Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
779 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-786 | Access of Memory Location Before Start of Buffer | Discouraged | 4 |
| CWE-767 | Access to Critical Private Variable via Public Method | Allowed | 4 |
| CWE-733 | Compiler Optimization Removal or Modification of Security-critical Code | Allowed | 4 |
| CWE-685 | Function Call With Incorrect Number of Arguments | Allowed | 4 |
| CWE-683 | Function Call With Incorrect Order of Arguments | Allowed | 4 |
| CWE-675 | Multiple Operations on Resource in Single-Operation Context | Allowed-with-Review | 4 |
| CWE-616 | Incomplete Identification of Uploaded File Variables (PHP) | Allowed | 4 |
| CWE-550 | Server-generated Error Message Containing Sensitive Information | Allowed | 4 |
| CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | Allowed | 4 |
| CWE-50 | Path Equivalence: '//multiple/leading/slash' | Allowed | 4 |
| CWE-473 | PHP External Variable Modification | Allowed | 4 |
| CWE-467 | Use of sizeof() on a Pointer Type | Allowed | 4 |
| CWE-455 | Non-exit on Failed Initialization | Allowed | 4 |
| CWE-414 | Missing Lock Check | Allowed | 4 |
| CWE-368 | Context Switching Race Condition | Allowed | 4 |
| CWE-336 | Same Seed in Pseudo-Random Number Generator (PRNG) | Allowed | 4 |
| CWE-240 | Improper Handling of Inconsistent Structural Elements | Allowed | 4 |
| CWE-231 | Improper Handling of Extra Values | Allowed | 4 |
| CWE-216 | DEPRECATED: Containment Errors (Container Errors) | Prohibited | 4 |
| CWE-194 | Unexpected Sign Extension | Allowed | 4 |
| CWE-188 | Reliance on Data/Memory Layout | Allowed | 4 |
| CWE-174 | Double Decoding of the Same Data | Allowed | 4 |
| CWE-166 | Improper Handling of Missing Special Element | Allowed | 4 |
| CWE-156 | Improper Neutralization of Whitespace | Allowed | 4 |
| CWE-148 | Improper Neutralization of Input Leaders | Allowed | 4 |
| CWE-144 | Improper Neutralization of Line Delimiters | Allowed | 4 |
| CWE-1420 | Exposure of Sensitive Information during Transient Execution | Allowed-with-Review | 4 |
| CWE-142 | Improper Neutralization of Value Delimiters | Allowed | 4 |
| CWE-1319 | Improper Protection against Electromagnetic Fault Injection (EM-FI) | Allowed | 4 |
| CWE-1300 | Improper Protection of Physical Side Channels | Allowed | 4 |
| CWE-1234 | Hardware Internal or Debug Modes Allow Override of Locks | Allowed | 4 |
| CWE-1125 | Excessive Attack Surface | Prohibited | 4 |
| CWE-1108 | Excessive Reliance on Global Variables | Allowed | 4 |
| CWE-1068 | Inconsistency Between Implementation and Documented Design | Prohibited | 4 |
| CWE-1039 | Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism | Allowed-with-Review | 4 |
| CWE-1037 | Processor Optimization Removal or Modification of Security-critical Code | Allowed | 4 |
| CWE-925 | Improper Verification of Intent by Broadcast Receiver | Allowed | 3 |
| CWE-910 | Use of Expired File Descriptor | Allowed | 3 |
| CWE-780 | Use of RSA Algorithm without OAEP | Allowed | 3 |
| CWE-756 | Missing Custom Error Page | Allowed | 3 |
| CWE-69 | Improper Handling of Windows ::DATA Alternate Data Stream | Allowed | 3 |
| CWE-687 | Function Call With Incorrectly Specified Argument Value | Allowed | 3 |
| CWE-623 | Unsafe ActiveX Control Marked Safe For Scripting | Allowed | 3 |
| CWE-62 | UNIX Hard Link | Allowed | 3 |
| CWE-605 | Multiple Binds to the Same Port | Allowed | 3 |
| CWE-597 | Use of Wrong Operator in String Comparison | Allowed | 3 |
| CWE-588 | Attempt to Access Child of a Non-structure Pointer | Allowed | 3 |
| CWE-534 | DEPRECATED: Information Exposure Through Debug Log Files | Prohibited | 3 |