Major	Mapping_Notes, Type
	Minor	None
1031	OWASP Top Ten 2017 Category A5 - Broken Access Control
	Major	Mapping_Notes, Type
	Minor	None
1032	OWASP Top Ten 2017 Category A6 - Security Misconfiguration
	Major	Mapping_Notes, Type
	Minor	None
1033	OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)
	Major	Mapping_Notes, Type
	Minor	None
1034	OWASP Top Ten 2017 Category A8 - Insecure Deserialization
	Major	Mapping_Notes, Type
	Minor	None
1035	OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
	Major	Mapping_Notes, Type
	Minor	None
1036	OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring
	Major	Mapping_Notes, Type
	Minor	None
1037	Processor Optimization Removal or Modification of Security-critical Code
	Major	Dimensions
	Minor	None
1038	Insecure Automated Optimizations
	Major	Dimensions
	Minor	None
1039	Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism
	Major	Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction, References, Technical_Nuance
	Minor	None
1041	Use of Redundant Code
	Major	Description, Dimensions, Potential_Mitigations, References, Type
	Minor	None
1042	Static Member Data Element outside of a Singleton Class Element
	Major	Detection_Factors, References
	Minor	None
1043	Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1044	Architecture with Number of Horizontal Layers Outside of Expected Range
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1045	Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
	Major	Detection_Factors, References
	Minor	None
1046	Creation of Immutable Text Using String Concatenation
	Major	Common_Consequences, Description, Detection_Factors, References
	Minor	None
1047	Modules with Circular Dependencies
	Major	Detection_Factors, References
	Minor	None
1048	Invokable Control Element with Large Number of Outward Calls
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1049	Excessive Data Query Operations in a Large Data Table
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1050	Excessive Platform Resource Consumption within a Loop
	Major	Detection_Factors, References
	Minor	None
1051	Initialization with Hard-Coded Network Resource Configuration Data
	Major	Detection_Factors, References
	Minor	None
1052	Excessive Use of Hard-Coded Literals in Initialization
	Major	Detection_Factors, References
	Minor	None
1054	Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
	Major	Detection_Factors, References
	Minor	None
1055	Multiple Inheritance from Concrete Classes
	Major	References
	Minor	None
1057	Data Access Operations Outside of Expected Data Manager Component
	Major	Detection_Factors, References
	Minor	None
1058	Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
	Major	Detection_Factors, References
	Minor	None
1059	Insufficient Technical Documentation
	Major	Common_Consequences, Description, Technical_Nuance
	Minor	None
1060	Excessive Number of Inefficient Server-Side Data Accesses
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1061	Insufficient Encapsulation
	Major	Common_Consequences, Description, Dimensions
	Minor	None
1062	Parent Class with References to Child Class
	Major	Detection_Factors, References
	Minor	None
1063	Creation of Class Instance within a Static Code Block
	Major	Detection_Factors, References
	Minor	None
1064	Invokable Control Element with Signature Containing an Excessive Number of Parameters
	Major	Description, References, Terminology_Notes
	Minor	None
1065	Runtime Resource Management Control Element in a Component Built to Run on Application Servers
	Major	Detection_Factors, Relationships
	Minor	None
1066	Missing Serialization Control Element
	Major	Detection_Factors, References
	Minor	None
1067	Excessive Execution of Sequential Searches of Data Resource
	Major	Detection_Factors, References
	Minor	None
1068	Inconsistency Between Implementation and Documented Design
	Major	Type
	Minor	None
1069	Empty Exception Block
	Major	Demonstrative_Examples, Detection_Factors
	Minor	None
1070	Serializable Data Element Containing non-Serializable Item Elements
	Major	Detection_Factors, References
	Minor	None
1071	Empty Code Block
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction
	Minor	None
1072	Data Resource Access without Use of Connection Pooling
	Major	Detection_Factors, References
	Minor	None
1073	Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1074	Class with Excessively Deep Inheritance
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1075	Unconditional Control Flow Transfer outside of Switch Block
	Major	References
	Minor	None
1077	Floating Point Comparison with Incorrect Operator
	Major	Description, Dimensions, References, Relationships, Technical_Nuance
	Minor	None
1078	Inappropriate Source Code Style or Formatting
	Major	Detection_Factors
	Minor	None
1079	Parent Class without Virtual Destructor Method
	Major	References
	Minor	None
1080	Source Code File with Excessive Number of Lines of Code
	Major	Description, References, Terminology_Notes
	Minor	None
1082	Class Instance Self Destruction Control Element
	Major	Description, Detection_Factors, References
	Minor	None
1083	Data Access from Outside Expected Data Manager Component
	Major	Common_Consequences, Description, Detection_Factors, References
	Minor	None
1084	Invokable Control Element with Excessive File or Data Access Operations
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1085	Invokable Control Element with Excessive Volume of Commented-out Code
	Major	Description, References, Terminology_Notes
	Minor	None
1086	Class with Excessive Number of Child Classes
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1087	Class with Virtual Method without a Virtual Destructor
	Major	References
	Minor	None
1088	Synchronous Access of Remote Resource without Timeout
	Major	Detection_Factors, References
	Minor	None
1089	Large Data Table with Excessive Number of Indices
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1090	Method Containing Access of a Member Element from Another Class
	Major	Detection_Factors, References
	Minor	None
1091	Use of Object without Invoking Destructor Method
	Major	References
	Minor	None
1092	Use of Same Invokable Control Element in Multiple Architectural Layers
	Major	Detection_Factors, References
	Minor	None
1094	Excessive Index Range Scan for a Data Resource
	Major	Description, Detection_Factors, References, Terminology_Notes
	Minor	None
1095	Loop Condition Value Update within the Loop
	Major	Applicable_Platforms, Detection_Factors, References, Relationships, Taxonomy_Mappings
	Minor	None
1096	Singleton Class Instance Creation without Proper Locking or Synchronization
	Major	Detection_Factors, References
	Minor	None
1097	Persistent Storable Data Element without Associated Comparison Control Element
	Major	Detection_Factors, References
	Minor	None
1098	Data Element containing Pointer Item without Proper Copy Control Element
	Major	Detection_Factors, References
	Minor	None
1101	Reliance on Runtime Component in Generated Code
	Major	Detection_Factors
	Minor	None
1102	Reliance on Machine-Dependent Data Representation
	Major	Detection_Factors
	Minor	None
1109	Use of Same Variable for Multiple Purposes
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
1112	Incomplete Documentation of Program Execution
	Major	Description
	Minor	None
1113	Inappropriate Comment Style
	Major	Detection_Factors
	Minor	None
1114	Inappropriate Whitespace Style
	Major	Detection_Factors
	Minor	None
1115	Source Code Element without Standard Prologue
	Major	Background_Details, Description, Detection_Factors
	Minor	None
1116	Inaccurate Source Code Comments
	Major	Demonstrative_Examples, Detection_Factors
	Minor	None
1118	Insufficient Documentation of Error Handling Techniques
	Major	Description, Potential_Mitigations
	Minor	None
1119	Excessive Use of Unconditional Branching
	Major	Alternate_Terms, Detection_Factors, References
	Minor	None
1120	Excessive Code Complexity
	Major	Dimensions, References, Relationships, Taxonomy_Mappings
	Minor	None
1121	Excessive McCabe Cyclomatic Complexity
	Major	Dimensions, References
	Minor	None
1122	Excessive Halstead Complexity
	Major	Background_Details, Description, Detection_Factors, Dimensions
	Minor	None
1124	Excessively Deep Nesting
	Major	Detection_Factors, Dimensions, References
	Minor	None
1125	Excessive Attack Surface
	Major	Background_Details, Description
	Minor	None
1127	Compilation with Insufficient Warnings or Errors
	Major	Common_Consequences, Description, Dimensions, Potential_Mitigations, Type
	Minor	None
1129	CISQ Quality Measures (2016) - Reliability
	Major	Mapping_Notes, Type
	Minor	None
1130	CISQ Quality Measures (2016) - Maintainability
	Major	Mapping_Notes, Type
	Minor	None
1131	CISQ Quality Measures (2016) - Security
	Major	Mapping_Notes, Type
	Minor	None
1132	CISQ Quality Measures (2016) - Performance Efficiency
	Major	Mapping_Notes, Type
	Minor	None
1134	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)
	Major	Mapping_Notes, Type
	Minor	None
1135	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL)
	Major	Mapping_Notes, Type
	Minor	None
1136	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)
	Major	Mapping_Notes, Type
	Minor	None
1137	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM)
	Major	Mapping_Notes, Type
	Minor	None
1138	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR)
	Major	Mapping_Notes, Type
	Minor	None
1139	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)
	Major	Mapping_Notes, Type
	Minor	None
1140	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)
	Major	Mapping_Notes, Type
	Minor	None
1141	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR)
	Major	Mapping_Notes, Type
	Minor	None
1142	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA)
	Major	Mapping_Notes, Type
	Minor	None
1143	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK)
	Major	Mapping_Notes, Type
	Minor	None
1144	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI)
	Major	Mapping_Notes, Type
	Minor	None
1145	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)
	Major	Mapping_Notes, Type
	Minor	None
1146	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM)
	Major	Mapping_Notes, Type
	Minor	None
1147	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO)
	Major	Mapping_Notes, Type
	Minor	None
1148	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER)
	Major	Mapping_Notes, Type
	Minor	None
1149	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC)
	Major	Mapping_Notes, Type
	Minor	None
1150	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV)
	Major	Mapping_Notes, Type
	Minor	None
1151	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI)
	Major	Mapping_Notes, Type
	Minor	None
1152	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)
	Major	Mapping_Notes, Type
	Minor	None
1153	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD)
	Major	Mapping_Notes, Type
	Minor	None
1155	SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE)
	Major	Mapping_Notes, Type
	Minor	None
1156	SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL)
	Major	Mapping_Notes, Type
	Minor	None
1157	SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)
	Major	Mapping_Notes, Type
	Minor	None
1158	SEI CERT C Coding Standard - Guidelines 04. Integers (INT)
	Major	Mapping_Notes, Type
	Minor	None
1159	SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)
	Major	Mapping_Notes, Type
	Minor	None
1160	SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR)
	Major	Mapping_Notes, Type
	Minor	None
1161	SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR)
	Major	Mapping_Notes, Type
	Minor	None
1162	SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)
	Major	Mapping_Notes, Type
	Minor	None
1163	SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)
	Major	Mapping_Notes, Type
	Minor	None
1164	Irrelevant Code
	Major	Description, Relationships, Technical_Nuance
	Minor	None
1165	SEI CERT C Coding Standard - Guidelines 10. Environment (ENV)
	Major	Mapping_Notes, Type
	Minor	None
1166	SEI CERT C Coding Standard - Guidelines 11. Signals (SIG)
	Major	Mapping_Notes, Type
	Minor	None
1167	SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)
	Major	Mapping_Notes, Type
	Minor	None
1168	SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API)
	Major	Mapping_Notes, Type
	Minor	None
1169	SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON)
	Major	Mapping_Notes, Type
	Minor	None
1170	SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)
	Major	Mapping_Notes, Type
	Minor	None
1171	SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)
	Major	Mapping_Notes, Type
	Minor	None
1172	SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN)
	Major	Mapping_Notes, Type
	Minor	None
1173	Improper Use of Validation Framework
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, Weakness_Ordinalities
	Minor	None
1175	SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON)
	Major	Mapping_Notes, Type
	Minor	None
1177	Use of Prohibited Code
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
1179	SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS)
	Major	Mapping_Notes, Type
	Minor	None
1180	SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL)
	Major	Mapping_Notes, Type
	Minor	None
1181	SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP)
	Major	Mapping_Notes, Type
	Minor	None
1182	SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT)
	Major	Mapping_Notes, Type
	Minor	None
1183	SEI CERT Perl Coding Standard - Guidelines 05. Strings (STR)
	Major	Mapping_Notes, Type
	Minor	None
1184	SEI CERT Perl Coding Standard - Guidelines 06. Object-Oriented Programming (OOP)
	Major	Mapping_Notes, Type
	Minor	None
1185	SEI CERT Perl Coding Standard - Guidelines 07. File Input and Output (FIO)
	Major	Mapping_Notes, Type
	Minor	None
1186	SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)
	Major	Mapping_Notes, Type
	Minor	None
1189	Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
	Major	Dimensions
	Minor	None
1190	DMA Device Enabled Too Early in Boot Phase
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
1191	On-Chip Debug and Test Interface With Improper Access Control
	Major	Background_Details, Demonstrative_Examples, Description, Dimensions, Modes_of_Introduction
	Minor	Observed_Examples
1192	Improper Identifier for IP Block used in System-On-Chip (SOC)
	Major	Background_Details, Description, Technical_Nuance
	Minor	None
1193	Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1194	Hardware Design
	Major	Other_Notes, Relationship_Notes
	Minor	None
1195	Manufacturing and Life Cycle Management Concerns
	Major	Mapping_Notes, Type
	Minor	None
1196	Security Flow Issues
	Major	Mapping_Notes, Type
	Minor	None
1197	Integration Issues
	Major	Mapping_Notes, Type
	Minor	None
1198	Privilege Separation and Access Control Issues
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1199	General Circuit and Logic Design Concerns
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1201	Core and Compute Issues
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1202	Memory and Storage Issues
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1203	Peripherals, On-chip Fabric, and Interface/IO Problems
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1204	Generation of Weak Initialization Vector (IV)
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1205	Security Primitives and Cryptography Issues
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1206	Power, Clock, Thermal, and Reset Concerns
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1207	Debug and Test Problems
	Major	Mapping_Notes, Type
	Minor	None
1208	Cross-Cutting Problems
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1209	Failure to Disable Reserved Bits
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
1210	Audit / Logging Errors
	Major	Mapping_Notes, Type
	Minor	None
1211	Authentication Errors
	Major	Mapping_Notes, Type
	Minor	None
1212	Authorization Errors
	Major	Mapping_Notes, Type
	Minor	None
1213	Random Number Issues
	Major	Mapping_Notes, Type
	Minor	None
1214	Data Integrity Issues
	Major	Mapping_Notes, Type
	Minor	None
1215	Data Validation Issues
	Major	Mapping_Notes, Type
	Minor	None
1216	Lockout Mechanism Errors
	Major	Mapping_Notes, Type
	Minor	None
1217	User Session Errors
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1218	Memory Buffer Errors
	Major	Mapping_Notes, Type
	Minor	None
1219	File Handling Issues
	Major	Mapping_Notes, Type
	Minor	None
1220	Insufficient Granularity of Access Control
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Dimensions, Observed_Examples, Relationships
	Minor	None
1221	Incorrect Register Defaults or Module Parameters
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Detection_Factors
	Minor	None
1222	Insufficient Granularity of Address Regions Protected by Register Locks
	Major	Background_Details, Description
	Minor	None
1223	Race Condition for Write-Once Attributes
	Major	Background_Details, Description
	Minor	None
1224	Improper Restriction of Write-Once Bit Fields
	Major	Background_Details, Common_Consequences, Description, Dimensions
	Minor	None
1225	Documentation Issues
	Major	Mapping_Notes, Type
	Minor	None
1226	Complexity Issues
	Major	Mapping_Notes, Type
	Minor	None
1227	Encapsulation Issues
	Major	Mapping_Notes, Type
	Minor	None
1228	API / Function Errors
	Major	Mapping_Notes, Type
	Minor	None
1231	Improper Prevention of Lock Bit Modification
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description
	Minor	None
1232	Improper Lock Behavior After Power State Transition
	Major	Background_Details, Demonstrative_Examples, Description, Technical_Nuance
	Minor	None
1233	Security-Sensitive Hardware Controls with Missing Lock Bit Protection
	Major	Background_Details, Common_Consequences, Description, Observed_Examples
	Minor	None
1234	Hardware Internal or Debug Modes Allow Override of Locks
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Modes_of_Introduction
	Minor	None
1237	SFP Primary Cluster: Faulty Resource Release
	Major	Mapping_Notes, Type
	Minor	None
1238	SFP Primary Cluster: Failure to Release Memory
	Major	Mapping_Notes, Type
	Minor	None
1239	Improper Zeroization of Hardware Register
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations, Relationships, Terminology_Notes
	Minor	None
1241	Use of Predictable Algorithm in Random Number Generator
	Major	Demonstrative_Examples, Potential_Mitigations
	Minor	None
1243	Sensitive Non-Volatile Information Not Protected During Debug
	Major	Demonstrative_Examples
	Minor	None
1244	Internal Asset Exposed to Unsafe Debug Access Level or State
	Major	Background_Details, Demonstrative_Examples, Description
	Minor	None
1246	Improper Write Handling in Limited-write Non-Volatile Memories
	Major	Background_Details, Description
	Minor	None
1247	Improper Protection Against Voltage and Clock Glitches
	Major	Background_Details, Description, Detection_Factors, Potential_Mitigations
	Minor	None
1248	Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1250	Improper Preservation of Consistency Between Independent Representations of Shared State
	Major	Type
	Minor	None
1251	Mirrored Regions with Different Values
	Major	Common_Consequences, Description
	Minor	None
1252	CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
	Major	Background_Details, Description, Modes_of_Introduction
	Minor	None
1253	Incorrect Selection of Fuse Values
	Major	Dimensions
	Minor	None
1255	Comparison Logic is Vulnerable to Power Side-Channel Attacks
	Major	Common_Consequences, Description
	Minor	None
1257	Improper Access Control Applied to Mirrored or Aliased Memory Regions
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description
	Minor	None
1258	Exposure of Sensitive System Information Due to Uncleared Debug Information
	Major	Common_Consequences, Demonstrative_Examples, Description, Relationships
	Minor	None
1259	Improper Restriction of Security Token Assignment
	Major	Background_Details, Description, Potential_Mitigations, Relationships
	Minor	None
1260	Improper Handling of Overlap Between Protected Memory Ranges
	Major	Common_Consequences, Demonstrative_Examples, Description
	Minor	None
1262	Improper Access Control for Register Interface
	Major	Demonstrative_Examples, Relationships
	Minor	None
1263	Improper Physical Access Control
	Major	Common_Consequences, Description
	Minor	None
1264	Hardware Logic with Insecure De-Synchronization between Control and Data Channels
	Major	Relationships
	Minor	None
1265	Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
	Major	Description
	Minor	None
1266	Improper Scrubbing of Sensitive Data from Decommissioned Device
	Major	Background_Details, Common_Consequences, Description, Relationships
	Minor	None
1267	Policy Uses Obsolete Encoding
	Major	Background_Details, Description
	Minor	None
1268	Policy Privileges are not Assigned Consistently Between Control and Data Agents
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description
	Minor	None
1269	Product Released in Non-Release Configuration
	Major	Description, Potential_Mitigations, Technical_Nuance
	Minor	None
1270	Generation of Incorrect Security Tokens
	Major	Relationships
	Minor	Description
1271	Uninitialized Value on Reset for Registers Holding Security Settings
	Major	Common_Consequences, Description
	Minor	None
1272	Sensitive Information Uncleared Before Debug/Power State Transition
	Major	Background_Details, Common_Consequences, Description, Relationships
	Minor	None
1274	Improper Access Control for Volatile Memory Containing Boot Code
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1275	Sensitive Cookie with Improper SameSite Attribute
	Major	Background_Details, Common_Consequences, Description, Potential_Mitigations
	Minor	None
1276	Hardware Child Block Incorrectly Connected to Parent System
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description
	Minor	None
1277	Firmware Not Updateable
	Major	Common_Consequences, Description
	Minor	None
1278	Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
	Major	Common_Consequences, Description, Dimensions
	Minor	None
1279	Cryptographic Operations are Run Before Supporting Units are Ready
	Major	Background_Details, Description, Potential_Mitigations
	Minor	Name
1280	Access Control Check Implemented After Asset is Accessed
	Major	Dimensions
	Minor	None
1281	Sequence of Processor Instructions Leads to Unexpected Behavior
	Major	Demonstrative_Examples
	Minor	None
1282	Assumed-Immutable Data is Stored in Writable Memory
	Major	Background_Details, Common_Consequences, Description, Potential_Mitigations
	Minor	None
1283	Mutable Attestation or Measurement Reporting Data
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1284	Improper Validation of Specified Quantity in Input
	Major	Description, Dimensions, Modes_of_Introduction, Relationships, Technical_Nuance
	Minor	None
1285	Improper Validation of Specified Index, Position, or Offset in Input
	Major	Dimensions
	Minor	None
1286	Improper Validation of Syntactic Correctness of Input
	Major	Background_Details, Common_Consequences, Description, Dimensions
	Minor	None
1287	Improper Validation of Specified Type of Input
	Major	Common_Consequences, Description, Dimensions, Modes_of_Introduction
	Minor	None
1288	Improper Validation of Consistency within Input
	Major	Background_Details, Common_Consequences, Description, Dimensions
	Minor	None
1289	Improper Validation of Unsafe Equivalence in Input
	Major	Common_Consequences, Description, Dimensions
	Minor	None
1290	Incorrect Decoding of Security Identifiers
	Major	Background_Details, Common_Consequences, Description, Dimensions, Relationships
	Minor	None
1291	Public Key Re-Use for Signing both Debug and Production Code
	Major	Dimensions
	Minor	None
1292	Incorrect Conversion of Security Identifiers
	Major	Background_Details, Common_Consequences, Description, Relationships
	Minor	None
1293	Missing Source Correlation of Multiple Independent Data
	Major	Description, Potential_Mitigations
	Minor	None
1294	Insecure Security Identifier Mechanism
	Major	Background_Details, Description, Relationships, Research_Gaps, Technical_Nuance
	Minor	None
1295	Debug Messages Revealing Unnecessary Information
	Major	Relationships
	Minor	None
1296	Incorrect Chaining or Granularity of Debug Components
	Major	Background_Details, Description, Modes_of_Introduction
	Minor	None
1297	Unprotected Confidential Information on Device is Accessible by OSAT Vendors
	Major	Description, Modes_of_Introduction, Potential_Mitigations, Time_of_Introduction
	Minor	None
1298	Hardware Logic Contains Race Conditions
	Major	Common_Consequences, Demonstrative_Examples, Description
	Minor	None
1299	Missing Protection Mechanism for Alternate Hardware Interface
	Major	Relationships
	Minor	None
1300	Improper Protection of Physical Side Channels
	Major	Common_Consequences, Demonstrative_Examples, Description, Observed_Examples, Relationships
	Minor	None
1301	Insufficient or Incomplete Data Removal within Hardware Component
	Major	Common_Consequences, Description, Relationships
	Minor	None
1302	Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1304	Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1306	CISQ Quality Measures - Reliability
	Major	Mapping_Notes, Type
	Minor	None
1307	CISQ Quality Measures - Maintainability
	Major	Mapping_Notes, Type
	Minor	None
1308	CISQ Quality Measures - Security
	Major	Mapping_Notes, Type
	Minor	None
1309	CISQ Quality Measures - Efficiency
	Major	Mapping_Notes, Type
	Minor	None
1310	Missing Ability to Patch ROM Code
	Major	Common_Consequences, Demonstrative_Examples, Description
	Minor	None
1311	Improper Translation of Security Attributes by Fabric Bridge
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1313	Hardware Allows Activation of Test or Debug Logic at Runtime
	Major	Common_Consequences, Description
	Minor	None
1314	Missing Write Protection for Parametric Data Values
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1316	Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1317	Improper Access Control in Fabric Bridge
	Major	Background_Details, Demonstrative_Examples, Description
	Minor	None
1318	Missing Support for Security Features in On-chip Fabrics or Buses
	Major	Demonstrative_Examples, Description, Dimensions, Modes_of_Introduction, Potential_Mitigations
	Minor	None
1319	Improper Protection against Electromagnetic Fault Injection (EM-FI)
	Major	Common_Consequences, Description, Dimensions, Observed_Examples
	Minor	None
1320	Improper Protection for Outbound Error Messages and Alert Signals
	Major	Background_Details, Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
1321	Improperly Controlled Modification of Object Prototype Attributes
	Major	Alternate_Terms, Name
	Minor	None
1322	Use of Blocking Code in Single-threaded, Non-blocking Context
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1323	Improper Management of Sensitive Trace Data
	Major	Background_Details, Common_Consequences, Description, Potential_Mitigations
	Minor	None
1326	Missing Immutable Root of Trust in Hardware
	Major	Background_Details, Common_Consequences, Demonstrative_Examples, Description, Potential_Mitigations
	Minor	None
1327	Binding to an Unrestricted IP Address
	Major	Background_Details, Common_Consequences, Description, Relationships
	Minor	None
1328	Security Version Number Mutable to Older Versions
	Major	Background_Details, Common_Consequences, Description, Potential_Mitigations
	Minor	None
1329	Reliance on Component That is Not Updateable
	Major	Demonstrative_Examples, Relationships, Type
	Minor	None
1330	Remanent Data Readable after Memory Erase
	Major	Common_Consequences, Description, Modes_of_Introduction, Relationships, Time_of_Introduction
	Minor	None
1332	Improper Handling of Faults that Lead to Instruction Skips
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction
	Minor	None
1333	Inefficient Regular Expression Complexity
	Major	Applicable_Platforms, References, Relationships, Taxonomy_Mappings
	Minor	None
1334	Unauthorized Error Injection Can Degrade Hardware Redundancy
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
1335	Incorrect Bitwise Shift of Integer
	Major	Applicable_Platforms, Common_Consequences, Description, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
1336	Improper Neutralization of Special Elements Used in a Template Engine
	Major	Background_Details, Common_Consequences, Description
	Minor	None
1338	Improper Protections Against Hardware Overheating
	Major	Dimensions, Relationships
	Minor	None
1339	Insufficient Precision or Accuracy of a Real Number
	Major	Applicable_Platforms, Background_Details, Demonstrative_Examples, Description, References, Relationships, Taxonomy_Mappings
	Minor	Observed_Examples
1341	Multiple Releases of Same Resource or Handle
	Major	Background_Details, Common_Consequences, Description, Modes_of_Introduction
	Minor	None
1342	Information Exposure through Microarchitectural State after Transient Execution
	Major	Relationships
	Minor	None
1345	OWASP Top Ten 2021 Category A01:2021 - Broken Access Control
	Major	Mapping_Notes, Type
	Minor	None
1346	OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures
	Major	Mapping_Notes, Type
	Minor	None
1347	OWASP Top Ten 2021 Category A03:2021 - Injection
	Major	Mapping_Notes, Type
	Minor	None
1348	OWASP Top Ten 2021 Category A04:2021 - Insecure Design
	Major	Mapping_Notes, Type
	Minor	None
1349	OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration
	Major	Mapping_Notes, Type
	Minor	None
1351	Improper Handling of Hardware Behavior in Exceptionally Cold Environments
	Major	Common_Consequences, Demonstrative_Examples, Description, Mapping_Notes, Modes_of_Introduction, Relationships
	Minor	None
1352	OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components
	Major	Mapping_Notes, Type
	Minor	None
1353	OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures
	Major	Mapping_Notes, Type
	Minor	None
1354	OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures
	Major	Mapping_Notes, Type
	Minor	None
1355	OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures
	Major	Mapping_Notes, Type
	Minor	None
1356	OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF)
	Major	Mapping_Notes, Type
	Minor	None
1357	Reliance on Insufficiently Trustworthy Component
	Major	Common_Consequences, Description, Modes_of_Introduction, Potential_Mitigations, Relationships, Technical_Nuance
	Minor	None
1359	ICS Communications
	Major	Mapping_Notes, Type
	Minor	None
1360	ICS Dependencies (& Architecture)
	Major	Mapping_Notes, Type
	Minor	None
1361	ICS Supply Chain
	Major	Mapping_Notes, Type
	Minor	None
1362	ICS Engineering (Constructions/Deployment)
	Major	Mapping_Notes, Type
	Minor	None
1363	ICS Operations (& Maintenance)
	Major	Mapping_Notes, Type
	Minor	None
1364	ICS Communications: Zone Boundary Failures
	Major	Mapping_Notes, Type
	Minor	None
1365	ICS Communications: Unreliability
	Major	Mapping_Notes, Type
	Minor	None
1366	ICS Communications: Frail Security in Protocols
	Major	Mapping_Notes, Type
	Minor	None
1367	ICS Dependencies (& Architecture): External Physical Systems
	Major	Mapping_Notes, Type
	Minor	None
1368	ICS Dependencies (& Architecture): External Digital Systems
	Major	Mapping_Notes, Type
	Minor	None
1369	ICS Supply Chain: IT/OT Convergence/Expansion
	Major	Mapping_Notes, Type
	Minor	None
1370	ICS Supply Chain: Common Mode Frailties
	Major	Mapping_Notes, Type
	Minor	None
1371	ICS Supply Chain: Poorly Documented or Undocumented Features
	Major	Mapping_Notes, Type
	Minor	None
1372	ICS Supply Chain: OT Counterfeit and Malicious Corruption
	Major	Mapping_Notes, Type
	Minor	None
1373	ICS Engineering (Construction/Deployment): Trust Model Problems
	Major	Mapping_Notes, Type
	Minor	None
1374	ICS Engineering (Construction/Deployment): Maker Breaker Blindness
	Major	Mapping_Notes, Type
	Minor	None
1375	ICS Engineering (Construction/Deployment): Gaps in Details/Data
	Major	Mapping_Notes, Type
	Minor	None
1376	ICS Engineering (Construction/Deployment): Security Gaps in Commissioning
	Major	Mapping_Notes, Type
	Minor	None
1377	ICS Engineering (Construction/Deployment): Inherent Predictability in Design
	Major	Mapping_Notes, Type
	Minor	None
1378	ICS Operations (& Maintenance): Gaps in obligations and training
	Major	Mapping_Notes, Type
	Minor	None
1379	ICS Operations (& Maintenance): Human factors in ICS environments
	Major	Mapping_Notes, Type
	Minor	None
1380	ICS Operations (& Maintenance): Post-analysis changes
	Major	Mapping_Notes, Type
	Minor	None
1381	ICS Operations (& Maintenance): Exploitable Standard Operational Procedures
	Major	Mapping_Notes, Type
	Minor	None
1382	ICS Operations (& Maintenance): Emerging Energy Technologies
	Major	Mapping_Notes, Type
	Minor	None
1383	ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements
	Major	Mapping_Notes, Type
	Minor	None
1384	Improper Handling of Physical or Environmental Conditions
	Major	Background_Details, Description, Dimensions, Relationships, Technical_Nuance
	Minor	None
1385	Missing Origin Validation in WebSockets
	Major	Applicable_Platforms, Background_Details, Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
1386	Insecure Operation on Windows Junction / Mount Point
	Major	Background_Details, Description
	Minor	None
1388	Physical Access Issues and Concerns
	Major	Mapping_Notes, Type
	Minor	None
1389	Incorrect Parsing of Numbers with Different Radices
	Major	Applicable_Platforms, Background_Details, Demonstrative_Examples, Description
	Minor	None
1390	Weak Authentication
	Major	Applicable_Platforms, Common_Consequences, Description, References, Relationships, Taxonomy_Mappings
	Minor	None
1391	Use of Weak Credentials
	Major	Common_Consequences, Description, Modes_of_Introduction, Technical_Nuance
	Minor	Observed_Examples
1392	Use of Default Credentials
	Major	Common_Consequences, Description, Modes_of_Introduction, Time_of_Introduction
	Minor	None
1393	Use of Default Password
	Major	Applicable_Platforms, Description, Detection_Factors, Modes_of_Introduction, References, Relationships, Taxonomy_Mappings
	Minor	None
1394	Use of Default Cryptographic Key
	Major	Common_Consequences, Description, Modes_of_Introduction
	Minor	None
1395	Dependency on Vulnerable Third-Party Component
	Major	Background_Details, Description
	Minor	None
1396	Comprehensive Categorization: Access Control
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1397	Comprehensive Categorization: Comparison
	Major	Mapping_Notes, Type
	Minor	None
1398	Comprehensive Categorization: Component Interaction
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1399	Comprehensive Categorization: Memory Safety
	Major	Mapping_Notes, Type
	Minor	None
1401	Comprehensive Categorization: Concurrency
	Major	Mapping_Notes, Type
	Minor	None
1402	Comprehensive Categorization: Encryption
	Major	Mapping_Notes, Type
	Minor	None
1403	Comprehensive Categorization: Exposed Resource
	Major	Mapping_Notes, Type
	Minor	None
1404	Comprehensive Categorization: File Handling
	Major	Mapping_Notes, Type
	Minor	None
1405	Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions
	Major	Mapping_Notes, Type
	Minor	None
1406	Comprehensive Categorization: Improper Input Validation
	Major	Mapping_Notes, Type
	Minor	None
1407	Comprehensive Categorization: Improper Neutralization
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1408	Comprehensive Categorization: Incorrect Calculation
	Major	Mapping_Notes, Type
	Minor	None
1409	Comprehensive Categorization: Injection
	Major	Mapping_Notes, Type
	Minor	None
1410	Comprehensive Categorization: Insufficient Control Flow Management
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1411	Comprehensive Categorization: Insufficient Verification of Data Authenticity
	Major	Mapping_Notes, Type
	Minor	None
1412	Comprehensive Categorization: Poor Coding Practices
	Major	Mapping_Notes, Type
	Minor	None
1413	Comprehensive Categorization: Protection Mechanism Failure
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1414	Comprehensive Categorization: Randomness
	Major	Mapping_Notes, Type
	Minor	None
1415	Comprehensive Categorization: Resource Control
	Major	Mapping_Notes, Type
	Minor	None
1416	Comprehensive Categorization: Resource Lifecycle Management
	Major	Mapping_Notes, Relationships, Type
	Minor	None
1417	Comprehensive Categorization: Sensitive Information Exposure
	Major	Mapping_Notes, Type
	Minor	None
1418	Comprehensive Categorization: Violation of Secure Design Principles
	Major	Mapping_Notes, Type
	Minor	None
1419	Incorrect Initialization of Resource
	Major	Demonstrative_Examples, Description, Modes_of_Introduction
	Minor	Observed_Examples
1420	Exposure of Sensitive Information during Transient Execution
	Major	Relationships
	Minor	None
1421	Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
	Major	Common_Consequences, Relationships
	Minor	None
1422	Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
	Major	Relationships
	Minor	None
1423	Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
	Major	Observed_Examples, Relationships
	Minor	None
1426	Improper Validation of Generative AI Output
	Major	Dimensions, Maintenance_Notes, Research_Gaps
	Minor	Observed_Examples
1427	Improper Neutralization of Input Used for LLM Prompting
	Major	Demonstrative_Examples
	Minor	None
1428	Reliance on HTTP instead of HTTPS
	Major	Description, Potential_Mitigations
	Minor	None
1429	Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface
	Major	Demonstrative_Examples, Detection_Factors
	Minor	None
1431	Driving Intermediate Cryptographic State/Results to Hardware Module Outputs
	Major	Demonstrative_Examples, Detection_Factors, Relationships
	Minor	None
1433	2025 MIHW Supplement: Expert Insights
	Major	Mapping_Notes, Type
	Minor	None
1436	OWASP Top Ten 2025 Category A01:2025 - Broken Access Control
	Major	Mapping_Notes, Type
	Minor	None
1437	OWASP Top Ten 2025 Category A02:2025 - Security Misconfiguration
	Major	Mapping_Notes, Type
	Minor	None
1438	OWASP Top Ten 2025 Category A03:2025 - Software Supply Chain Failures
	Major	Mapping_Notes, Type
	Minor	None
1439	OWASP Top Ten 2025 Category A04:2025 - Cryptographic Failures
	Major	Mapping_Notes, Type
	Minor	None
1440	OWASP Top Ten 2025 Category A05:2025 - Injection
	Major	Mapping_Notes, Type
	Minor	None
1441	OWASP Top Ten 2025 Category A06:2025 - Insecure Design
	Major	Mapping_Notes, Type
	Minor	None
1442	OWASP Top Ten 2025 Category A07:2025 - Authentication Failures
	Major	Mapping_Notes, Type
	Minor	None
1443	OWASP Top Ten 2025 Category A08:2025 - Software or Data Integrity Failures
	Major	Mapping_Notes, Type
	Minor	None
1444	OWASP Top Ten 2025 Category A09:2025 - Logging & Alerting Failures
	Major	Mapping_Notes, Type
	Minor	None
1445	OWASP Top Ten 2025 Category A10:2025 - Mishandling of Exceptional Conditions
	Major	Mapping_Notes, Type
	Minor	None
1446	Weaknesses That are Specific to AI/ML Technology
	Major	Mapping_Notes, Type
	Minor	None
1447	General Software Weaknesses that Appear in Products that Use or Support AI/ML Technology
	Major	Mapping_Notes, Relationships, Type
	Minor	None

Page Last Updated: October 27, 2026


	Site Map \| Terms of Use \| Manage Cookies \| Cookie Notice \| Privacy Policy \| Contact Us \| Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.

Common Weakness Enumeration