Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
777 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-656 | Reliance on Security Through Obscurity | Allowed-with-Review | 10 |
| CWE-646 | Reliance on File Name or Extension of Externally-Supplied File | Allowed | 10 |
| CWE-645 | Overly Restrictive Account Lockout Mechanism | Allowed | 10 |
| CWE-173 | Improper Handling of Alternate Encoding | Allowed | 10 |
| CWE-1419 | Incorrect Initialization of Resource | Allowed-with-Review | 10 |
| CWE-14 | Compiler Removal of Code to Clear Buffers | Allowed | 10 |
| CWE-1263 | Improper Physical Access Control | Allowed-with-Review | 10 |
| CWE-921 | Storage of Sensitive Data in a Mechanism without Access Control | Allowed | 9 |
| CWE-775 | Missing Release of File Descriptor or Handle after Effective Lifetime | Allowed | 9 |
| CWE-705 | Incorrect Control Flow Scoping | Allowed-with-Review | 9 |
| CWE-662 | Improper Synchronization | Discouraged | 9 |
| CWE-64 | Windows Shortcut Following (.LNK) | Allowed | 9 |
| CWE-561 | Dead Code | Allowed | 9 |
| CWE-291 | Reliance on IP Address for Authentication | Allowed | 9 |
| CWE-127 | Buffer Under-read | Allowed | 9 |
| CWE-1262 | Improper Access Control for Register Interface | Allowed | 9 |
| CWE-1088 | Synchronous Access of Remote Resource without Timeout | Allowed | 9 |
| CWE-81 | Improper Neutralization of Script in an Error Message Web Page | Allowed | 8 |
| CWE-671 | Lack of Administrator Control over Security | Allowed-with-Review | 8 |
| CWE-628 | Function Call with Incorrectly Specified Arguments | Allowed | 8 |
| CWE-456 | Missing Initialization of a Variable | Allowed | 8 |
| CWE-408 | Incorrect Behavior Order: Early Amplification | Allowed | 8 |
| CWE-372 | Incomplete Internal State Distinction | Discouraged | 8 |
| CWE-192 | Integer Coercion Error | Allowed | 8 |
| CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | Allowed | 8 |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features | Allowed | 8 |
| CWE-1250 | Improper Preservation of Consistency Between Independent Representations of Shared State | Allowed | 8 |
| CWE-1173 | Improper Use of Validation Framework | Allowed | 8 |
| CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | Allowed | 7 |
| CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | Allowed | 7 |
| CWE-777 | Regular Expression without Anchors | Allowed | 7 |
| CWE-599 | Missing Validation of OpenSSL Certificate | Allowed | 7 |
| CWE-421 | Race Condition During Access to Alternate Channel | Allowed | 7 |
| CWE-412 | Unrestricted Externally Accessible Lock | Allowed | 7 |
| CWE-317 | Cleartext Storage of Sensitive Information in GUI | Allowed | 7 |
| CWE-298 | Improper Validation of Certificate Expiration | Allowed | 7 |
| CWE-219 | Storage of File with Sensitive Data Under Web Root | Allowed | 7 |
| CWE-1389 | Incorrect Parsing of Numbers with Different Radices | Allowed | 7 |
| CWE-1328 | Security Version Number Mutable to Older Versions | Allowed | 7 |
| CWE-1322 | Use of Blocking Code in Single-threaded, Non-blocking Context | Allowed | 7 |
| CWE-112 | Missing XML Validation | Allowed | 7 |
| CWE-914 | Improper Control of Dynamically-Identified Variables | Allowed | 6 |
| CWE-783 | Operator Precedence Logic Error | Allowed | 6 |
| CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | Allowed | 6 |
| CWE-562 | Return of Stack Variable Address | Allowed | 6 |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | Allowed | 6 |
| CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | Allowed | 6 |
| CWE-37 | Path Traversal: '/absolute/pathname/here' | Allowed | 6 |
| CWE-342 | Predictable Exact Value from Previous Values | Allowed | 6 |