Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-38 | Path Traversal: '\absolute\pathname\here' | Allowed | 1 |
| CWE-355 | User Interface Security Issues | Prohibited | 1 |
| CWE-333 | Improper Handling of Insufficient Entropy in TRNG | Allowed | 1 |
| CWE-318 | Cleartext Storage of Sensitive Information in Executable | Allowed | 1 |
| CWE-314 | Cleartext Storage in the Registry | Allowed | 1 |
| CWE-301 | Reflection Attack in an Authentication Protocol | Allowed | 1 |
| CWE-293 | Using Referer Field for Authentication | Allowed | 1 |
| CWE-263 | Password Aging with Long Expiration | Discouraged | 1 |
| CWE-234 | Failure to Handle Missing Parameter | Discouraged | 1 |
| CWE-207 | Observable Behavioral Discrepancy With Equivalent Products | Allowed | 1 |
| CWE-206 | Observable Internal Behavioral Discrepancy | Allowed | 1 |
| CWE-198 | Use of Incorrect Byte Ordering | Allowed | 1 |
| CWE-17 | DEPRECATED: Code | Prohibited | 1 |
| CWE-162 | Improper Neutralization of Trailing Special Elements | Allowed | 1 |
| CWE-154 | Improper Neutralization of Variable Name Delimiters | Allowed | 1 |
| CWE-1466 | Improper Session Invalidation after Authentication Credential Change | Allowed | 1 |
| CWE-1366 | ICS Communications: Frail Security in Protocols | Prohibited | 1 |
| CWE-1352 | OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components | Prohibited | 1 |
| CWE-1314 | Missing Write Protection for Parametric Data Values | Allowed | 1 |
| CWE-1313 | Hardware Allows Activation of Test or Debug Logic at Runtime | Allowed | 1 |
| CWE-1312 | Missing Protection for Mirrored Regions in On-Chip Fabric Firewall | Allowed | 1 |
| CWE-1310 | Missing Ability to Patch ROM Code | Allowed | 1 |
| CWE-1278 | Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques | Allowed | 1 |
| CWE-1272 | Sensitive Information Uncleared Before Debug/Power State Transition | Allowed | 1 |
| CWE-1264 | Hardware Logic with Insecure De-Synchronization between Control and Data Channels | Allowed | 1 |
| CWE-1253 | Incorrect Selection of Fuse Values | Allowed | 1 |
| CWE-1224 | Improper Restriction of Write-Once Bit Fields | Allowed | 1 |
| CWE-1222 | Insufficient Granularity of Address Regions Protected by Register Locks | Allowed | 1 |
| CWE-1218 | Memory Buffer Errors | Prohibited | 1 |
| CWE-12 | ASP.NET Misconfiguration: Missing Custom Error Page | Allowed | 1 |
| CWE-1190 | DMA Device Enabled Too Early in Boot Phase | Allowed | 1 |
| CWE-1164 | Irrelevant Code | Allowed-with-Review | 1 |
| CWE-1118 | Insufficient Documentation of Error Handling Techniques | Prohibited | 1 |
| CWE-1113 | Inappropriate Comment Style | Prohibited | 1 |
| CWE-1102 | Reliance on Machine-Dependent Data Representation | Allowed | 1 |
| CWE-1083 | Data Access from Outside Expected Data Manager Component | Prohibited | 1 |
| CWE-1078 | Inappropriate Source Code Style or Formatting | Prohibited | 1 |
| CWE-1072 | Data Resource Access without Use of Connection Pooling | Prohibited | 1 |
| CWE-1066 | Missing Serialization Control Element | Prohibited | 1 |
| CWE-1057 | Data Access Operations Outside of Expected Data Manager Component | Prohibited | 1 |
| CWE-1051 | Initialization with Hard-Coded Network Resource Configuration Data | Prohibited | 1 |
| CWE-1046 | Creation of Immutable Text Using String Concatenation | Allowed | 1 |
| CWE-1026 | Weaknesses in OWASP Top Ten (2017) | Prohibited | 1 |