| HasMember |  Deprecated | 1 | DEPRECATED: Location |
| HasMember |  Category - a CWE entry that contains a set of other entries that share a common characteristic. | 2 | 7PK - Environment |
| HasMember | Deprecated | 3 | DEPRECATED: Technology-specific Environment Issues |
| HasMember | Deprecated | 4 | DEPRECATED: J2EE Environment Issues |
| HasMember |  Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 5 | J2EE Misconfiguration: Data Transmission Without Encryption |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 6 | J2EE Misconfiguration: Insufficient Session-ID Length |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 7 | J2EE Misconfiguration: Missing Custom Error Page |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 8 | J2EE Misconfiguration: Entity Bean Declared Remote |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 9 | J2EE Misconfiguration: Weak Access Permissions for EJB Methods |
| HasMember | Deprecated | 10 | DEPRECATED: ASP.NET Environment Issues |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 11 | ASP.NET Misconfiguration: Creating Debug Binary |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 12 | ASP.NET Misconfiguration: Missing Custom Error Page |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 13 | ASP.NET Misconfiguration: Password in Configuration File |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 14 | Compiler Removal of Code to Clear Buffers |
| HasMember |  Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 15 | External Control of System or Configuration Setting |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 16 | Configuration |
| HasMember | Deprecated | 17 | DEPRECATED: Code |
| HasMember | Deprecated | 18 | DEPRECATED: Source Code |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 19 | Data Processing Errors |
| HasMember |  Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 20 | Improper Input Validation |
| HasMember | Deprecated | 21 | DEPRECATED: Pathname Traversal and Equivalence Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 23 | Relative Path Traversal |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 24 | Path Traversal: '../filedir' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 25 | Path Traversal: '/../filedir' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 26 | Path Traversal: '/dir/../filename' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 27 | Path Traversal: 'dir/../../filename' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 28 | Path Traversal: '..\filedir' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 29 | Path Traversal: '\..\filename' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 30 | Path Traversal: '\dir\..\filename' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 31 | Path Traversal: 'dir\..\..\filename' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 32 | Path Traversal: '...' (Triple Dot) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 33 | Path Traversal: '....' (Multiple Dot) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 34 | Path Traversal: '....//' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 35 | Path Traversal: '.../...//' |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 36 | Absolute Path Traversal |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 37 | Path Traversal: '/absolute/pathname/here' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 38 | Path Traversal: '\absolute\pathname\here' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 39 | Path Traversal: 'C:dirname' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 41 | Improper Resolution of Path Equivalence |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 42 | Path Equivalence: 'filename.' (Trailing Dot) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 43 | Path Equivalence: 'filename....' (Multiple Trailing Dot) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 44 | Path Equivalence: 'file.name' (Internal Dot) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 45 | Path Equivalence: 'file...name' (Multiple Internal Dot) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 46 | Path Equivalence: 'filename ' (Trailing Space) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 47 | Path Equivalence: ' filename' (Leading Space) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 48 | Path Equivalence: 'file name' (Internal Whitespace) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 49 | Path Equivalence: 'filename/' (Trailing Slash) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 50 | Path Equivalence: '//multiple/leading/slash' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 51 | Path Equivalence: '/multiple//internal/slash' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 52 | Path Equivalence: '/multiple/trailing/slash//' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 53 | Path Equivalence: '\multiple\\internal\backslash' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 54 | Path Equivalence: 'filedir\' (Trailing Backslash) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 55 | Path Equivalence: '/./' (Single Dot Directory) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 56 | Path Equivalence: 'filedir*' (Wildcard) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 57 | Path Equivalence: 'fakedir/../realdir/filename' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 58 | Path Equivalence: Windows 8.3 Filename |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 59 | Improper Link Resolution Before File Access ('Link Following') |
| HasMember | Deprecated | 60 | DEPRECATED: UNIX Path Link Problems |
| HasMember |  Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. | 61 | UNIX Symbolic Link (Symlink) Following |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 62 | UNIX Hard Link |
| HasMember | Deprecated | 63 | DEPRECATED: Windows Path Link Problems |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 64 | Windows Shortcut Following (.LNK) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 65 | Windows Hard Link |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 66 | Improper Handling of File Names that Identify Virtual Resources |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 67 | Improper Handling of Windows Device Names |
| HasMember | Deprecated | 68 | DEPRECATED: Windows Virtual File Problems |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 69 | Improper Handling of Windows ::DATA Alternate Data Stream |
| HasMember | Deprecated | 70 | DEPRECATED: Mac Virtual File Problems |
| HasMember | Deprecated | 71 | DEPRECATED: Apple '.DS_Store' |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 72 | Improper Handling of Apple HFS+ Alternate Data Stream Path |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 73 | External Control of File Name or Path |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 75 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 76 | Improper Neutralization of Equivalent Special Elements |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 81 | Improper Neutralization of Script in an Error Message Web Page |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 83 | Improper Neutralization of Script in Attributes in a Web Page |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 84 | Improper Neutralization of Encoded URI Schemes in a Web Page |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 85 | Doubled Character XSS Manipulations |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 87 | Improper Neutralization of Alternate XSS Syntax |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 91 | XML Injection (aka Blind XPath Injection) |
| HasMember | Deprecated | 92 | DEPRECATED: Improper Sanitization of Custom Special Characters |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 94 | Improper Control of Generation of Code ('Code Injection') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 99 | Improper Control of Resource Identifiers ('Resource Injection') |
| HasMember | Deprecated | 100 | DEPRECATED: Technology-Specific Input Validation Problems |
| HasMember | Deprecated | 101 | DEPRECATED: Struts Validation Problems |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 102 | Struts: Duplicate Validation Forms |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 103 | Struts: Incomplete validate() Method Definition |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 104 | Struts: Form Bean Does Not Extend Validation Class |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 105 | Struts: Form Field Without Validator |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 106 | Struts: Plug-in Framework not in Use |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 107 | Struts: Unused Validation Form |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 108 | Struts: Unvalidated Action Form |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 109 | Struts: Validator Turned Off |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 110 | Struts: Validator Without Form Field |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 111 | Direct Use of Unsafe JNI |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 112 | Missing XML Validation |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 114 | Process Control |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 115 | Misinterpretation of Input |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 116 | Improper Encoding or Escaping of Output |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 117 | Improper Output Neutralization for Logs |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 118 | Incorrect Access of Indexable Resource ('Range Error') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 119 | Improper Restriction of Operations within the Bounds of a Memory Buffer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 121 | Stack-based Buffer Overflow |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 122 | Heap-based Buffer Overflow |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 123 | Write-what-where Condition |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 124 | Buffer Underwrite ('Buffer Underflow') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 125 | Out-of-bounds Read |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 126 | Buffer Over-read |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 127 | Buffer Under-read |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 128 | Wrap-around Error |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 129 | Improper Validation of Array Index |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 130 | Improper Handling of Length Parameter Inconsistency |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 131 | Incorrect Calculation of Buffer Size |
| HasMember | Deprecated | 132 | DEPRECATED: Miscalculated Null Termination |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 133 | String Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 134 | Use of Externally-Controlled Format String |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 135 | Incorrect Calculation of Multi-Byte String Length |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 136 | Type Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 137 | Data Neutralization Issues |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 138 | Improper Neutralization of Special Elements |
| HasMember | Deprecated | 139 | DEPRECATED: General Special Element Problems |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 140 | Improper Neutralization of Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 141 | Improper Neutralization of Parameter/Argument Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 142 | Improper Neutralization of Value Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 143 | Improper Neutralization of Record Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 144 | Improper Neutralization of Line Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 145 | Improper Neutralization of Section Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 146 | Improper Neutralization of Expression/Command Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 147 | Improper Neutralization of Input Terminators |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 148 | Improper Neutralization of Input Leaders |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 149 | Improper Neutralization of Quoting Syntax |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 150 | Improper Neutralization of Escape, Meta, or Control Sequences |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 151 | Improper Neutralization of Comment Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 152 | Improper Neutralization of Macro Symbols |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 153 | Improper Neutralization of Substitution Characters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 154 | Improper Neutralization of Variable Name Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 155 | Improper Neutralization of Wildcards or Matching Symbols |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 156 | Improper Neutralization of Whitespace |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 157 | Failure to Sanitize Paired Delimiters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 158 | Improper Neutralization of Null Byte or NUL Character |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 159 | Improper Handling of Invalid Use of Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 160 | Improper Neutralization of Leading Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 161 | Improper Neutralization of Multiple Leading Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 162 | Improper Neutralization of Trailing Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 163 | Improper Neutralization of Multiple Trailing Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 164 | Improper Neutralization of Internal Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 165 | Improper Neutralization of Multiple Internal Special Elements |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 166 | Improper Handling of Missing Special Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 167 | Improper Handling of Additional Special Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 168 | Improper Handling of Inconsistent Special Elements |
| HasMember | Deprecated | 169 | DEPRECATED: Technology-Specific Special Elements |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 170 | Improper Null Termination |
| HasMember | Deprecated | 171 | DEPRECATED: Cleansing, Canonicalization, and Comparison Errors |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 172 | Encoding Error |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 173 | Improper Handling of Alternate Encoding |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 174 | Double Decoding of the Same Data |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 175 | Improper Handling of Mixed Encoding |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 176 | Improper Handling of Unicode Encoding |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 177 | Improper Handling of URL Encoding (Hex Encoding) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 178 | Improper Handling of Case Sensitivity |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 179 | Incorrect Behavior Order: Early Validation |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 180 | Incorrect Behavior Order: Validate Before Canonicalize |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 181 | Incorrect Behavior Order: Validate Before Filter |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 182 | Collapse of Data into Unsafe Value |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 183 | Permissive List of Allowed Inputs |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 184 | Incomplete List of Disallowed Inputs |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 185 | Incorrect Regular Expression |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 186 | Overly Restrictive Regular Expression |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 187 | Partial String Comparison |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 188 | Reliance on Data/Memory Layout |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 189 | Numeric Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 190 | Integer Overflow or Wraparound |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 191 | Integer Underflow (Wrap or Wraparound) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 192 | Integer Coercion Error |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 193 | Off-by-one Error |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 194 | Unexpected Sign Extension |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 195 | Signed to Unsigned Conversion Error |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 196 | Unsigned to Signed Conversion Error |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 197 | Numeric Truncation Error |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 198 | Use of Incorrect Byte Ordering |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 199 | Information Management Errors |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 200 | Exposure of Sensitive Information to an Unauthorized Actor |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 201 | Insertion of Sensitive Information Into Sent Data |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 202 | Exposure of Sensitive Information Through Data Queries |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 203 | Observable Discrepancy |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 204 | Observable Response Discrepancy |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 205 | Observable Behavioral Discrepancy |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 206 | Observable Internal Behavioral Discrepancy |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 207 | Observable Behavioral Discrepancy With Equivalent Products |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 208 | Observable Timing Discrepancy |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 209 | Generation of Error Message Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 210 | Self-generated Error Message Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 211 | Externally-Generated Error Message Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 212 | Improper Removal of Sensitive Information Before Storage or Transfer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 213 | Exposure of Sensitive Information Due to Incompatible Policies |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 214 | Invocation of Process Using Visible Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 215 | Insertion of Sensitive Information Into Debugging Code |
| HasMember | Deprecated | 216 | DEPRECATED: Containment Errors (Container Errors) |
| HasMember | Deprecated | 217 | DEPRECATED: Failure to Protect Stored Data from Modification |
| HasMember | Deprecated | 218 | DEPRECATED: Failure to provide confidentiality for stored data |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 219 | Storage of File with Sensitive Data Under Web Root |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 220 | Storage of File With Sensitive Data Under FTP Root |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 221 | Information Loss or Omission |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 222 | Truncation of Security-relevant Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 223 | Omission of Security-relevant Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 224 | Obscured Security-relevant Information by Alternate Name |
| HasMember | Deprecated | 225 | DEPRECATED: General Information Management Problems |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 226 | Sensitive Information in Resource Not Removed Before Reuse |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 227 | 7PK - API Abuse |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 228 | Improper Handling of Syntactically Invalid Structure |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 229 | Improper Handling of Values |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 230 | Improper Handling of Missing Values |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 231 | Improper Handling of Extra Values |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 232 | Improper Handling of Undefined Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 233 | Improper Handling of Parameters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 234 | Failure to Handle Missing Parameter |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 235 | Improper Handling of Extra Parameters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 236 | Improper Handling of Undefined Parameters |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 237 | Improper Handling of Structural Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 238 | Improper Handling of Incomplete Structural Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 239 | Failure to Handle Incomplete Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 240 | Improper Handling of Inconsistent Structural Elements |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 241 | Improper Handling of Unexpected Data Type |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 242 | Use of Inherently Dangerous Function |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 243 | Creation of chroot Jail Without Changing Working Directory |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 244 | Improper Clearing of Heap Memory Before Release ('Heap Inspection') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 245 | J2EE Bad Practices: Direct Management of Connections |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 246 | J2EE Bad Practices: Direct Use of Sockets |
| HasMember | Deprecated | 247 | DEPRECATED: Reliance on DNS Lookups in a Security Decision |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 248 | Uncaught Exception |
| HasMember | Deprecated | 249 | DEPRECATED: Often Misused: Path Manipulation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 250 | Execution with Unnecessary Privileges |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 251 | Often Misused: String Management |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 252 | Unchecked Return Value |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 253 | Incorrect Check of Function Return Value |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 254 | 7PK - Security Features |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 255 | Credentials Management Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 256 | Plaintext Storage of a Password |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 257 | Storing Passwords in a Recoverable Format |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 258 | Empty Password in Configuration File |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 259 | Use of Hard-coded Password |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 260 | Password in Configuration File |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 261 | Weak Encoding for Password |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 262 | Not Using Password Aging |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 263 | Password Aging with Long Expiration |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 264 | Permissions, Privileges, and Access Controls |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 265 | Privilege Issues |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 266 | Incorrect Privilege Assignment |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 267 | Privilege Defined With Unsafe Actions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 268 | Privilege Chaining |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 269 | Improper Privilege Management |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 270 | Privilege Context Switching Error |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 271 | Privilege Dropping / Lowering Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 272 | Least Privilege Violation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 273 | Improper Check for Dropped Privileges |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 274 | Improper Handling of Insufficient Privileges |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 275 | Permission Issues |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 276 | Incorrect Default Permissions |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 277 | Insecure Inherited Permissions |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 278 | Insecure Preserved Inherited Permissions |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 279 | Incorrect Execution-Assigned Permissions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 280 | Improper Handling of Insufficient Permissions or Privileges |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 281 | Improper Preservation of Permissions |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 282 | Improper Ownership Management |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 283 | Unverified Ownership |
| HasMember |  Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 284 | Improper Access Control |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 285 | Improper Authorization |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 286 | Incorrect User Management |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 287 | Improper Authentication |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 288 | Authentication Bypass Using an Alternate Path or Channel |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 289 | Authentication Bypass by Alternate Name |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 290 | Authentication Bypass by Spoofing |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 291 | Reliance on IP Address for Authentication |
| HasMember | Deprecated | 292 | DEPRECATED: Trusting Self-reported DNS Name |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 293 | Using Referer Field for Authentication |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 294 | Authentication Bypass by Capture-replay |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 295 | Improper Certificate Validation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 296 | Improper Following of a Certificate's Chain of Trust |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 297 | Improper Validation of Certificate with Host Mismatch |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 298 | Improper Validation of Certificate Expiration |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 299 | Improper Check for Certificate Revocation |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 300 | Channel Accessible by Non-Endpoint |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 301 | Reflection Attack in an Authentication Protocol |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 302 | Authentication Bypass by Assumed-Immutable Data |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 303 | Incorrect Implementation of Authentication Algorithm |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 304 | Missing Critical Step in Authentication |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 305 | Authentication Bypass by Primary Weakness |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 306 | Missing Authentication for Critical Function |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 307 | Improper Restriction of Excessive Authentication Attempts |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 308 | Use of Single-factor Authentication |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 309 | Use of Password System for Primary Authentication |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 310 | Cryptographic Issues |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 311 | Missing Encryption of Sensitive Data |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 312 | Cleartext Storage of Sensitive Information |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 313 | Cleartext Storage in a File or on Disk |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 314 | Cleartext Storage in the Registry |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 315 | Cleartext Storage of Sensitive Information in a Cookie |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 316 | Cleartext Storage of Sensitive Information in Memory |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 317 | Cleartext Storage of Sensitive Information in GUI |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 318 | Cleartext Storage of Sensitive Information in Executable |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 319 | Cleartext Transmission of Sensitive Information |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 320 | Key Management Errors |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 321 | Use of Hard-coded Cryptographic Key |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 322 | Key Exchange without Entity Authentication |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 323 | Reusing a Nonce, Key Pair in Encryption |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 324 | Use of a Key Past its Expiration Date |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 325 | Missing Cryptographic Step |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 326 | Inadequate Encryption Strength |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 327 | Use of a Broken or Risky Cryptographic Algorithm |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 328 | Use of Weak Hash |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 329 | Generation of Predictable IV with CBC Mode |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 330 | Use of Insufficiently Random Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 331 | Insufficient Entropy |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 332 | Insufficient Entropy in PRNG |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 333 | Improper Handling of Insufficient Entropy in TRNG |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 334 | Small Space of Random Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 336 | Same Seed in Pseudo-Random Number Generator (PRNG) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 337 | Predictable Seed in Pseudo-Random Number Generator (PRNG) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 339 | Small Seed Space in PRNG |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 340 | Generation of Predictable Numbers or Identifiers |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 341 | Predictable from Observable State |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 342 | Predictable Exact Value from Previous Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 343 | Predictable Value Range from Previous Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 344 | Use of Invariant Value in Dynamically Changing Context |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 345 | Insufficient Verification of Data Authenticity |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 346 | Origin Validation Error |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 347 | Improper Verification of Cryptographic Signature |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 348 | Use of Less Trusted Source |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 349 | Acceptance of Extraneous Untrusted Data With Trusted Data |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 350 | Reliance on Reverse DNS Resolution for a Security-Critical Action |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 351 | Insufficient Type Distinction |
| HasMember | Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. | 352 | Cross-Site Request Forgery (CSRF) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 353 | Missing Support for Integrity Check |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 354 | Improper Validation of Integrity Check Value |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 355 | User Interface Security Issues |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 356 | Product UI does not Warn User of Unsafe Actions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 357 | Insufficient UI Warning of Dangerous Operations |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 358 | Improperly Implemented Security Check for Standard |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 359 | Exposure of Private Personal Information to an Unauthorized Actor |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 360 | Trust of System Event Data |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 361 | 7PK - Time and State |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 363 | Race Condition Enabling Link Following |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 364 | Signal Handler Race Condition |
| HasMember | Deprecated | 365 | DEPRECATED: Race Condition in Switch |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 366 | Race Condition within a Thread |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 367 | Time-of-check Time-of-use (TOCTOU) Race Condition |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 368 | Context Switching Race Condition |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 369 | Divide By Zero |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 370 | Missing Check for Certificate Revocation after Initial Check |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 371 | State Issues |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 372 | Incomplete Internal State Distinction |
| HasMember | Deprecated | 373 | DEPRECATED: State Synchronization Error |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 374 | Passing Mutable Objects to an Untrusted Method |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 375 | Returning a Mutable Object to an Untrusted Caller |
| HasMember | Deprecated | 376 | DEPRECATED: Temporary File Issues |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 377 | Insecure Temporary File |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 378 | Creation of Temporary File With Insecure Permissions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 379 | Creation of Temporary File in Directory with Insecure Permissions |
| HasMember | Deprecated | 380 | DEPRECATED: Technology-Specific Time and State Issues |
| HasMember | Deprecated | 381 | DEPRECATED: J2EE Time and State Issues |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 382 | J2EE Bad Practices: Use of System.exit() |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 383 | J2EE Bad Practices: Direct Use of Threads |
| HasMember | Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. | 384 | Session Fixation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 385 | Covert Timing Channel |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 386 | Symbolic Name not Mapping to Correct Object |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 387 | Signal Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 388 | 7PK - Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 389 | Error Conditions, Return Values, Status Codes |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 390 | Detection of Error Condition Without Action |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 391 | Unchecked Error Condition |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 392 | Missing Report of Error Condition |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 393 | Return of Wrong Status Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 394 | Unexpected Status Code or Return Value |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 395 | Use of NullPointerException Catch to Detect NULL Pointer Dereference |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 396 | Declaration of Catch for Generic Exception |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 397 | Declaration of Throws for Generic Exception |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 398 | 7PK - Code Quality |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 399 | Resource Management Errors |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 400 | Uncontrolled Resource Consumption |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 401 | Missing Release of Memory after Effective Lifetime |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 402 | Transmission of Private Resources into a New Sphere ('Resource Leak') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 403 | Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 404 | Improper Resource Shutdown or Release |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 405 | Asymmetric Resource Consumption (Amplification) |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 406 | Insufficient Control of Network Message Volume (Network Amplification) |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 407 | Inefficient Algorithmic Complexity |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 408 | Incorrect Behavior Order: Early Amplification |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 409 | Improper Handling of Highly Compressed Data (Data Amplification) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 410 | Insufficient Resource Pool |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 411 | Resource Locking Problems |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 412 | Unrestricted Externally Accessible Lock |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 413 | Improper Resource Locking |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 414 | Missing Lock Check |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 415 | Double Free |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 416 | Use After Free |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 417 | Communication Channel Errors |
| HasMember | Deprecated | 418 | DEPRECATED: Channel Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 419 | Unprotected Primary Channel |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 420 | Unprotected Alternate Channel |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 421 | Race Condition During Access to Alternate Channel |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 422 | Unprotected Windows Messaging Channel ('Shatter') |
| HasMember | Deprecated | 423 | DEPRECATED: Proxied Trusted Channel |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 424 | Improper Protection of Alternate Path |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 425 | Direct Request ('Forced Browsing') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 426 | Untrusted Search Path |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 427 | Uncontrolled Search Path Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 428 | Unquoted Search Path or Element |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 429 | Handler Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 430 | Deployment of Wrong Handler |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 431 | Missing Handler |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 432 | Dangerous Signal Handler not Disabled During Sensitive Operations |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 433 | Unparsed Raw Web Content Delivery |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 434 | Unrestricted Upload of File with Dangerous Type |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 435 | Improper Interaction Between Multiple Correctly-Behaving Entities |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 436 | Interpretation Conflict |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 437 | Incomplete Model of Endpoint Features |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 438 | Behavioral Problems |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 439 | Behavioral Change in New Version or Environment |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 440 | Expected Behavior Violation |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 441 | Unintended Proxy or Intermediary ('Confused Deputy') |
| HasMember | Deprecated | 442 | DEPRECATED: Web Problems |
| HasMember | Deprecated | 443 | DEPRECATED: HTTP response splitting |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| HasMember | Deprecated | 445 | DEPRECATED: User Interface Errors |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 446 | UI Discrepancy for Security Feature |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 447 | Unimplemented or Unsupported Feature in UI |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 448 | Obsolete Feature in UI |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 449 | The UI Performs the Wrong Action |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 450 | Multiple Interpretations of UI Input |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 451 | User Interface (UI) Misrepresentation of Critical Information |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 452 | Initialization and Cleanup Errors |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 453 | Insecure Default Variable Initialization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 454 | External Initialization of Trusted Variables or Data Stores |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 455 | Non-exit on Failed Initialization |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 456 | Missing Initialization of a Variable |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 457 | Use of Uninitialized Variable |
| HasMember | Deprecated | 458 | DEPRECATED: Incorrect Initialization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 459 | Incomplete Cleanup |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 460 | Improper Cleanup on Thrown Exception |
| HasMember | Deprecated | 461 | DEPRECATED: Data Structure Issues |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 462 | Duplicate Key in Associative List (Alist) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 463 | Deletion of Data Structure Sentinel |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 464 | Addition of Data Structure Sentinel |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 465 | Pointer Issues |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 466 | Return of Pointer Value Outside of Expected Range |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 467 | Use of sizeof() on a Pointer Type |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 468 | Incorrect Pointer Scaling |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 469 | Use of Pointer Subtraction to Determine Size |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 471 | Modification of Assumed-Immutable Data (MAID) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 472 | External Control of Assumed-Immutable Web Parameter |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 473 | PHP External Variable Modification |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 474 | Use of Function with Inconsistent Implementations |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 475 | Undefined Behavior for Input to API |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 476 | NULL Pointer Dereference |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 477 | Use of Obsolete Function |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 478 | Missing Default Case in Multiple Condition Expression |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 479 | Signal Handler Use of a Non-reentrant Function |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 480 | Use of Incorrect Operator |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 481 | Assigning instead of Comparing |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 482 | Comparing instead of Assigning |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 483 | Incorrect Block Delimitation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 484 | Omitted Break Statement in Switch |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 485 | 7PK - Encapsulation |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 486 | Comparison of Classes by Name |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 487 | Reliance on Package-level Scope |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 488 | Exposure of Data Element to Wrong Session |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 489 | Active Debug Code |
| HasMember | Deprecated | 490 | DEPRECATED: Mobile Code Issues |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 491 | Public cloneable() Method Without Final ('Object Hijack') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 492 | Use of Inner Class Containing Sensitive Data |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 493 | Critical Public Variable Without Final Modifier |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 494 | Download of Code Without Integrity Check |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 495 | Private Data Structure Returned From A Public Method |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 496 | Public Data Assigned to Private Array-Typed Field |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 498 | Cloneable Class Containing Sensitive Information |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 499 | Serializable Class Containing Sensitive Data |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 500 | Public Static Field Not Marked Final |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 501 | Trust Boundary Violation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 502 | Deserialization of Untrusted Data |
| HasMember | Deprecated | 503 | DEPRECATED: Byte/Object Code |
| HasMember | Deprecated | 504 | DEPRECATED: Motivation/Intent |
| HasMember | Deprecated | 505 | DEPRECATED: Intentionally Introduced Weakness |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 506 | Embedded Malicious Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 507 | Trojan Horse |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 508 | Non-Replicating Malicious Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 509 | Replicating Malicious Code (Virus or Worm) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 510 | Trapdoor |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 511 | Logic/Time Bomb |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 512 | Spyware |
| HasMember | Deprecated | 513 | DEPRECATED: Intentionally Introduced Nonmalicious Weakness |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 514 | Covert Channel |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 515 | Covert Storage Channel |
| HasMember | Deprecated | 516 | DEPRECATED: Covert Timing Channel |
| HasMember | Deprecated | 517 | DEPRECATED: Other Intentional, Nonmalicious Weakness |
| HasMember | Deprecated | 518 | DEPRECATED: Inadvertently Introduced Weakness |
| HasMember | Deprecated | 519 | DEPRECATED: .NET Environment Issues |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 520 | .NET Misconfiguration: Use of Impersonation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 521 | Weak Password Requirements |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 522 | Insufficiently Protected Credentials |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 523 | Unprotected Transport of Credentials |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 524 | Use of Cache Containing Sensitive Information |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 525 | Use of Web Browser Cache Containing Sensitive Information |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 526 | Cleartext Storage of Sensitive Information in an Environment Variable |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 528 | Exposure of Core Dump File to an Unauthorized Control Sphere |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 529 | Exposure of Access Control List Files to an Unauthorized Control Sphere |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 530 | Exposure of Backup File to an Unauthorized Control Sphere |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 531 | Inclusion of Sensitive Information in Test Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 532 | Insertion of Sensitive Information into Log File |
| HasMember | Deprecated | 533 | DEPRECATED: Information Exposure Through Server Log Files |
| HasMember | Deprecated | 534 | DEPRECATED: Information Exposure Through Debug Log Files |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 535 | Exposure of Information Through Shell Error Message |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 536 | Servlet Runtime Error Message Containing Sensitive Information |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 537 | Java Runtime Error Message Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 538 | Insertion of Sensitive Information into Externally-Accessible File or Directory |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 539 | Use of Persistent Cookies Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 540 | Inclusion of Sensitive Information in Source Code |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 541 | Inclusion of Sensitive Information in an Include File |
| HasMember | Deprecated | 542 | DEPRECATED: Information Exposure Through Cleanup Log Files |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 543 | Use of Singleton Pattern Without Synchronization in a Multithreaded Context |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 544 | Missing Standardized Error Handling Mechanism |
| HasMember | Deprecated | 545 | DEPRECATED: Use of Dynamic Class Loading |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 546 | Suspicious Comment |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 547 | Use of Hard-coded, Security-relevant Constants |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 548 | Exposure of Information Through Directory Listing |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 549 | Missing Password Field Masking |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 550 | Server-generated Error Message Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 552 | Files or Directories Accessible to External Parties |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 553 | Command Shell in Externally Accessible Directory |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 554 | ASP.NET Misconfiguration: Not Using Input Validation Framework |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 555 | J2EE Misconfiguration: Plaintext Password in Configuration File |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 556 | ASP.NET Misconfiguration: Use of Identity Impersonation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 557 | Concurrency Issues |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 558 | Use of getlogin() in Multithreaded Application |
| HasMember | Deprecated | 559 | DEPRECATED: Often Misused: Arguments and Parameters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 560 | Use of umask() with chmod-style Argument |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 561 | Dead Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 562 | Return of Stack Variable Address |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 563 | Assignment to Variable without Use |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 564 | SQL Injection: Hibernate |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 565 | Reliance on Cookies without Validation and Integrity Checking |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 566 | Authorization Bypass Through User-Controlled SQL Primary Key |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 567 | Unsynchronized Access to Shared Data in a Multithreaded Context |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 568 | finalize() Method Without super.finalize() |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 569 | Expression Issues |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 570 | Expression is Always False |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 571 | Expression is Always True |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 572 | Call to Thread run() instead of start() |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 573 | Improper Following of Specification by Caller |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 574 | EJB Bad Practices: Use of Synchronization Primitives |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 575 | EJB Bad Practices: Use of AWT Swing |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 576 | EJB Bad Practices: Use of Java I/O |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 577 | EJB Bad Practices: Use of Sockets |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 578 | EJB Bad Practices: Use of Class Loader |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 579 | J2EE Bad Practices: Non-serializable Object Stored in Session |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 580 | clone() Method Without super.clone() |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 581 | Object Model Violation: Just One of Equals and Hashcode Defined |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 582 | Array Declared Public, Final, and Static |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 583 | finalize() Method Declared Public |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 584 | Return Inside Finally Block |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 585 | Empty Synchronized Block |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 586 | Explicit Call to Finalize() |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 587 | Assignment of a Fixed Address to a Pointer |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 588 | Attempt to Access Child of a Non-structure Pointer |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 589 | Call to Non-ubiquitous API |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 590 | Free of Memory not on the Heap |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 591 | Sensitive Data Storage in Improperly Locked Memory |
| HasMember | Deprecated | 592 | DEPRECATED: Authentication Bypass Issues |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 593 | Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 594 | J2EE Framework: Saving Unserializable Objects to Disk |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 595 | Comparison of Object References Instead of Object Contents |
| HasMember | Deprecated | 596 | DEPRECATED: Incorrect Semantic Object Comparison |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 597 | Use of Wrong Operator in String Comparison |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 598 | Use of GET Request Method With Sensitive Query Strings |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 599 | Missing Validation of OpenSSL Certificate |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 600 | Uncaught Exception in Servlet |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 601 | URL Redirection to Untrusted Site ('Open Redirect') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 602 | Client-Side Enforcement of Server-Side Security |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 603 | Use of Client-Side Authentication |
| HasMember |  View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 604 | Deprecated Entries |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 605 | Multiple Binds to the Same Port |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 606 | Unchecked Input for Loop Condition |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 607 | Public Static Final Field References Mutable Object |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 608 | Struts: Non-private Field in ActionForm Class |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 609 | Double-Checked Locking |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 610 | Externally Controlled Reference to a Resource in Another Sphere |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 611 | Improper Restriction of XML External Entity Reference |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 612 | Improper Authorization of Index Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 613 | Insufficient Session Expiration |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 615 | Inclusion of Sensitive Information in Source Code Comments |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 616 | Incomplete Identification of Uploaded File Variables (PHP) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 617 | Reachable Assertion |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 618 | Exposed Unsafe ActiveX Method |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 619 | Dangling Database Cursor ('Cursor Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 620 | Unverified Password Change |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 621 | Variable Extraction Error |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 622 | Improper Validation of Function Hook Arguments |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 623 | Unsafe ActiveX Control Marked Safe For Scripting |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 624 | Executable Regular Expression Error |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 625 | Permissive Regular Expression |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 626 | Null Byte Interaction Error (Poison Null Byte) |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 627 | Dynamic Variable Evaluation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 628 | Function Call with Incorrectly Specified Arguments |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 629 | Weaknesses in OWASP Top Ten (2007) |
| HasMember | Deprecated | 630 | DEPRECATED: Weaknesses Examined by SAMATE |
| HasMember | Deprecated | 631 | DEPRECATED: Resource-specific Weaknesses |
| HasMember | Deprecated | 632 | DEPRECATED: Weaknesses that Affect Files or Directories |
| HasMember | Deprecated | 633 | DEPRECATED: Weaknesses that Affect Memory |
| HasMember | Deprecated | 634 | DEPRECATED: Weaknesses that Affect System Processes |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 635 | Weaknesses Originally Used by NVD from 2008 to 2016 |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 636 | Not Failing Securely ('Failing Open') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 638 | Not Using Complete Mediation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 639 | Authorization Bypass Through User-Controlled Key |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 640 | Weak Password Recovery Mechanism for Forgotten Password |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 641 | Improper Restriction of Names for Files and Other Resources |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 642 | External Control of Critical State Data |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 644 | Improper Neutralization of HTTP Headers for Scripting Syntax |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 645 | Overly Restrictive Account Lockout Mechanism |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 646 | Reliance on File Name or Extension of Externally-Supplied File |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 647 | Use of Non-Canonical URL Paths for Authorization Decisions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 648 | Incorrect Use of Privileged APIs |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 649 | Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 650 | Trusting HTTP Permission Methods on the Server Side |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 651 | Exposure of WSDL File Containing Sensitive Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 652 | Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 653 | Improper Isolation or Compartmentalization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 654 | Reliance on a Single Factor in a Security Decision |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 655 | Insufficient Psychological Acceptability |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 656 | Reliance on Security Through Obscurity |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 657 | Violation of Secure Design Principles |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 658 | Weaknesses in Software Written in C |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 659 | Weaknesses in Software Written in C++ |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 660 | Weaknesses in Software Written in Java |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 661 | Weaknesses in Software Written in PHP |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 662 | Improper Synchronization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 663 | Use of a Non-reentrant Function in a Concurrent Context |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 664 | Improper Control of a Resource Through its Lifetime |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 665 | Improper Initialization |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 666 | Operation on Resource in Wrong Phase of Lifetime |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 667 | Improper Locking |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 668 | Exposure of Resource to Wrong Sphere |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 669 | Incorrect Resource Transfer Between Spheres |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 670 | Always-Incorrect Control Flow Implementation |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 671 | Lack of Administrator Control over Security |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 672 | Operation on a Resource after Expiration or Release |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 673 | External Influence of Sphere Definition |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 674 | Uncontrolled Recursion |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 675 | Multiple Operations on Resource in Single-Operation Context |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 676 | Use of Potentially Dangerous Function |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 677 | Weakness Base Elements |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 678 | Composites |
| HasMember | Deprecated | 679 | DEPRECATED: Chain Elements |
| HasMember |  Chain - a Compound Element that is a sequence of two or more separate weaknesses that can be closely linked together within software. One weakness, X, can directly create the conditions that are necessary to cause another weakness, Y, to enter a vulnerable condition. When this happens, CWE refers to X as "primary" to Y, and Y is "resultant" from X. Chains can involve more than two weaknesses, and in some cases, they might have a tree-like structure. | 680 | Integer Overflow to Buffer Overflow |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 681 | Incorrect Conversion between Numeric Types |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 682 | Incorrect Calculation |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 683 | Function Call With Incorrect Order of Arguments |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 684 | Incorrect Provision of Specified Functionality |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 685 | Function Call With Incorrect Number of Arguments |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 686 | Function Call With Incorrect Argument Type |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 687 | Function Call With Incorrectly Specified Argument Value |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 688 | Function Call With Incorrect Variable or Reference as Argument |
| HasMember | Composite - a Compound Element that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk. One weakness, X, can be "broken down" into component weaknesses Y and Z. There can be cases in which one weakness might not be essential to a composite, but changes the nature of the composite when it becomes a vulnerability. | 689 | Permission Race Condition During Resource Copy |
| HasMember | Chain - a Compound Element that is a sequence of two or more separate weaknesses that can be closely linked together within software. One weakness, X, can directly create the conditions that are necessary to cause another weakness, Y, to enter a vulnerable condition. When this happens, CWE refers to X as "primary" to Y, and Y is "resultant" from X. Chains can involve more than two weaknesses, and in some cases, they might have a tree-like structure. | 690 | Unchecked Return Value to NULL Pointer Dereference |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 691 | Insufficient Control Flow Management |
| HasMember | Chain - a Compound Element that is a sequence of two or more separate weaknesses that can be closely linked together within software. One weakness, X, can directly create the conditions that are necessary to cause another weakness, Y, to enter a vulnerable condition. When this happens, CWE refers to X as "primary" to Y, and Y is "resultant" from X. Chains can involve more than two weaknesses, and in some cases, they might have a tree-like structure. | 692 | Incomplete Denylist to Cross-Site Scripting |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 693 | Protection Mechanism Failure |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 694 | Use of Multiple Resources with Duplicate Identifier |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 695 | Use of Low-Level Functionality |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 696 | Incorrect Behavior Order |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 697 | Incorrect Comparison |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 698 | Execution After Redirect (EAR) |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 699 | Software Development |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 700 | Seven Pernicious Kingdoms |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 701 | Weaknesses Introduced During Design |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 702 | Weaknesses Introduced During Implementation |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 703 | Improper Check or Handling of Exceptional Conditions |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 704 | Incorrect Type Conversion or Cast |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 705 | Incorrect Control Flow Scoping |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 706 | Use of Incorrectly-Resolved Name or Reference |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 707 | Improper Neutralization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 708 | Incorrect Ownership Assignment |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 709 | Named Chains |
| HasMember | Pillar - a weakness that is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. | 710 | Improper Adherence to Coding Standards |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 711 | Weaknesses in OWASP Top Ten (2004) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 712 | OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 713 | OWASP Top Ten 2007 Category A2 - Injection Flaws |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 714 | OWASP Top Ten 2007 Category A3 - Malicious File Execution |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 715 | OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 716 | OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 717 | OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 718 | OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 719 | OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 720 | OWASP Top Ten 2007 Category A9 - Insecure Communications |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 721 | OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 722 | OWASP Top Ten 2004 Category A1 - Unvalidated Input |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 723 | OWASP Top Ten 2004 Category A2 - Broken Access Control |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 724 | OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 725 | OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 726 | OWASP Top Ten 2004 Category A5 - Buffer Overflows |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 727 | OWASP Top Ten 2004 Category A6 - Injection Flaws |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 728 | OWASP Top Ten 2004 Category A7 - Improper Error Handling |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 729 | OWASP Top Ten 2004 Category A8 - Insecure Storage |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 730 | OWASP Top Ten 2004 Category A9 - Denial of Service |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 731 | OWASP Top Ten 2004 Category A10 - Insecure Configuration Management |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 732 | Incorrect Permission Assignment for Critical Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 733 | Compiler Optimization Removal or Modification of Security-critical Code |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 734 | Weaknesses Addressed by the CERT C Secure Coding Standard (2008) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 735 | CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 736 | CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 737 | CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 738 | CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 739 | CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 740 | CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 741 | CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 742 | CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 743 | CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 744 | CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 745 | CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 746 | CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 747 | CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 748 | CERT C Secure Coding Standard (2008) Appendix - POSIX (POS) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 749 | Exposed Dangerous Method or Function |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 750 | Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 751 | 2009 Top 25 - Insecure Interaction Between Components |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 752 | 2009 Top 25 - Risky Resource Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 753 | 2009 Top 25 - Porous Defenses |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 754 | Improper Check for Unusual or Exceptional Conditions |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 755 | Improper Handling of Exceptional Conditions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 756 | Missing Custom Error Page |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 757 | Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 759 | Use of a One-Way Hash without a Salt |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 760 | Use of a One-Way Hash with a Predictable Salt |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 761 | Free of Pointer not at Start of Buffer |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 762 | Mismatched Memory Management Routines |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 763 | Release of Invalid Pointer or Reference |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 764 | Multiple Locks of a Critical Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 765 | Multiple Unlocks of a Critical Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 766 | Critical Data Element Declared Public |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 767 | Access to Critical Private Variable via Public Method |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 768 | Incorrect Short Circuit Evaluation |
| HasMember | Deprecated | 769 | DEPRECATED: Uncontrolled File Descriptor Consumption |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 770 | Allocation of Resources Without Limits or Throttling |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 771 | Missing Reference to Active Allocated Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 772 | Missing Release of Resource after Effective Lifetime |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 773 | Missing Reference to Active File Descriptor or Handle |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 774 | Allocation of File Descriptors or Handles Without Limits or Throttling |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 775 | Missing Release of File Descriptor or Handle after Effective Lifetime |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 777 | Regular Expression without Anchors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 778 | Insufficient Logging |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 779 | Logging of Excessive Data |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 780 | Use of RSA Algorithm without OAEP |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 781 | Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 782 | Exposed IOCTL with Insufficient Access Control |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 783 | Operator Precedence Logic Error |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 785 | Use of Path Manipulation Function without Maximum-sized Buffer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 786 | Access of Memory Location Before Start of Buffer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 787 | Out-of-bounds Write |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 788 | Access of Memory Location After End of Buffer |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 789 | Memory Allocation with Excessive Size Value |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 790 | Improper Filtering of Special Elements |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 791 | Incomplete Filtering of Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 792 | Incomplete Filtering of One or More Instances of Special Elements |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 793 | Only Filtering One Instance of a Special Element |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 794 | Incomplete Filtering of Multiple Instances of Special Elements |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 795 | Only Filtering Special Elements at a Specified Location |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 796 | Only Filtering Special Elements Relative to a Marker |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 797 | Only Filtering Special Elements at an Absolute Position |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 798 | Use of Hard-coded Credentials |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 799 | Improper Control of Interaction Frequency |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 800 | Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 801 | 2010 Top 25 - Insecure Interaction Between Components |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 802 | 2010 Top 25 - Risky Resource Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 803 | 2010 Top 25 - Porous Defenses |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 804 | Guessable CAPTCHA |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 805 | Buffer Access with Incorrect Length Value |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 806 | Buffer Access Using Size of Source Buffer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 807 | Reliance on Untrusted Inputs in a Security Decision |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 808 | 2010 Top 25 - Weaknesses On the Cusp |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 809 | Weaknesses in OWASP Top Ten (2010) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 810 | OWASP Top Ten 2010 Category A1 - Injection |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 811 | OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 812 | OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 813 | OWASP Top Ten 2010 Category A4 - Insecure Direct Object References |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 814 | OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 815 | OWASP Top Ten 2010 Category A6 - Security Misconfiguration |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 816 | OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 817 | OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 818 | OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 819 | OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 820 | Missing Synchronization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 821 | Incorrect Synchronization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 822 | Untrusted Pointer Dereference |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 823 | Use of Out-of-range Pointer Offset |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 824 | Access of Uninitialized Pointer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 825 | Expired Pointer Dereference |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 826 | Premature Release of Resource During Expected Lifetime |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 827 | Improper Control of Document Type Definition |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 828 | Signal Handler with Functionality that is not Asynchronous-Safe |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 829 | Inclusion of Functionality from Untrusted Control Sphere |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 830 | Inclusion of Web Functionality from an Untrusted Source |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 831 | Signal Handler Function Associated with Multiple Signals |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 832 | Unlock of a Resource that is not Locked |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 833 | Deadlock |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 834 | Excessive Iteration |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 835 | Loop with Unreachable Exit Condition ('Infinite Loop') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 836 | Use of Password Hash Instead of Password for Authentication |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 837 | Improper Enforcement of a Single, Unique Action |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 838 | Inappropriate Encoding for Output Context |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 839 | Numeric Range Comparison Without Minimum Check |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 840 | Business Logic Errors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 841 | Improper Enforcement of Behavioral Workflow |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 842 | Placement of User into Incorrect Group |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 843 | Access of Resource Using Incompatible Type ('Type Confusion') |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 844 | Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 845 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 846 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 847 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 848 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 849 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 850 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 851 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 852 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 853 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 854 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 855 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 856 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 13 - Thread-Safety Miscellaneous (TSM) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 857 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 858 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 859 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 860 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 861 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC) |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 862 | Missing Authorization |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 863 | Incorrect Authorization |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 864 | 2011 Top 25 - Insecure Interaction Between Components |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 865 | 2011 Top 25 - Risky Resource Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 866 | 2011 Top 25 - Porous Defenses |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 867 | 2011 Top 25 - Weaknesses On the Cusp |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 868 | Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 869 | CERT C++ Secure Coding Section 01 - Preprocessor (PRE) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 870 | CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 871 | CERT C++ Secure Coding Section 03 - Expressions (EXP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 872 | CERT C++ Secure Coding Section 04 - Integers (INT) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 873 | CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 874 | CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 875 | CERT C++ Secure Coding Section 07 - Characters and Strings (STR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 876 | CERT C++ Secure Coding Section 08 - Memory Management (MEM) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 877 | CERT C++ Secure Coding Section 09 - Input Output (FIO) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 878 | CERT C++ Secure Coding Section 10 - Environment (ENV) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 879 | CERT C++ Secure Coding Section 11 - Signals (SIG) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 880 | CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 881 | CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 882 | CERT C++ Secure Coding Section 14 - Concurrency (CON) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 883 | CERT C++ Secure Coding Section 49 - Miscellaneous (MSC) |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 884 | CWE Cross-section |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 885 | SFP Primary Cluster: Risky Values |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 886 | SFP Primary Cluster: Unused entities |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 887 | SFP Primary Cluster: API |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 888 | Software Fault Pattern (SFP) Clusters |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 889 | SFP Primary Cluster: Exception Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 890 | SFP Primary Cluster: Memory Access |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 891 | SFP Primary Cluster: Memory Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 892 | SFP Primary Cluster: Resource Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 893 | SFP Primary Cluster: Path Resolution |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 894 | SFP Primary Cluster: Synchronization |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 895 | SFP Primary Cluster: Information Leak |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 896 | SFP Primary Cluster: Tainted Input |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 897 | SFP Primary Cluster: Entry Points |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 898 | SFP Primary Cluster: Authentication |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 899 | SFP Primary Cluster: Access Control |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 900 | Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 901 | SFP Primary Cluster: Privilege |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 902 | SFP Primary Cluster: Channel |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 903 | SFP Primary Cluster: Cryptography |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 904 | SFP Primary Cluster: Malware |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 905 | SFP Primary Cluster: Predictability |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 906 | SFP Primary Cluster: UI |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 907 | SFP Primary Cluster: Other |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 908 | Use of Uninitialized Resource |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 909 | Missing Initialization of Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 910 | Use of Expired File Descriptor |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 911 | Improper Update of Reference Count |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 912 | Hidden Functionality |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 913 | Improper Control of Dynamically-Managed Code Resources |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 914 | Improper Control of Dynamically-Identified Variables |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 916 | Use of Password Hash With Insufficient Computational Effort |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 918 | Server-Side Request Forgery (SSRF) |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 919 | Weaknesses in Mobile Applications |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 920 | Improper Restriction of Power Consumption |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 921 | Storage of Sensitive Data in a Mechanism without Access Control |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 922 | Insecure Storage of Sensitive Information |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 923 | Improper Restriction of Communication Channel to Intended Endpoints |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 924 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 925 | Improper Verification of Intent by Broadcast Receiver |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 926 | Improper Export of Android Application Components |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 927 | Use of Implicit Intent for Sensitive Communication |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 928 | Weaknesses in OWASP Top Ten (2013) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 929 | OWASP Top Ten 2013 Category A1 - Injection |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 930 | OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 931 | OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 932 | OWASP Top Ten 2013 Category A4 - Insecure Direct Object References |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 933 | OWASP Top Ten 2013 Category A5 - Security Misconfiguration |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 934 | OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 935 | OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 936 | OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 937 | OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 938 | OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 939 | Improper Authorization in Handler for Custom URL Scheme |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 940 | Improper Verification of Source of a Communication Channel |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 941 | Incorrectly Specified Destination in a Communication Channel |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 942 | Permissive Cross-domain Policy with Untrusted Domains |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 943 | Improper Neutralization of Special Elements in Data Query Logic |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 944 | SFP Secondary Cluster: Access Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 945 | SFP Secondary Cluster: Insecure Resource Access |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 946 | SFP Secondary Cluster: Insecure Resource Permissions |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 947 | SFP Secondary Cluster: Authentication Bypass |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 948 | SFP Secondary Cluster: Digital Certificate |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 949 | SFP Secondary Cluster: Faulty Endpoint Authentication |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 950 | SFP Secondary Cluster: Hardcoded Sensitive Data |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 951 | SFP Secondary Cluster: Insecure Authentication Policy |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 952 | SFP Secondary Cluster: Missing Authentication |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 953 | SFP Secondary Cluster: Missing Endpoint Authentication |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 954 | SFP Secondary Cluster: Multiple Binds to the Same Port |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 955 | SFP Secondary Cluster: Unrestricted Authentication |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 956 | SFP Secondary Cluster: Channel Attack |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 957 | SFP Secondary Cluster: Protocol Error |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 958 | SFP Secondary Cluster: Broken Cryptography |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 959 | SFP Secondary Cluster: Weak Cryptography |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 960 | SFP Secondary Cluster: Ambiguous Exception Type |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 961 | SFP Secondary Cluster: Incorrect Exception Behavior |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 962 | SFP Secondary Cluster: Unchecked Status Condition |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 963 | SFP Secondary Cluster: Exposed Data |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 964 | SFP Secondary Cluster: Exposure Temporary File |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 965 | SFP Secondary Cluster: Insecure Session Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 966 | SFP Secondary Cluster: Other Exposures |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 967 | SFP Secondary Cluster: State Disclosure |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 968 | SFP Secondary Cluster: Covert Channel |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 969 | SFP Secondary Cluster: Faulty Memory Release |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 970 | SFP Secondary Cluster: Faulty Buffer Access |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 971 | SFP Secondary Cluster: Faulty Pointer Use |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 972 | SFP Secondary Cluster: Faulty String Expansion |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 973 | SFP Secondary Cluster: Improper NULL Termination |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 974 | SFP Secondary Cluster: Incorrect Buffer Length Computation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 975 | SFP Secondary Cluster: Architecture |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 976 | SFP Secondary Cluster: Compiler |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 977 | SFP Secondary Cluster: Design |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 978 | SFP Secondary Cluster: Implementation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 979 | SFP Secondary Cluster: Failed Chroot Jail |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 980 | SFP Secondary Cluster: Link in Resource Name Resolution |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 981 | SFP Secondary Cluster: Path Traversal |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 982 | SFP Secondary Cluster: Failure to Release Resource |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 983 | SFP Secondary Cluster: Faulty Resource Use |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 984 | SFP Secondary Cluster: Life Cycle |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 985 | SFP Secondary Cluster: Unrestricted Consumption |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 986 | SFP Secondary Cluster: Missing Lock |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 987 | SFP Secondary Cluster: Multiple Locks/Unlocks |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 988 | SFP Secondary Cluster: Race Condition Window |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 989 | SFP Secondary Cluster: Unrestricted Lock |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 990 | SFP Secondary Cluster: Tainted Input to Command |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 991 | SFP Secondary Cluster: Tainted Input to Environment |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 992 | SFP Secondary Cluster: Faulty Input Transformation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 993 | SFP Secondary Cluster: Incorrect Input Handling |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 994 | SFP Secondary Cluster: Tainted Input to Variable |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 995 | SFP Secondary Cluster: Feature |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 996 | SFP Secondary Cluster: Security |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 997 | SFP Secondary Cluster: Information Loss |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 998 | SFP Secondary Cluster: Glitch in Computation |
| HasMember | Deprecated | 999 | DEPRECATED: Weaknesses without Software Fault Patterns |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1000 | Research Concepts |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1001 | SFP Secondary Cluster: Use of an Improper API |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1002 | SFP Secondary Cluster: Unexpected Entry Points |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1003 | Weaknesses for Simplified Mapping of Published Vulnerabilities |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1004 | Sensitive Cookie Without 'HttpOnly' Flag |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1005 | 7PK - Input Validation and Representation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1006 | Bad Coding Practices |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1007 | Insufficient Visual Distinction of Homoglyphs Presented to User |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1008 | Architectural Concepts |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1009 | Audit |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1010 | Authenticate Actors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1011 | Authorize Actors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1012 | Cross Cutting |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1013 | Encrypt Data |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1014 | Identify Actors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1015 | Limit Access |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1016 | Limit Exposure |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1017 | Lock Computer |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1018 | Manage User Sessions |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1019 | Validate Inputs |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1020 | Verify Message Integrity |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1021 | Improper Restriction of Rendered UI Layers or Frames |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1022 | Use of Web Link to Untrusted Target with window.opener Access |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1023 | Incomplete Comparison with Missing Factors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1024 | Comparison of Incompatible Types |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1025 | Comparison Using Wrong Factors |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1026 | Weaknesses in OWASP Top Ten (2017) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1027 | OWASP Top Ten 2017 Category A1 - Injection |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1028 | OWASP Top Ten 2017 Category A2 - Broken Authentication |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1029 | OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1030 | OWASP Top Ten 2017 Category A4 - XML External Entities (XXE) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1031 | OWASP Top Ten 2017 Category A5 - Broken Access Control |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1032 | OWASP Top Ten 2017 Category A6 - Security Misconfiguration |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1033 | OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1034 | OWASP Top Ten 2017 Category A8 - Insecure Deserialization |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1035 | OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1036 | OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1037 | Processor Optimization Removal or Modification of Security-critical Code |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1038 | Insecure Automated Optimizations |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1039 | Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1040 | Quality Weaknesses with Indirect Security Impacts |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1041 | Use of Redundant Code |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1042 | Static Member Data Element outside of a Singleton Class Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1043 | Data Element Aggregating an Excessively Large Number of Non-Primitive Elements |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1044 | Architecture with Number of Horizontal Layers Outside of Expected Range |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1045 | Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1046 | Creation of Immutable Text Using String Concatenation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1047 | Modules with Circular Dependencies |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1048 | Invokable Control Element with Large Number of Outward Calls |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1049 | Excessive Data Query Operations in a Large Data Table |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1050 | Excessive Platform Resource Consumption within a Loop |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1051 | Initialization with Hard-Coded Network Resource Configuration Data |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1052 | Excessive Use of Hard-Coded Literals in Initialization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1053 | Missing Documentation for Design |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1054 | Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1055 | Multiple Inheritance from Concrete Classes |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1056 | Invokable Control Element with Variadic Parameters |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1057 | Data Access Operations Outside of Expected Data Manager Component |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1058 | Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1059 | Insufficient Technical Documentation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1060 | Excessive Number of Inefficient Server-Side Data Accesses |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1061 | Insufficient Encapsulation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1062 | Parent Class with References to Child Class |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1063 | Creation of Class Instance within a Static Code Block |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1064 | Invokable Control Element with Signature Containing an Excessive Number of Parameters |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1065 | Runtime Resource Management Control Element in a Component Built to Run on Application Servers |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1066 | Missing Serialization Control Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1067 | Excessive Execution of Sequential Searches of Data Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1068 | Inconsistency Between Implementation and Documented Design |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1069 | Empty Exception Block |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1070 | Serializable Data Element Containing non-Serializable Item Elements |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1071 | Empty Code Block |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1072 | Data Resource Access without Use of Connection Pooling |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1073 | Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1074 | Class with Excessively Deep Inheritance |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1075 | Unconditional Control Flow Transfer outside of Switch Block |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1076 | Insufficient Adherence to Expected Conventions |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1077 | Floating Point Comparison with Incorrect Operator |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1078 | Inappropriate Source Code Style or Formatting |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1079 | Parent Class without Virtual Destructor Method |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1080 | Source Code File with Excessive Number of Lines of Code |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1081 | Entries with Maintenance Notes |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1082 | Class Instance Self Destruction Control Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1083 | Data Access from Outside Expected Data Manager Component |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1084 | Invokable Control Element with Excessive File or Data Access Operations |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1085 | Invokable Control Element with Excessive Volume of Commented-out Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1086 | Class with Excessive Number of Child Classes |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1087 | Class with Virtual Method without a Virtual Destructor |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1088 | Synchronous Access of Remote Resource without Timeout |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1089 | Large Data Table with Excessive Number of Indices |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1090 | Method Containing Access of a Member Element from Another Class |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1091 | Use of Object without Invoking Destructor Method |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1092 | Use of Same Invokable Control Element in Multiple Architectural Layers |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1093 | Excessively Complex Data Representation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1094 | Excessive Index Range Scan for a Data Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1095 | Loop Condition Value Update within the Loop |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1096 | Singleton Class Instance Creation without Proper Locking or Synchronization |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1097 | Persistent Storable Data Element without Associated Comparison Control Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1098 | Data Element containing Pointer Item without Proper Copy Control Element |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1099 | Inconsistent Naming Conventions for Identifiers |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1100 | Insufficient Isolation of System-Dependent Functions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1101 | Reliance on Runtime Component in Generated Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1102 | Reliance on Machine-Dependent Data Representation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1103 | Use of Platform-Dependent Third Party Components |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1104 | Use of Unmaintained Third Party Components |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1105 | Insufficient Encapsulation of Machine-Dependent Functionality |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1106 | Insufficient Use of Symbolic Constants |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1107 | Insufficient Isolation of Symbolic Constant Definitions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1108 | Excessive Reliance on Global Variables |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1109 | Use of Same Variable for Multiple Purposes |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1110 | Incomplete Design Documentation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1111 | Incomplete I/O Documentation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1112 | Incomplete Documentation of Program Execution |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1113 | Inappropriate Comment Style |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1114 | Inappropriate Whitespace Style |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1115 | Source Code Element without Standard Prologue |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1116 | Inaccurate Comments |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1117 | Callable with Insufficient Behavioral Summary |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1118 | Insufficient Documentation of Error Handling Techniques |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1119 | Excessive Use of Unconditional Branching |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1120 | Excessive Code Complexity |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1121 | Excessive McCabe Cyclomatic Complexity |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1122 | Excessive Halstead Complexity |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1123 | Excessive Use of Self-Modifying Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1124 | Excessively Deep Nesting |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1125 | Excessive Attack Surface |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1126 | Declaration of Variable with Unnecessarily Wide Scope |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1127 | Compilation with Insufficient Warnings or Errors |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1128 | CISQ Quality Measures (2016) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1129 | CISQ Quality Measures (2016) - Reliability |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1130 | CISQ Quality Measures (2016) - Maintainability |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1131 | CISQ Quality Measures (2016) - Security |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1132 | CISQ Quality Measures (2016) - Performance Efficiency |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1133 | Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1134 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1135 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1136 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1137 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1138 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1139 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1140 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1141 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1142 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1143 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1144 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1145 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1146 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1147 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1148 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1149 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1150 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1151 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1152 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1153 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD) |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1154 | Weaknesses Addressed by the SEI CERT C Coding Standard |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1155 | SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1156 | SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1157 | SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1158 | SEI CERT C Coding Standard - Guidelines 04. Integers (INT) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1159 | SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1160 | SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1161 | SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1162 | SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1163 | SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO) |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1164 | Irrelevant Code |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1165 | SEI CERT C Coding Standard - Guidelines 10. Environment (ENV) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1166 | SEI CERT C Coding Standard - Guidelines 11. Signals (SIG) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1167 | SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1168 | SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1169 | SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1170 | SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1171 | SEI CERT C Coding Standard - Guidelines 50. POSIX (POS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1172 | SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1173 | Improper Use of Validation Framework |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1174 | ASP.NET Misconfiguration: Improper Model Validation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1175 | SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON) |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1176 | Inefficient CPU Computation |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1177 | Use of Prohibited Code |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1178 | Weaknesses Addressed by the SEI CERT Perl Coding Standard |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1179 | SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1180 | SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1181 | SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1182 | SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1183 | SEI CERT Perl Coding Standard - Guidelines 05. Strings (STR) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1184 | SEI CERT Perl Coding Standard - Guidelines 06. Object-Oriented Programming (OOP) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1185 | SEI CERT Perl Coding Standard - Guidelines 07. File Input and Output (FIO) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1186 | SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC) |
| HasMember | Deprecated | 1187 | DEPRECATED: Use of Uninitialized Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1188 | Initialization of a Resource with an Insecure Default |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1190 | DMA Device Enabled Too Early in Boot Phase |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1191 | On-Chip Debug and Test Interface With Improper Access Control |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1192 | Improper Identifier for IP Block used in System-On-Chip (SOC) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1193 | Power-On of Untrusted Execution Core Before Enabling Fabric Access Control |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1194 | Hardware Design |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1195 | Manufacturing and Life Cycle Management Concerns |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1196 | Security Flow Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1197 | Integration Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1198 | Privilege Separation and Access Control Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1199 | General Circuit and Logic Design Concerns |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1200 | Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1201 | Core and Compute Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1202 | Memory and Storage Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1203 | Peripherals, On-chip Fabric, and Interface/IO Problems |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1204 | Generation of Weak Initialization Vector (IV) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1205 | Security Primitives and Cryptography Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1206 | Power, Clock, Thermal, and Reset Concerns |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1207 | Debug and Test Problems |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1208 | Cross-Cutting Problems |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1209 | Failure to Disable Reserved Bits |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1210 | Audit / Logging Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1211 | Authentication Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1212 | Authorization Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1213 | Random Number Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1214 | Data Integrity Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1215 | Data Validation Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1216 | Lockout Mechanism Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1217 | User Session Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1218 | Memory Buffer Errors |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1219 | File Handling Issues |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1220 | Insufficient Granularity of Access Control |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1221 | Incorrect Register Defaults or Module Parameters |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1222 | Insufficient Granularity of Address Regions Protected by Register Locks |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1223 | Race Condition for Write-Once Attributes |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1224 | Improper Restriction of Write-Once Bit Fields |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1225 | Documentation Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1226 | Complexity Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1227 | Encapsulation Issues |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1228 | API / Function Errors |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1229 | Creation of Emergent Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1230 | Exposure of Sensitive Information Through Metadata |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1231 | Improper Prevention of Lock Bit Modification |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1232 | Improper Lock Behavior After Power State Transition |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1234 | Hardware Internal or Debug Modes Allow Override of Locks |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1235 | Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1236 | Improper Neutralization of Formula Elements in a CSV File |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1237 | SFP Primary Cluster: Faulty Resource Release |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1238 | SFP Primary Cluster: Failure to Release Memory |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1239 | Improper Zeroization of Hardware Register |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1240 | Use of a Cryptographic Primitive with a Risky Implementation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1241 | Use of Predictable Algorithm in Random Number Generator |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1242 | Inclusion of Undocumented Features or Chicken Bits |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1243 | Sensitive Non-Volatile Information Not Protected During Debug |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1244 | Internal Asset Exposed to Unsafe Debug Access Level or State |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1245 | Improper Finite State Machines (FSMs) in Hardware Logic |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1246 | Improper Write Handling in Limited-write Non-Volatile Memories |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1247 | Improper Protection Against Voltage and Clock Glitches |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1248 | Semiconductor Defects in Hardware Logic with Security-Sensitive Implications |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1249 | Application-Level Admin Tool with Inconsistent View of Underlying Operating System |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1250 | Improper Preservation of Consistency Between Independent Representations of Shared State |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1251 | Mirrored Regions with Different Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1252 | CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1253 | Incorrect Selection of Fuse Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1254 | Incorrect Comparison Logic Granularity |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1255 | Comparison Logic is Vulnerable to Power Side-Channel Attacks |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1256 | Improper Restriction of Software Interfaces to Hardware Features |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1257 | Improper Access Control Applied to Mirrored or Aliased Memory Regions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1259 | Improper Restriction of Security Token Assignment |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1260 | Improper Handling of Overlap Between Protected Memory Ranges |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1261 | Improper Handling of Single Event Upsets |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1262 | Improper Access Control for Register Interface |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1263 | Improper Physical Access Control |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1264 | Hardware Logic with Insecure De-Synchronization between Control and Data Channels |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1265 | Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1266 | Improper Scrubbing of Sensitive Data from Decommissioned Device |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1267 | Policy Uses Obsolete Encoding |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1268 | Policy Privileges are not Assigned Consistently Between Control and Data Agents |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1269 | Product Released in Non-Release Configuration |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1270 | Generation of Incorrect Security Tokens |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1271 | Uninitialized Value on Reset for Registers Holding Security Settings |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1272 | Sensitive Information Uncleared Before Debug/Power State Transition |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1273 | Device Unlock Credential Sharing |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1274 | Improper Access Control for Volatile Memory Containing Boot Code |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1275 | Sensitive Cookie with Improper SameSite Attribute |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1276 | Hardware Child Block Incorrectly Connected to Parent System |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1277 | Firmware Not Updateable |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1278 | Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1279 | Cryptographic Operations are run Before Supporting Units are Ready |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1280 | Access Control Check Implemented After Asset is Accessed |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1281 | Sequence of Processor Instructions Leads to Unexpected Behavior |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1282 | Assumed-Immutable Data is Stored in Writable Memory |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1283 | Mutable Attestation or Measurement Reporting Data |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1284 | Improper Validation of Specified Quantity in Input |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1285 | Improper Validation of Specified Index, Position, or Offset in Input |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1286 | Improper Validation of Syntactic Correctness of Input |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1287 | Improper Validation of Specified Type of Input |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1288 | Improper Validation of Consistency within Input |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1289 | Improper Validation of Unsafe Equivalence in Input |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1290 | Incorrect Decoding of Security Identifiers |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1291 | Public Key Re-Use for Signing both Debug and Production Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1292 | Incorrect Conversion of Security Identifiers |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1293 | Missing Source Correlation of Multiple Independent Data |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1294 | Insecure Security Identifier Mechanism |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1295 | Debug Messages Revealing Unnecessary Information |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1296 | Incorrect Chaining or Granularity of Debug Components |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1297 | Unprotected Confidential Information on Device is Accessible by OSAT Vendors |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1298 | Hardware Logic Contains Race Conditions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1299 | Missing Protection Mechanism for Alternate Hardware Interface |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1300 | Improper Protection of Physical Side Channels |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1301 | Insufficient or Incomplete Data Removal within Hardware Component |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1302 | Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1303 | Non-Transparent Sharing of Microarchitectural Resources |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1304 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1305 | CISQ Quality Measures (2020) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1306 | CISQ Quality Measures - Reliability |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1307 | CISQ Quality Measures - Maintainability |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1308 | CISQ Quality Measures - Security |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1309 | CISQ Quality Measures - Efficiency |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1310 | Missing Ability to Patch ROM Code |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1311 | Improper Translation of Security Attributes by Fabric Bridge |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1312 | Missing Protection for Mirrored Regions in On-Chip Fabric Firewall |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1313 | Hardware Allows Activation of Test or Debug Logic at Runtime |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1314 | Missing Write Protection for Parametric Data Values |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1315 | Improper Setting of Bus Controlling Capability in Fabric End-point |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1316 | Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1317 | Improper Access Control in Fabric Bridge |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1318 | Missing Support for Security Features in On-chip Fabrics or Buses |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1319 | Improper Protection against Electromagnetic Fault Injection (EM-FI) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1320 | Improper Protection for Outbound Error Messages and Alert Signals |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1322 | Use of Blocking Code in Single-threaded, Non-blocking Context |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1323 | Improper Management of Sensitive Trace Data |
| HasMember | Deprecated | 1324 | DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1325 | Improperly Controlled Sequential Memory Allocation |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1326 | Missing Immutable Root of Trust in Hardware |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1327 | Binding to an Unrestricted IP Address |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1328 | Security Version Number Mutable to Older Versions |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1329 | Reliance on Component That is Not Updateable |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1330 | Remanent Data Readable after Memory Erase |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1331 | Improper Isolation of Shared Resources in Network On Chip (NoC) |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1332 | Improper Handling of Faults that Lead to Instruction Skips |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1333 | Inefficient Regular Expression Complexity |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1334 | Unauthorized Error Injection Can Degrade Hardware Redundancy |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1335 | Incorrect Bitwise Shift of Integer |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1336 | Improper Neutralization of Special Elements Used in a Template Engine |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1337 | Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1338 | Improper Protections Against Hardware Overheating |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1339 | Insufficient Precision or Accuracy of a Real Number |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1340 | CISQ Data Protection Measures |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1341 | Multiple Releases of Same Resource or Handle |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1342 | Information Exposure through Microarchitectural State after Transient Execution |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1343 | Weaknesses in the 2021 CWE Most Important Hardware Weaknesses List |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1344 | Weaknesses in OWASP Top Ten (2021) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1345 | OWASP Top Ten 2021 Category A01:2021 - Broken Access Control |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1346 | OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1347 | OWASP Top Ten 2021 Category A03:2021 - Injection |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1348 | OWASP Top Ten 2021 Category A04:2021 - Insecure Design |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1349 | OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1350 | Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1351 | Improper Handling of Hardware Behavior in Exceptionally Cold Environments |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1352 | OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1353 | OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1354 | OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1355 | OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1356 | OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF) |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1357 | Reliance on Insufficiently Trustworthy Component |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1358 | Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1359 | ICS Communications |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1360 | ICS Dependencies (& Architecture) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1361 | ICS Supply Chain |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1362 | ICS Engineering (Constructions/Deployment) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1363 | ICS Operations (& Maintenance) |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1364 | ICS Communications: Zone Boundary Failures |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1365 | ICS Communications: Unreliability |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1366 | ICS Communications: Frail Security in Protocols |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1367 | ICS Dependencies (& Architecture): External Physical Systems |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1368 | ICS Dependencies (& Architecture): External Digital Systems |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1369 | ICS Supply Chain: IT/OT Convergence/Expansion |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1370 | ICS Supply Chain: Common Mode Frailties |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1371 | ICS Supply Chain: Poorly Documented or Undocumented Features |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1372 | ICS Supply Chain: OT Counterfeit and Malicious Corruption |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1373 | ICS Engineering (Construction/Deployment): Trust Model Problems |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1374 | ICS Engineering (Construction/Deployment): Maker Breaker Blindness |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1375 | ICS Engineering (Construction/Deployment): Gaps in Details/Data |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1376 | ICS Engineering (Construction/Deployment): Security Gaps in Commissioning |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1377 | ICS Engineering (Construction/Deployment): Inherent Predictability in Design |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1378 | ICS Operations (& Maintenance): Gaps in obligations and training |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1379 | ICS Operations (& Maintenance): Human factors in ICS environments |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1380 | ICS Operations (& Maintenance): Post-analysis changes |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1381 | ICS Operations (& Maintenance): Exploitable Standard Operational Procedures |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1382 | ICS Operations (& Maintenance): Emerging Energy Technologies |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1383 | ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1384 | Improper Handling of Physical or Environmental Conditions |
| HasMember | Variant - a weakness
that is linked to a certain type of product, typically involving a specific language or technology. More specific than a Base weakness. Variant level weaknesses typically describe issues in terms of 3 to 5 of the following dimensions: behavior, property, technology, language, and resource. | 1385 | Missing Origin Validation in WebSockets |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1386 | Insecure Operation on Windows Junction / Mount Point |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1387 | Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1388 | Physical Access Issues and Concerns |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1389 | Incorrect Parsing of Numbers with Different Radices |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1390 | Weak Authentication |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1391 | Use of Weak Credentials |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1392 | Use of Default Credentials |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1393 | Use of Default Password |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1394 | Use of Default Cryptographic Key |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1395 | Dependency on Vulnerable Third-Party Component |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1396 | Comprehensive Categorization: Access Control |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1397 | Comprehensive Categorization: Comparison |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1398 | Comprehensive Categorization: Component Interaction |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1399 | Comprehensive Categorization: Memory Safety |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1400 | Comprehensive Categorization for Software Assurance Trends |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1401 | Comprehensive Categorization: Concurrency |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1402 | Comprehensive Categorization: Encryption |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1403 | Comprehensive Categorization: Exposed Resource |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1404 | Comprehensive Categorization: File Handling |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1405 | Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1406 | Comprehensive Categorization: Improper Input Validation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1407 | Comprehensive Categorization: Improper Neutralization |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1408 | Comprehensive Categorization: Incorrect Calculation |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1409 | Comprehensive Categorization: Injection |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1410 | Comprehensive Categorization: Insufficient Control Flow Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1411 | Comprehensive Categorization: Insufficient Verification of Data Authenticity |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1412 | Comprehensive Categorization: Poor Coding Practices |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1413 | Comprehensive Categorization: Protection Mechanism Failure |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1414 | Comprehensive Categorization: Randomness |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1415 | Comprehensive Categorization: Resource Control |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1416 | Comprehensive Categorization: Resource Lifecycle Management |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1417 | Comprehensive Categorization: Sensitive Information Exposure |
| HasMember | Category - a CWE entry that contains a set of other entries that share a common characteristic. | 1418 | Comprehensive Categorization: Violation of Secure Design Principles |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More specific than a Pillar Weakness, but more general than a Base Weakness. Class level weaknesses typically describe issues in terms of 1 or 2 of the following dimensions: behavior, property, and resource. | 1419 | Incorrect Initialization of Resource |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1420 | Exposure of Sensitive Information during Transient Execution |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1421 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1423 | Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1424 | Weaknesses Addressed by ISA/IEC 62443 Requirements |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 1425 | Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses |
| HasMember | Base - a weakness
that is still mostly independent of a resource or technology, but with sufficient details to provide specific methods for detection and prevention. Base level weaknesses typically describe issues in terms of 2 or 3 of the following dimensions: behavior, property, technology, language, and resource. | 1426 | Improper Validation of Generative AI Output |
| HasMember | View - a subset of CWE entries that provides a way of examining CWE content. The two main view structures are Slices (flat lists) and Graphs (containing relationships between entries). | 2000 | Comprehensive CWE Dictionary |
Objective
This table specifies different individual consequences associated with the weakness. The Scope identifies the application security area that is violated, while the Impact describes the negative technical impact that arises if an adversary succeeds in exploiting this weakness. The Likelihood provides information about how likely the specific consequence is expected to be seen relative to the other consequences in the list. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact.
Relevant to the view "CISQ Quality Measures (2020)" (CWE-1305)
