Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-149 | Improper Neutralization of Quoting Syntax | Allowed | 8 |
| CWE-1421 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution | Allowed | 8 |
| CWE-1328 | Security Version Number Mutable to Older Versions | Allowed | 8 |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features | Allowed | 8 |
| CWE-1204 | Generation of Weak Initialization Vector (IV) | Allowed | 8 |
| CWE-1176 | Inefficient CPU Computation | Allowed-with-Review | 8 |
| CWE-1059 | Insufficient Technical Documentation | Prohibited | 8 |
| CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | Allowed | 7 |
| CWE-67 | Improper Handling of Windows Device Names | Allowed | 7 |
| CWE-624 | Executable Regular Expression Error | Allowed | 7 |
| CWE-599 | Missing Validation of OpenSSL Certificate | Allowed | 7 |
| CWE-562 | Return of Stack Variable Address | Allowed | 7 |
| CWE-544 | Missing Standardized Error Handling Mechanism | Allowed | 7 |
| CWE-412 | Unrestricted Externally Accessible Lock | Allowed | 7 |
| CWE-317 | Cleartext Storage of Sensitive Information in GUI | Allowed | 7 |
| CWE-298 | Improper Validation of Certificate Expiration | Allowed | 7 |
| CWE-219 | Storage of File with Sensitive Data Under Web Root | Allowed | 7 |
| CWE-147 | Improper Neutralization of Input Terminators | Allowed | 7 |
| CWE-1389 | Incorrect Parsing of Numbers with Different Radices | Allowed | 7 |
| CWE-112 | Missing XML Validation | Allowed | 7 |
| CWE-616 | Incomplete Identification of Uploaded File Variables (PHP) | Allowed | 6 |
| CWE-550 | Server-generated Error Message Containing Sensitive Information | Allowed | 6 |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | Allowed | 6 |
| CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | Allowed | 6 |
| CWE-520 | .NET Misconfiguration: Use of Impersonation | Allowed | 6 |
| CWE-50 | Path Equivalence: '//multiple/leading/slash' | Allowed | 6 |
| CWE-37 | Path Traversal: '/absolute/pathname/here' | Allowed | 6 |
| CWE-315 | Cleartext Storage of Sensitive Information in a Cookie | Allowed | 6 |
| CWE-262 | Not Using Password Aging | Allowed | 6 |
| CWE-254 | 7PK - Security Features | Prohibited | 6 |
| CWE-249 | DEPRECATED: Often Misused: Path Manipulation | Prohibited | 6 |
| CWE-166 | Improper Handling of Missing Special Element | Allowed | 6 |
| CWE-144 | Improper Neutralization of Line Delimiters | Allowed | 6 |
| CWE-143 | Improper Neutralization of Record Delimiters | Allowed | 6 |
| CWE-1423 | Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution | Allowed | 6 |
| CWE-1342 | Information Exposure through Microarchitectural State after Transient Execution | Allowed | 6 |
| CWE-1320 | Improper Protection for Outbound Error Messages and Alert Signals | Allowed | 6 |
| CWE-1281 | Sequence of Processor Instructions Leads to Unexpected Behavior | Allowed | 6 |
| CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code | Allowed | 6 |
| CWE-1265 | Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls | Allowed | 6 |
| CWE-1254 | Incorrect Comparison Logic Granularity | Allowed | 6 |
| CWE-1247 | Improper Protection Against Voltage and Clock Glitches | Allowed | 6 |
| CWE-1077 | Floating Point Comparison with Incorrect Operator | Allowed | 6 |
| CWE-1068 | Inconsistency Between Implementation and Documented Design | Prohibited | 6 |
| CWE-1038 | Insecure Automated Optimizations | Allowed-with-Review | 6 |
| CWE-1032 | OWASP Top Ten 2017 Category A6 - Security Misconfiguration | Prohibited | 6 |
| CWE-97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | Allowed | 5 |
| CWE-827 | Improper Control of Document Type Definition | Allowed | 5 |
| CWE-794 | Incomplete Filtering of Multiple Instances of Special Elements | Allowed | 5 |
| CWE-786 | Access of Memory Location Before Start of Buffer | Discouraged | 5 |