Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-146 | Improper Neutralization of Expression/Command Delimiters | Allowed | 13 |
| CWE-1270 | Generation of Incorrect Security Tokens | Allowed | 13 |
| CWE-941 | Incorrectly Specified Destination in a Communication Channel | Allowed | 12 |
| CWE-676 | Use of Potentially Dangerous Function | Allowed | 12 |
| CWE-649 | Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking | Allowed | 12 |
| CWE-466 | Return of Pointer Value Outside of Expected Range | Allowed | 12 |
| CWE-419 | Unprotected Primary Channel | Allowed | 12 |
| CWE-371 | State Issues | Prohibited | 12 |
| CWE-31 | Path Traversal: 'dir\..\..\filename' | Allowed | 12 |
| CWE-291 | Reliance on IP Address for Authentication | Allowed | 12 |
| CWE-232 | Improper Handling of Undefined Values | Allowed | 12 |
| CWE-1250 | Improper Preservation of Consistency Between Independent Representations of Shared State | Allowed | 12 |
| CWE-1088 | Synchronous Access of Remote Resource without Timeout | Allowed | 12 |
| CWE-86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | Allowed | 11 |
| CWE-839 | Numeric Range Comparison Without Minimum Check | Allowed | 11 |
| CWE-777 | Regular Expression without Anchors | Allowed | 11 |
| CWE-662 | Improper Synchronization | Discouraged | 11 |
| CWE-646 | Reliance on File Name or Extension of Externally-Supplied File | Allowed | 11 |
| CWE-1326 | Missing Immutable Root of Trust in Hardware | Allowed | 11 |
| CWE-1299 | Missing Protection Mechanism for Alternate Hardware Interface | Allowed | 11 |
| CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | Allowed | 11 |
| CWE-1262 | Improper Access Control for Register Interface | Allowed | 11 |
| CWE-830 | Inclusion of Web Functionality from an Untrusted Source | Allowed | 10 |
| CWE-783 | Operator Precedence Logic Error | Allowed | 10 |
| CWE-388 | 7PK - Errors | Prohibited | 10 |
| CWE-1428 | Reliance on HTTP instead of HTTPS | Allowed | 10 |
| CWE-14 | Compiler Removal of Code to Clear Buffers | Allowed | 10 |
| CWE-1335 | Incorrect Bitwise Shift of Integer | Allowed | 10 |
| CWE-1263 | Improper Physical Access Control | Allowed-with-Review | 10 |
| CWE-1173 | Improper Use of Validation Framework | Allowed | 10 |
| CWE-921 | Storage of Sensitive Data in a Mechanism without Access Control | Allowed | 9 |
| CWE-914 | Improper Control of Dynamically-Identified Variables | Allowed | 9 |
| CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | Allowed | 9 |
| CWE-671 | Lack of Administrator Control over Security | Allowed-with-Review | 9 |
| CWE-666 | Operation on Resource in Wrong Phase of Lifetime | Discouraged | 9 |
| CWE-64 | Windows Shortcut Following (.LNK) | Allowed | 9 |
| CWE-62 | UNIX Hard Link | Allowed | 9 |
| CWE-561 | Dead Code | Allowed-with-Review | 9 |
| CWE-1322 | Use of Blocking Code in Single-threaded, Non-blocking Context | Allowed | 9 |
| CWE-128 | Wrap-around Error | Allowed | 9 |
| CWE-81 | Improper Neutralization of Script in an Error Message Web Page | Allowed | 8 |
| CWE-688 | Function Call With Incorrect Variable or Reference as Argument | Allowed | 8 |
| CWE-686 | Function Call With Incorrect Argument Type | Allowed | 8 |
| CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | Allowed | 8 |
| CWE-456 | Missing Initialization of a Variable | Allowed | 8 |
| CWE-421 | Race Condition During Access to Alternate Channel | Allowed | 8 |
| CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | Allowed | 8 |
| CWE-342 | Predictable Exact Value from Previous Values | Allowed | 8 |
| CWE-235 | Improper Handling of Extra Parameters | Allowed | 8 |
| CWE-192 | Integer Coercion Error | Allowed | 8 |