Detail Tampilan CWE-1400

CWE-1400

Comprehensive Categorization for Software Assurance Trends
2023-04-25 +00:00
Draft
Graph
2023-06-29 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Comprehensive Categorization for Software Assurance Trends

Anggota CWE

CWE-1396: Weaknesses in this category are related to access control.
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods Dasar
CWE-13: ASP.NET Misconfiguration: Password in Configuration File Dasar
CWE-202: Exposure of Sensitive Information Through Data Queries Dasar
CWE-256: Plaintext Storage of a Password Dasar
CWE-257: Storing Passwords in a Recoverable Format Dasar
CWE-258: Empty Password in Configuration File Dasar
CWE-259: Use of Hard-coded Password Dasar
CWE-260: Password in Configuration File Dasar
CWE-261: Weak Encoding for Password Dasar
CWE-262: Not Using Password Aging Dasar
CWE-263: Password Aging with Long Expiration Dasar
CWE-266: Incorrect Privilege Assignment Dasar
CWE-267: Privilege Defined With Unsafe Actions Dasar
CWE-268: Privilege Chaining Dasar
CWE-269: Improper Privilege Management Dasar
CWE-270: Privilege Context Switching Error Dasar
CWE-271: Privilege Dropping / Lowering Errors Dasar
CWE-272: Least Privilege Violation Dasar
CWE-273: Improper Check for Dropped Privileges Dasar
CWE-274: Improper Handling of Insufficient Privileges Dasar
CWE-276: Incorrect Default Permissions Dasar
CWE-277: Insecure Inherited Permissions Dasar
CWE-278: Insecure Preserved Inherited Permissions Dasar
CWE-279: Incorrect Execution-Assigned Permissions Dasar
CWE-280: Improper Handling of Insufficient Permissions or Privileges Dasar
CWE-281: Improper Preservation of Permissions Dasar
CWE-282: Improper Ownership Management Dasar
CWE-283: Unverified Ownership Dasar
CWE-284: Improper Access Control Dasar
CWE-285: Improper Authorization Dasar
CWE-286: Incorrect User Management Dasar
CWE-287: Improper Authentication Dasar
CWE-288: Authentication Bypass Using an Alternate Path or Channel Dasar
CWE-289: Authentication Bypass by Alternate Name Dasar
CWE-290: Authentication Bypass by Spoofing Dasar
CWE-291: Reliance on IP Address for Authentication Dasar
CWE-293: Using Referer Field for Authentication Dasar
CWE-294: Authentication Bypass by Capture-replay Dasar
CWE-295: Improper Certificate Validation Dasar
CWE-296: Improper Following of a Certificate's Chain of Trust Dasar
CWE-297: Improper Validation of Certificate with Host Mismatch Dasar
CWE-298: Improper Validation of Certificate Expiration Dasar
CWE-299: Improper Check for Certificate Revocation Dasar
CWE-300: Channel Accessible by Non-Endpoint Dasar
CWE-301: Reflection Attack in an Authentication Protocol Dasar
CWE-302: Authentication Bypass by Assumed-Immutable Data Dasar
CWE-303: Incorrect Implementation of Authentication Algorithm Dasar
CWE-304: Missing Critical Step in Authentication Dasar
CWE-305: Authentication Bypass by Primary Weakness Dasar
CWE-306: Missing Authentication for Critical Functionality Dasar
CWE-307: Improper Restriction of Excessive Authentication Attempts Dasar
CWE-308: Use of Single-factor Authentication Dasar
CWE-309: Use of Password System for Primary Authentication Dasar
CWE-321: Use of Hard-coded Cryptographic Key Dasar
CWE-322: Key Exchange without Entity Authentication Dasar
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action Dasar
CWE-370: Missing Check for Certificate Revocation after Initial Check Dasar
CWE-384: Session Fixation Dasar
CWE-419: Unprotected Primary Channel Dasar
CWE-420: Unprotected Alternate Channel Dasar
CWE-421: Race Condition During Access to Alternate Channel Dasar
CWE-422: Unprotected Windows Messaging Channel Dasar
CWE-425: Direct Request Dasar
CWE-441: Unintended Proxy or Intermediary Dasar
CWE-520: .NET Misconfiguration: Use of Impersonation Dasar
CWE-521: Weak Password Requirements Dasar
CWE-522: Insufficiently Protected Credentials Dasar
CWE-523: Unprotected Transport of Credentials Dasar
CWE-549: Missing Password Field Masking Dasar
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization Dasar
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File Dasar
CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation Dasar
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Dasar
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created Dasar
CWE-599: Missing Validation of OpenSSL Certificate Dasar
CWE-601: URL Redirection to Untrusted Site Dasar
CWE-603: Use of Client-Side Authentication Dasar
CWE-611: Improper Restriction of XML External Entity Reference Dasar
CWE-612: Improper Authorization of Index Containing Sensitive Information Dasar
CWE-613: DEPRECATED: Insufficient Session Expiration Dasar
CWE-620: Unverified Password Change Dasar
CWE-623: Unsafe ActiveX Control Marked Safe For Scripting Dasar
CWE-639: Authorization Bypass Through User-Controlled Key Dasar
CWE-640: Weak Password Recovery Mechanism for Forgotten Password Dasar
CWE-645: Overly Restrictive Account Lockout Mechanism Dasar
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions Dasar
CWE-648: Incorrect Use of Privileged APIs Dasar
CWE-708: Incorrect Ownership Assignment Dasar
CWE-732: Incorrect Permission Assignment for Critical Resource Dasar
CWE-798: Use of Hard-coded Credentials Dasar
CWE-804: Guessable CAPTCHA Dasar
CWE-836: Use of Password Hash Instead of Password for Authentication Dasar
CWE-842: Placement of User into Incorrect Group Dasar
CWE-862: Missing Authorization Dasar
CWE-863: Incorrect Authorization Dasar
CWE-918: Server-Side Request Forgery Dasar
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control Dasar
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints Dasar
CWE-925: Improper Verification of Intent by Broadcast Receiver Dasar
CWE-926: Improper Export of Android Application Components Dasar
CWE-927: Use of Implicit Intent for Sensitive Communication Dasar
CWE-939: Improper Authorization in Handler for Custom URL Scheme Dasar
CWE-940: Improper Verification of Source of a Communication Channel Dasar
CWE-941: Incorrectly Specified Destination in a Communication Channel Dasar
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains Dasar
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag Dasar
CWE-1021: Improper Restriction of Rendered UI Layers or Frames Dasar
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access Dasar
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control Dasar
CWE-1220: Insufficient Granularity of Access Control Dasar
CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks Dasar
CWE-1224: Improper Restriction of Write-Once Bit Fields Dasar
CWE-1230: Exposure of Sensitive Information Through Metadata Dasar
CWE-1231: Improper Prevention of Lock Bit Modification Dasar
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection Dasar
CWE-1242: Inclusion of Undocumented Features or Chicken Bits Dasar
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug Dasar
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State Dasar
CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations Dasar
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features Dasar
CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions Dasar
CWE-1259: Improper Restriction of Security Token Assignment Dasar
CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges Dasar
CWE-1262: Improper Access Control for Register Interface Dasar
CWE-1263: Improper Physical Access Control Dasar
CWE-1267: Policy Uses Obsolete Encoding Dasar
CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents Dasar
CWE-1270: Generation of Incorrect Security Tokens Dasar
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code Dasar
CWE-1275: Sensitive Cookie with Improper SameSite Attribute Dasar
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System Dasar
CWE-1283: Mutable Attestation or Measurement Reporting Data Dasar
CWE-1290: Incorrect Decoding of Security Identifiers Dasar
CWE-1292: Incorrect Conversion of Security Identifiers Dasar
CWE-1294: Insecure Security Identifier Mechanism Dasar
CWE-1296: Incorrect Chaining or Granularity of Debug Components Dasar
CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors Dasar
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface Dasar
CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) Dasar
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation Dasar
CWE-1311: Improper Translation of Security Attributes by Fabric Bridge Dasar
CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall Dasar
CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime Dasar
CWE-1314: Missing Write Protection for Parametric Data Values Dasar
CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point Dasar
CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges Dasar
CWE-1317: Improper Access Control in Fabric Bridge Dasar
CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals Dasar
CWE-1323: Improper Management of Sensitive Trace Data Dasar
CWE-1328: Security Version Number Mutable to Older Versions Dasar
CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy Dasar
CWE-1390: Weak Authentication Dasar
CWE-1391: Use of Weak Credentials Dasar
CWE-1392: Use of Default Credentials Dasar
CWE-1393: Use of Default Password Dasar
CWE-1394: Use of Default Cryptographic Key Dasar
CWE-1401: Weaknesses in this category are related to concurrency.
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Dasar
CWE-363: Race Condition Enabling Link Following Dasar
CWE-364: Signal Handler Race Condition Dasar
CWE-366: Race Condition within a Thread Dasar
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition Dasar
CWE-368: Context Switching Race Condition Dasar
CWE-412: Unrestricted Externally Accessible Lock Dasar
CWE-413: Improper Resource Locking Dasar
CWE-414: Missing Lock Check Dasar
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations Dasar
CWE-479: Signal Handler Use of a Non-reentrant Function Dasar
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context Dasar
CWE-558: Use of getlogin() in Multithreaded Application Dasar
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context Dasar
CWE-572: Call to Thread run() instead of start() Dasar
CWE-574: EJB Bad Practices: Use of Synchronization Primitives Dasar
CWE-591: Sensitive Data Storage in Improperly Locked Memory Dasar
CWE-609: Double-Checked Locking Dasar
CWE-663: Use of a Non-reentrant Function in a Concurrent Context Dasar
CWE-667: Improper Locking Dasar
CWE-689: Permission Race Condition During Resource Copy Dasar
CWE-764: Multiple Locks of a Critical Resource Dasar
CWE-765: Multiple Unlocks of a Critical Resource Dasar
CWE-820: Missing Synchronization Dasar
CWE-821: Incorrect Synchronization Dasar
CWE-828: Signal Handler with Functionality that is not Asynchronous-Safe Dasar
CWE-831: Signal Handler Function Associated with Multiple Signals Dasar
CWE-832: Unlock of a Resource that is not Locked Dasar
CWE-833: Deadlock Dasar
CWE-1058: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element Dasar
CWE-1088: Synchronous Access of Remote Resource without Timeout Dasar
CWE-1096: Singleton Class Instance Creation without Proper Locking or Synchronization Dasar
CWE-1223: Race Condition for Write-Once Attributes Dasar
CWE-1232: Improper Lock Behavior After Power State Transition Dasar
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Dasar
CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels Dasar
CWE-1298: Hardware Logic Contains Race Conditions Dasar
CWE-1403: Weaknesses in this category are related to exposed resource.
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote Dasar
CWE-15: External Control of System or Configuration Setting Dasar
CWE-73: External Control of File Name or Path Dasar
CWE-114: Process Control Dasar
CWE-219: Storage of File with Sensitive Data Under Web Root Dasar
CWE-220: Storage of File With Sensitive Data Under FTP Root Dasar
CWE-374: Passing Mutable Objects to an Untrusted Method Dasar
CWE-375: Returning a Mutable Object to an Untrusted Caller Dasar
CWE-377: DEPRECATED: Insecure Temporary File Dasar
CWE-378: Creation of Temporary File With Insecure Permissions Dasar
CWE-379: Creation of Temporary File in Directory with Insecure Permissions Dasar
CWE-402: Transmission of Private Resources into a New Sphere Dasar
CWE-403: Exposure of File Descriptor to Unintended Control Sphere Dasar
CWE-426: Untrusted Search Path Dasar
CWE-427: Uncontrolled Search Path Element Dasar
CWE-428: Unquoted Search Path or Element Dasar
CWE-433: Unparsed Raw Web Content Delivery Dasar
CWE-472: External Control of Assumed-Immutable Web Parameter Dasar
CWE-488: Exposure of Data Element to Wrong Session Dasar
CWE-491: Public cloneable() Method Without Final Dasar
CWE-492: Use of Inner Class Containing Sensitive Data Dasar
CWE-493: Critical Public Variable Without Final Modifier Dasar
CWE-498: Cloneable Class Containing Sensitive Information Dasar
CWE-499: Serializable Class Containing Sensitive Data Dasar
CWE-500: Public Static Field Not Marked Final Dasar
CWE-524: Use of Cache Containing Sensitive Information Dasar
CWE-525: Use of Web Browser Cache Containing Sensitive Information Dasar
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere Dasar
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere Dasar
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere Dasar
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere Dasar
CWE-539: Use of Persistent Cookies Containing Sensitive Information Dasar
CWE-552: Files or Directories Accessible to External Parties Dasar
CWE-553: Command Shell in Externally Accessible Directory Dasar
CWE-565: Reliance on Cookies without Validation and Integrity Checking Dasar
CWE-582: Array Declared Public, Final, and Static Dasar
CWE-583: finalize() Method Declared Public Dasar
CWE-608: Struts: Non-private Field in ActionForm Class Dasar
CWE-619: Dangling Database Cursor Dasar
CWE-642: External Control of Critical State Data Dasar
CWE-668: Exposure of Resource to Wrong Sphere Dasar
CWE-767: Access to Critical Private Variable via Public Method Dasar
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision Dasar
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory Dasar
CWE-1327: Binding to an Unrestricted IP Address Dasar
CWE-1404: Weaknesses in this category are related to file handling.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Dasar
CWE-23: Relative Path Traversal Dasar
CWE-24: Path Traversal: '../filedir' Dasar
CWE-25: Path Traversal: '/../filedir' Dasar
CWE-26: Path Traversal: '/dir/../filename' Dasar
CWE-27: Path Traversal: 'dir/../../filename' Dasar
CWE-28: Path Traversal: '..\filedir' Dasar
CWE-29: Path Traversal: '\..\filename' Dasar
CWE-30: Path Traversal: '\dir\..\filename' Dasar
CWE-31: Path Traversal: 'dir\..\..\filename' Dasar
CWE-32: Path Traversal: '...' (Triple Dot) Dasar
CWE-33: Path Traversal: '....' (Multiple Dot) Dasar
CWE-34: Path Traversal: '....//' Dasar
CWE-35: Path Traversal: '.../...//' Dasar
CWE-36: Absolute Path Traversal Dasar
CWE-37: Path Traversal: '/absolute/pathname/here' Dasar
CWE-38: Path Traversal: '\absolute\pathname\here' Dasar
CWE-39: Path Traversal: 'C:dirname' Dasar
CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share) Dasar
CWE-41: Improper Resolution of Path Equivalence Dasar
CWE-42: Path Equivalence: 'filename.' (Trailing Dot) Dasar
CWE-43: Path Equivalence: 'filename....' (Multiple Trailing Dot) Dasar
CWE-44: Path Equivalence: 'file.name' (Internal Dot) Dasar
CWE-45: Path Equivalence: 'file...name' (Multiple Internal Dot) Dasar
CWE-46: Path Equivalence: 'filename ' (Trailing Space) Dasar
CWE-47: Path Equivalence: ' filename' (Leading Space) Dasar
CWE-48: Path Equivalence: 'file name' (Internal Whitespace) Dasar
CWE-49: Path Equivalence: 'filename/' (Trailing Slash) Dasar
CWE-50: Path Equivalence: '//multiple/leading/slash' Dasar
CWE-51: Path Equivalence: '/multiple//internal/slash' Dasar
CWE-52: Path Equivalence: '/multiple/trailing/slash//' Dasar
CWE-53: Path Equivalence: '\multiple\\internal\backslash' Dasar
CWE-54: Path Equivalence: 'filedir\' (Trailing Backslash) Dasar
CWE-55: Path Equivalence: '/./' (Single Dot Directory) Dasar
CWE-56: Path Equivalence: 'filedir*' (Wildcard) Dasar
CWE-57: Path Equivalence: 'fakedir/../realdir/filename' Dasar
CWE-58: Path Equivalence: Windows 8.3 Filename Dasar
CWE-59: Improper Link Resolution Before File Access Dasar
CWE-61: UNIX Symbolic Link (Symlink) Following Dasar
CWE-62: UNIX Hard Link Dasar
CWE-64: Windows Shortcut Following (.LNK) Dasar
CWE-65: Windows Hard Link Dasar
CWE-66: Improper Handling of File Names that Identify Virtual Resources Dasar
CWE-67: Improper Handling of Windows Device Names Dasar
CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream Dasar
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path Dasar
CWE-1407: Weaknesses in this category are related to improper neutralization.
CWE-116: Improper Encoding or Escaping of Output Dasar
CWE-117: Improper Output Neutralization for Logs Dasar
CWE-130: Improper Handling of Length Parameter Inconsistency Dasar
CWE-138: Improper Neutralization of Special Elements Dasar
CWE-140: Improper Neutralization of Delimiters Dasar
CWE-141: Improper Neutralization of Parameter/Argument Delimiters Dasar
CWE-142: Improper Neutralization of Value Delimiters Dasar
CWE-143: Improper Neutralization of Record Delimiters Dasar
CWE-144: Improper Neutralization of Line Delimiters Dasar
CWE-145: Improper Neutralization of Section Delimiters Dasar
CWE-146: Improper Neutralization of Expression/Command Delimiters Dasar
CWE-147: Improper Neutralization of Input Terminators Dasar
CWE-148: Improper Neutralization of Input Leaders Dasar
CWE-149: Improper Neutralization of Quoting Syntax Dasar
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Dasar
CWE-151: Improper Neutralization of Comment Delimiters Dasar
CWE-152: Improper Neutralization of Macro Symbols Dasar
CWE-153: Improper Neutralization of Substitution Characters Dasar
CWE-154: Improper Neutralization of Variable Name Delimiters Dasar
CWE-155: Improper Neutralization of Wildcards or Matching Symbols Dasar
CWE-156: Improper Neutralization of Whitespace Dasar
CWE-157: Failure to Sanitize Paired Delimiters Dasar
CWE-158: Improper Neutralization of Null Byte or NUL Character Dasar
CWE-159: Improper Handling of Invalid Use of Special Elements Dasar
CWE-160: Improper Neutralization of Leading Special Elements Dasar
CWE-161: Improper Neutralization of Multiple Leading Special Elements Dasar
CWE-162: Improper Neutralization of Trailing Special Elements Dasar
CWE-163: Improper Neutralization of Multiple Trailing Special Elements Dasar
CWE-164: Improper Neutralization of Internal Special Elements Dasar
CWE-165: Improper Neutralization of Multiple Internal Special Elements Dasar
CWE-166: Improper Handling of Missing Special Element Dasar
CWE-167: Improper Handling of Additional Special Element Dasar
CWE-168: Improper Handling of Inconsistent Special Elements Dasar
CWE-170: Improper Null Termination Dasar
CWE-172: Improper Encoding or Decoding of Data Dasar
CWE-173: Improper Handling of Alternate Encoding Dasar
CWE-174: Double Decoding of the Same Data Dasar
CWE-175: Improper Handling of Mixed Encoding Dasar
CWE-176: Improper Handling of Unicode Encoding Dasar
CWE-177: Improper Handling of URL Encoding (Hex Encoding) Dasar
CWE-228: Improper Handling of Syntactically Invalid Structure Dasar
CWE-229: Improper Handling of Values Dasar
CWE-230: Improper Handling of Missing Values Dasar
CWE-231: Improper Handling of Extra Values Dasar
CWE-232: Improper Handling of Undefined Values Dasar
CWE-233: Improper Handling of Parameters Dasar
CWE-234: Failure to Handle Missing Parameter Dasar
CWE-235: Improper Handling of Extra Parameters Dasar
CWE-236: Improper Handling of Undefined Parameters Dasar
CWE-237: Improper Handling of Structural Elements Dasar
CWE-238: Improper Handling of Incomplete Structural Elements Dasar
CWE-239: Failure to Handle Incomplete Element Dasar
CWE-240: Improper Handling of Inconsistent Structural Elements Dasar
CWE-241: Improper Handling of Unexpected Data Type Dasar
CWE-463: Deletion of Data Structure Sentinel Dasar
CWE-464: Addition of Data Structure Sentinel Dasar
CWE-626: Null Byte Interaction Error (Poison Null Byte) Dasar
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax Dasar
CWE-707: Improper Neutralization Dasar
CWE-790: Improper Filtering of Special Elements Dasar
CWE-791: Incomplete Filtering of Special Elements Dasar
CWE-792: Incomplete Filtering of One or More Instances of Special Elements Dasar
CWE-793: Only Filtering One Instance of a Special Element Dasar
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements Dasar
CWE-795: Only Filtering Special Elements at a Specified Location Dasar
CWE-796: Only Filtering Special Elements Relative to a Marker Dasar
CWE-797: Only Filtering Special Elements at an Absolute Position Dasar
CWE-838: Inappropriate Encoding for Output Context Dasar
CWE-1409: Weaknesses in this category are related to injection.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Dasar
CWE-75: Failure to Sanitize Special Elements into a Different Plane Dasar
CWE-76: Improper Neutralization of Equivalent Special Elements Dasar
CWE-77: Improper Neutralization of Special Elements used in a Command Dasar
CWE-78: Improper Neutralization of Special Elements used in an OS Command Dasar
CWE-79: Improper Neutralization of Input During Web Page Generation Dasar
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Dasar
CWE-81: Improper Neutralization of Script in an Error Message Web Page Dasar
CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page Dasar
CWE-83: Improper Neutralization of Script in Attributes in a Web Page Dasar
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page Dasar
CWE-85: Doubled Character XSS Manipulations Dasar
CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages Dasar
CWE-87: Improper Neutralization of Alternate XSS Syntax Dasar
CWE-88: Improper Neutralization of Argument Delimiters in a Command Dasar
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Dasar
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Dasar
CWE-91: XML Injection Dasar
CWE-93: Improper Neutralization of CRLF Sequences Dasar
CWE-94: Improper Control of Generation of Code Dasar
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Dasar
CWE-96: Improper Neutralization of Directives in Statically Saved Code Dasar
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Dasar
CWE-99: Improper Control of Resource Identifiers Dasar
CWE-102: Struts: Duplicate Validation Forms Dasar
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Dasar
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input Dasar
CWE-621: Variable Extraction Error Dasar
CWE-624: Executable Regular Expression Error Dasar
CWE-627: Dynamic Variable Evaluation Dasar
CWE-641: Improper Restriction of Names for Files and Other Resources Dasar
CWE-643: Improper Neutralization of Data within XPath Expressions Dasar
CWE-652: Improper Neutralization of Data within XQuery Expressions Dasar
CWE-692: Incomplete Denylist to Cross-Site Scripting Dasar
CWE-694: Use of Multiple Resources with Duplicate Identifier Dasar
CWE-914: Improper Control of Dynamically-Identified Variables Dasar
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement Dasar
CWE-943: Improper Neutralization of Special Elements in Data Query Logic Dasar
CWE-1236: Improper Neutralization of Formula Elements in a CSV File Dasar
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine Dasar
CWE-1426: Improper Validation of Generative AI Output Dasar
CWE-1427: Improper Neutralization of Input Used for LLM Prompting Dasar
CWE-1410: Weaknesses in this category are related to insufficient control flow management.
CWE-179: Incorrect Behavior Order: Early Validation Dasar
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize Dasar
CWE-181: Incorrect Behavior Order: Validate Before Filter Dasar
CWE-248: Uncaught Exception Dasar
CWE-382: J2EE Bad Practices: Use of System.exit() Dasar
CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference Dasar
CWE-396: Declaration of Catch for Generic Exception Dasar
CWE-397: Declaration of Throws for Generic Exception Dasar
CWE-408: Incorrect Behavior Order: Early Amplification Dasar
CWE-430: Deployment of Wrong Handler Dasar
CWE-431: Missing Handler Dasar
CWE-455: Non-exit on Failed Initialization Dasar
CWE-480: Use of Incorrect Operator Dasar
CWE-481: Assigning instead of Comparing Dasar
CWE-482: Comparing instead of Assigning Dasar
CWE-483: Incorrect Block Delimitation Dasar
CWE-584: Return Inside Finally Block Dasar
CWE-600: Uncaught Exception in Servlet Dasar
CWE-617: Reachable Assertion Dasar
CWE-670: Always-Incorrect Control Flow Implementation Dasar
CWE-674: Uncontrolled Recursion Dasar
CWE-691: Insufficient Control Flow Management Dasar
CWE-696: Incorrect Behavior Order Dasar
CWE-698: Execution After Redirect (EAR) Dasar
CWE-705: Incorrect Control Flow Scoping Dasar
CWE-768: Incorrect Short Circuit Evaluation Dasar
CWE-783: Operator Precedence Logic Error Dasar
CWE-799: Improper Control of Interaction Frequency Dasar
CWE-834: Excessive Iteration Dasar
CWE-835: Loop with Unreachable Exit Condition Dasar
CWE-837: Improper Enforcement of a Single, Unique Action Dasar
CWE-841: Improper Enforcement of Behavioral Workflow Dasar
CWE-1190: DMA Device Enabled Too Early in Boot Phase Dasar
CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control Dasar
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls Dasar
CWE-1280: Access Control Check Implemented After Asset is Accessed Dasar
CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior Dasar
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context Dasar
CWE-1399: Weaknesses in this category are related to memory safety.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Dasar
CWE-120: Buffer Copy without Checking Size of Input Dasar
CWE-121: Stack-based Buffer Overflow Dasar
CWE-122: Heap-based Buffer Overflow Dasar
CWE-123: Write-what-where Condition Dasar
CWE-124: Buffer Underwrite Dasar
CWE-125: Out-of-bounds Read Dasar
CWE-126: Buffer Over-read Dasar
CWE-127: Buffer Under-read Dasar
CWE-129: Improper Validation of Array Index Dasar
CWE-131: Incorrect Calculation of Buffer Size Dasar
CWE-134: Use of Externally-Controlled Format String Dasar
CWE-188: Reliance on Data/Memory Layout Dasar
CWE-198: Use of Incorrect Byte Ordering Dasar
CWE-244: Improper Clearing of Heap Memory Before Release Dasar
CWE-401: Missing Release of Memory after Effective Lifetime Dasar
CWE-415: Double Free Dasar
CWE-416: Use After Free Dasar
CWE-466: Return of Pointer Value Outside of Expected Range Dasar
CWE-562: Return of Stack Variable Address Dasar
CWE-587: Assignment of a Fixed Address to a Pointer Dasar
CWE-590: Free of Memory not on the Heap Dasar
CWE-680: Integer Overflow to Buffer Overflow Dasar
CWE-690: Unchecked Return Value to NULL Pointer Dereference Dasar
CWE-761: Free of Pointer not at Start of Buffer Dasar
CWE-762: Mismatched Memory Management Routines Dasar
CWE-763: Release of Invalid Pointer or Reference Dasar
CWE-786: Access of Memory Location Before Start of Buffer Dasar
CWE-787: Out-of-bounds Write Dasar
CWE-788: Access of Memory Location After End of Buffer Dasar
CWE-789: Memory Allocation with Excessive Size Value Dasar
CWE-805: Buffer Access with Incorrect Length Value Dasar
CWE-806: Buffer Access Using Size of Source Buffer Dasar
CWE-822: Untrusted Pointer Dereference Dasar
CWE-823: Use of Out-of-range Pointer Offset Dasar
CWE-824: Access of Uninitialized Pointer Dasar
CWE-825: Expired Pointer Dereference Dasar
CWE-1412: Weaknesses in this category are related to poor coding practices.
CWE-11: ASP.NET Misconfiguration: Creating Debug Binary Dasar
CWE-103: Struts: Incomplete validate() Method Definition Dasar
CWE-104: Struts: Form Bean Does Not Extend Validation Class Dasar
CWE-107: Struts: Unused Validation Form Dasar
CWE-110: Struts: Validator Without Form Field Dasar
CWE-111: Direct Use of Unsafe JNI Dasar
CWE-242: Use of Inherently Dangerous Function Dasar
CWE-245: J2EE Bad Practices: Direct Management of Connections Dasar
CWE-246: J2EE Bad Practices: Direct Use of Sockets Dasar
CWE-253: Incorrect Check of Function Return Value Dasar
CWE-358: Improperly Implemented Security Check for Standard Dasar
CWE-383: J2EE Bad Practices: Direct Use of Threads Dasar
CWE-392: Missing Report of Error Condition Dasar
CWE-393: Return of Wrong Status Code Dasar
CWE-440: Expected Behavior Violation Dasar
CWE-446: UI Discrepancy for Security Feature Dasar
CWE-448: Obsolete Feature in UI Dasar
CWE-449: The UI Performs the Wrong Action Dasar
CWE-451: User Interface (UI) Misrepresentation of Critical Information Dasar
CWE-462: Duplicate Key in Associative List (Alist) Dasar
CWE-474: Use of Function with Inconsistent Implementations Dasar
CWE-475: Undefined Behavior for Input to API Dasar
CWE-476: NULL Pointer Dereference Dasar
CWE-477: Use of Obsolete Function Dasar
CWE-484: Omitted Break Statement in Switch Dasar
CWE-489: Active Debug Code Dasar
CWE-506: Embedded Malicious Code Dasar
CWE-507: Trojan Horse Dasar
CWE-508: Non-Replicating Malicious Code Dasar
CWE-509: Replicating Malicious Code (Virus or Worm) Dasar
CWE-510: Trapdoor Dasar
CWE-511: Logic/Time Bomb Dasar
CWE-512: Spyware Dasar
CWE-546: Suspicious Comment Dasar
CWE-547: Use of Hard-coded, Security-relevant Constants Dasar
CWE-560: Use of umask() with chmod-style Argument Dasar
CWE-561: Dead Code Dasar
CWE-563: Assignment to Variable without Use Dasar
CWE-570: Expression is Always False Dasar
CWE-571: Expression is Always True Dasar
CWE-573: Improper Following of Specification by Caller Dasar
CWE-575: EJB Bad Practices: Use of AWT Swing Dasar
CWE-576: EJB Bad Practices: Use of Java I/O Dasar
CWE-577: EJB Bad Practices: Use of Sockets Dasar
CWE-578: EJB Bad Practices: Use of Class Loader Dasar
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session Dasar
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined Dasar
CWE-585: Empty Synchronized Block Dasar
CWE-586: Explicit Call to Finalize() Dasar
CWE-589: Call to Non-ubiquitous API Dasar
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk Dasar
CWE-605: Multiple Binds to the Same Port Dasar
CWE-628: Function Call with Incorrectly Specified Arguments Dasar
CWE-675: Multiple Operations on Resource in Single-Operation Context Dasar
CWE-676: Use of Potentially Dangerous Function Dasar
CWE-683: Function Call With Incorrect Order of Arguments Dasar
CWE-684: Incorrect Provision of Specified Functionality Dasar
CWE-685: Function Call With Incorrect Number of Arguments Dasar
CWE-686: Function Call With Incorrect Argument Type Dasar
CWE-687: Function Call With Incorrectly Specified Argument Value Dasar
CWE-688: Function Call With Incorrect Variable or Reference as Argument Dasar
CWE-695: Use of Low-Level Functionality Dasar
CWE-710: Improper Adherence to Coding Standards Dasar
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior Dasar
CWE-766: Critical Data Element Declared Public Dasar
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer Dasar
CWE-912: Hidden Functionality Dasar
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User Dasar
CWE-1041: Use of Redundant Code Dasar
CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements Dasar
CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range Dasar
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor Dasar
CWE-1047: Modules with Circular Dependencies Dasar
CWE-1048: Invokable Control Element with Large Number of Outward Calls Dasar
CWE-1053: Missing Documentation for Design Dasar
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer Dasar
CWE-1055: Multiple Inheritance from Concrete Classes Dasar
CWE-1056: Invokable Control Element with Variadic Parameters Dasar
CWE-1057: Data Access Operations Outside of Expected Data Manager Component Dasar
CWE-1059: Insufficient Technical Documentation Dasar
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses Dasar
CWE-1061: Insufficient Encapsulation Dasar
CWE-1062: Parent Class with References to Child Class Dasar
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters Dasar
CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers Dasar
CWE-1066: Missing Serialization Control Element Dasar
CWE-1068: Inconsistency Between Implementation and Documented Design Dasar
CWE-1069: Empty Exception Block Dasar
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements Dasar
CWE-1071: Empty Code Block Dasar
CWE-1074: Class with Excessively Deep Inheritance Dasar
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block Dasar
CWE-1076: Insufficient Adherence to Expected Conventions Dasar
CWE-1078: Inappropriate Source Code Style or Formatting Dasar
CWE-1079: Parent Class without Virtual Destructor Method Dasar
CWE-1080: Source Code File with Excessive Number of Lines of Code Dasar
CWE-1082: Class Instance Self Destruction Control Element Dasar
CWE-1083: Data Access from Outside Expected Data Manager Component Dasar
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code Dasar
CWE-1086: Class with Excessive Number of Child Classes Dasar
CWE-1087: Class with Virtual Method without a Virtual Destructor Dasar
CWE-1090: Method Containing Access of a Member Element from Another Class Dasar
CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers Dasar
CWE-1093: Excessively Complex Data Representation Dasar
CWE-1095: Loop Condition Value Update within the Loop Dasar
CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element Dasar
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element Dasar
CWE-1099: Inconsistent Naming Conventions for Identifiers Dasar
CWE-1100: Insufficient Isolation of System-Dependent Functions Dasar
CWE-1101: Reliance on Runtime Component in Generated Code Dasar
CWE-1102: Reliance on Machine-Dependent Data Representation Dasar
CWE-1103: Use of Platform-Dependent Third Party Components Dasar
CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality Dasar
CWE-1106: Insufficient Use of Symbolic Constants Dasar
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions Dasar
CWE-1108: Excessive Reliance on Global Variables Dasar
CWE-1109: Use of Same Variable for Multiple Purposes Dasar
CWE-1110: Incomplete Design Documentation Dasar
CWE-1111: Incomplete I/O Documentation Dasar
CWE-1112: Incomplete Documentation of Program Execution Dasar
CWE-1113: Inappropriate Comment Style Dasar
CWE-1114: Inappropriate Whitespace Style Dasar
CWE-1115: Source Code Element without Standard Prologue Dasar
CWE-1116: Inaccurate Source Code Comments Dasar
CWE-1117: Callable with Insufficient Behavioral Summary Dasar
CWE-1118: Insufficient Documentation of Error Handling Techniques Dasar
CWE-1119: Excessive Use of Unconditional Branching Dasar
CWE-1120: Excessive Code Complexity Dasar
CWE-1121: Excessive McCabe Cyclomatic Complexity Dasar
CWE-1122: Excessive Halstead Complexity Dasar
CWE-1123: Excessive Use of Self-Modifying Code Dasar
CWE-1124: Excessively Deep Nesting Dasar
CWE-1125: Excessive Attack Surface Dasar
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope Dasar
CWE-1127: Compilation with Insufficient Warnings or Errors Dasar
CWE-1164: Irrelevant Code Dasar
CWE-1177: Use of Prohibited Code Dasar
CWE-1209: Failure to Disable Reserved Bits Dasar
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic Dasar
CWE-1341: Multiple Releases of Same Resource or Handle Dasar
CWE-1357: Reliance on Insufficiently Trustworthy Component Dasar
CWE-1434: Insecure Setting of Generative AI/ML Model Inference Parameters Dasar
CWE-1413: Weaknesses in this category are related to protection mechanism failure.
CWE-182: Collapse of Data into Unsafe Value Dasar
CWE-184: Incomplete List of Disallowed Inputs Dasar
CWE-222: Truncation of Security-relevant Information Dasar
CWE-223: Omission of Security-relevant Information Dasar
CWE-224: Obscured Security-relevant Information by Alternate Name Dasar
CWE-356: Missing User Interaction for Potentially Unsafe Action Dasar
CWE-357: Insufficient UI Warning of Dangerous Operations Dasar
CWE-450: Multiple Interpretations of UI Input Dasar
CWE-602: Client-Side Enforcement of Server-Side Security Dasar
CWE-693: Protection Mechanism Failure Dasar
CWE-757: Selection of Less-Secure Algorithm During Negotiation Dasar
CWE-778: Insufficient Logging Dasar
CWE-807: Reliance on Untrusted Inputs in a Security Decision Dasar
CWE-1039: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism Dasar
CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Dasar
CWE-1253: Incorrect Selection of Fuse Values Dasar
CWE-1269: Product Released in Non-Release Configuration Dasar
CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques Dasar
CWE-1291: Public Key Re-Use for Signing both Debug and Production Code Dasar
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses Dasar
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI) Dasar
CWE-1326: Missing Immutable Root of Trust in Hardware Dasar
CWE-1338: Improper Protections Against Hardware Overheating Dasar
CWE-1429: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface Dasar
CWE-1416: Weaknesses in this category are related to resource lifecycle management.
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Dasar
CWE-118: Incorrect Access of Indexable Resource Dasar
CWE-178: Improper Handling of Case Sensitivity Dasar
CWE-192: Integer Coercion Error Dasar
CWE-194: Unexpected Sign Extension Dasar
CWE-195: Signed to Unsigned Conversion Error Dasar
CWE-196: Unsigned to Signed Conversion Error Dasar
CWE-197: Numeric Truncation Error Dasar
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer Dasar
CWE-221: Information Loss or Omission Dasar
CWE-226: Sensitive Information in Resource Not Removed Before Reuse Dasar
CWE-243: Creation of chroot Jail Without Changing Working Directory Dasar
CWE-372: Incomplete Internal State Distinction Dasar
CWE-386: Symbolic Name not Mapping to Correct Object Dasar
CWE-400: Uncontrolled Resource Consumption Dasar
CWE-404: Improper Resource Shutdown or Release Dasar
CWE-405: Asymmetric Resource Consumption (Amplification) Dasar
CWE-406: Insufficient Control of Network Message Volume (Network Amplification) Dasar
CWE-407: Inefficient Algorithmic Complexity Dasar
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) Dasar
CWE-410: Insufficient Resource Pool Dasar
CWE-434: Unrestricted Upload of File with Dangerous Type Dasar
CWE-453: Insecure Default Variable Initialization Dasar
CWE-454: External Initialization of Trusted Variables or Data Stores Dasar
CWE-456: Missing Initialization of a Variable Dasar
CWE-457: Use of Uninitialized Variable Dasar
CWE-459: Incomplete Cleanup Dasar
CWE-460: Improper Cleanup on Thrown Exception Dasar
CWE-471: Modification of Assumed-Immutable Data (MAID) Dasar
CWE-487: Reliance on Package-level Scope Dasar
CWE-495: Private Data Structure Returned From A Public Method Dasar
CWE-496: Public Data Assigned to Private Array-Typed Field Dasar
CWE-501: Trust Boundary Violation Dasar
CWE-568: finalize() Method Without super.finalize() Dasar
CWE-580: clone() Method Without super.clone() Dasar
CWE-588: Attempt to Access Child of a Non-structure Pointer Dasar
CWE-607: Public Static Final Field References Mutable Object Dasar
CWE-610: Externally Controlled Reference to a Resource in Another Sphere Dasar
CWE-618: Exposed Unsafe ActiveX Method Dasar
CWE-662: Improper Synchronization Dasar
CWE-664: Improper Control of a Resource Through its Lifetime Dasar
CWE-665: Improper Initialization Dasar
CWE-666: Operation on Resource in Wrong Phase of Lifetime Dasar
CWE-669: Incorrect Resource Transfer Between Spheres Dasar
CWE-673: External Influence of Sphere Definition Dasar
CWE-681: Incorrect Conversion between Numeric Types Dasar
CWE-704: Incorrect Type Conversion or Cast Dasar
CWE-706: Use of Incorrectly-Resolved Name or Reference Dasar
CWE-749: Exposed Dangerous Method or Function Dasar
CWE-770: Allocation of Resources Without Limits or Throttling Dasar
CWE-771: Missing Reference to Active Allocated Resource Dasar
CWE-772: Missing Release of Resource after Effective Lifetime Dasar
CWE-773: Missing Reference to Active File Descriptor or Handle Dasar
CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling Dasar
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime Dasar
CWE-776: Improper Restriction of Recursive Entity References in DTDs Dasar
CWE-779: Logging of Excessive Data Dasar
CWE-782: Exposed IOCTL with Insufficient Access Control Dasar
CWE-827: Improper Control of Document Type Definition Dasar
CWE-829: Inclusion of Functionality from Untrusted Control Sphere Dasar
CWE-830: Inclusion of Web Functionality from an Untrusted Source Dasar
CWE-843: Access of Resource Using Incompatible Type Dasar
CWE-908: Use of Uninitialized Resource Dasar
CWE-909: Missing Initialization of Resource Dasar
CWE-911: Improper Update of Reference Count Dasar
CWE-913: Improper Control of Dynamically-Managed Code Resources Dasar
CWE-920: Improper Restriction of Power Consumption Dasar
CWE-922: Insecure Storage of Sensitive Information Dasar
CWE-1042: Static Member Data Element outside of a Singleton Class Element Dasar
CWE-1046: Creation of Immutable Text Using String Concatenation Dasar
CWE-1049: Excessive Data Query Operations in a Large Data Table Dasar
CWE-1050: Excessive Platform Resource Consumption within a Loop Dasar
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data Dasar
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization Dasar
CWE-1063: Creation of Class Instance within a Static Code Block Dasar
CWE-1067: Excessive Execution of Sequential Searches of Data Resource Dasar
CWE-1072: Data Resource Access without Use of Connection Pooling Dasar
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses Dasar
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations Dasar
CWE-1089: Large Data Table with Excessive Number of Indices Dasar
CWE-1091: Use of Object without Invoking Destructor Method Dasar
CWE-1094: Excessive Index Range Scan for a Data Resource Dasar
CWE-1176: Inefficient CPU Computation Dasar
CWE-1188: Initialization of a Resource with an Insecure Default Dasar
CWE-1221: Incorrect Register Defaults or Module Parameters Dasar
CWE-1229: Creation of Emergent Resource Dasar
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations Dasar
CWE-1239: Improper Zeroization of Hardware Register Dasar
CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories Dasar
CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State Dasar
CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information Dasar
CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device Dasar
CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings Dasar
CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition Dasar
CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready Dasar
CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component Dasar
CWE-1325: Improperly Controlled Sequential Memory Allocation Dasar
CWE-1330: Remanent Data Readable after Memory Erase Dasar
CWE-1333: Inefficient Regular Expression Complexity Dasar
CWE-1342: Information Exposure through Microarchitectural State after Transient Execution Dasar
CWE-1386: Insecure Operation on Windows Junction / Mount Point Dasar
CWE-1389: Incorrect Parsing of Numbers with Different Radices Dasar
CWE-1419: Incorrect Initialization of Resource Dasar
CWE-1420: Exposure of Sensitive Information during Transient Execution Dasar
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution Dasar
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution Dasar
CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution Dasar
CWE-1417: Weaknesses in this category are related to sensitive information exposure.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Dasar
CWE-201: Insertion of Sensitive Information Into Sent Data Dasar
CWE-203: Observable Discrepancy Dasar
CWE-204: Observable Response Discrepancy Dasar
CWE-205: Observable Behavioral Discrepancy Dasar
CWE-206: Observable Internal Behavioral Discrepancy Dasar
CWE-207: Observable Behavioral Discrepancy With Equivalent Products Dasar
CWE-208: Observable Timing Discrepancy Dasar
CWE-209: Generation of Error Message Containing Sensitive Information Dasar
CWE-210: Self-generated Error Message Containing Sensitive Information Dasar
CWE-211: Externally-Generated Error Message Containing Sensitive Information Dasar
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies Dasar
CWE-214: Invocation of Process Using Visible Sensitive Information Dasar
CWE-215: Insertion of Sensitive Information Into Debugging Code Dasar
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Dasar
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Dasar
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable Dasar
CWE-531: Inclusion of Sensitive Information in Test Code Dasar
CWE-532: Insertion of Sensitive Information into Log File Dasar
CWE-535: Exposure of Information Through Shell Error Message Dasar
CWE-536: Servlet Runtime Error Message Containing Sensitive Information Dasar
CWE-537: Java Runtime Error Message Containing Sensitive Information Dasar
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Dasar
CWE-540: Inclusion of Sensitive Information in Source Code Dasar
CWE-541: Inclusion of Sensitive Information in an Include File Dasar
CWE-548: Exposure of Information Through Directory Listing Dasar
CWE-550: Server-generated Error Message Containing Sensitive Information Dasar
CWE-598: Use of HTTP Request With Sensitive Query String Dasar
CWE-615: Inclusion of Sensitive Information in Source Code Comments Dasar
CWE-651: Exposure of WSDL File Containing Sensitive Information Dasar
CWE-1254: Incorrect Comparison Logic Granularity Dasar
CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Dasar
CWE-1273: Device Unlock Credential Sharing Dasar
CWE-1295: Debug Messages Revealing Unnecessary Information Dasar
CWE-1300: Improper Protection of Physical Side Channels Dasar
CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs Dasar

Informasi Tampilan CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Komentar : Use this View or other Views to search and navigate for the appropriate weakness.

Catatan

This view is different than the software development view (CWE-699) because this view is expected to include all weaknesses regardless of abstraction, while view 699 uses a largely-fixed Base level of abstraction related only to software weaknesses. It is different from the Research view (CWE-1000) because while comprehensive for all weaknesses, the view uses a deep hierarchical structure and excludes categories.

Audiens

Pemangku kepentingan Deskripsi
Academic Researchers Researchers can use this view to evaluate the breadth and depth of software assurance with respect to mitigating and managing weaknesses before they become vulnerabilities.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2023-04-25 +00:00 2023-04-23 +00:00 4.11

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.