Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
777 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | Allowed | 94 |
| CWE-328 | Use of Weak Hash | Allowed | 94 |
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | Allowed | 94 |
| CWE-591 | Sensitive Data Storage in Improperly Locked Memory | Allowed | 91 |
| CWE-841 | Improper Enforcement of Behavioral Workflow | Allowed | 90 |
| CWE-183 | Permissive List of Allowed Inputs | Allowed | 89 |
| CWE-799 | Improper Control of Interaction Frequency | Allowed-with-Review | 88 |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | Discouraged | 88 |
| CWE-257 | Storing Passwords in a Recoverable Format | Allowed | 88 |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | Allowed | 87 |
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | Allowed | 85 |
| CWE-524 | Use of Cache Containing Sensitive Information | Allowed | 84 |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | Allowed | 84 |
| CWE-912 | Hidden Functionality | Allowed-with-Review | 83 |
| CWE-1395 | Dependency on Vulnerable Third-Party Component | Allowed-with-Review | 83 |
| CWE-357 | Insufficient UI Warning of Dangerous Operations | Allowed | 80 |
| CWE-187 | Partial String Comparison | Allowed | 76 |
| CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation | Allowed | 74 |
| CWE-653 | Improper Isolation or Compartmentalization | Allowed | 71 |
| CWE-641 | Improper Restriction of Names for Files and Other Resources | Allowed | 71 |
| CWE-405 | Asymmetric Resource Consumption (Amplification) | Allowed-with-Review | 70 |
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | Allowed | 68 |
| CWE-648 | Incorrect Use of Privileged APIs | Allowed | 67 |
| CWE-267 | Privilege Defined With Unsafe Actions | Allowed | 67 |
| CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | Allowed | 66 |
| CWE-340 | Generation of Predictable Numbers or Identifiers | Allowed-with-Review | 65 |
| CWE-29 | Path Traversal: '\..\filename' | Allowed | 65 |
| CWE-124 | Buffer Underwrite ('Buffer Underflow') | Allowed | 64 |
| CWE-118 | Incorrect Access of Indexable Resource ('Range Error') | Discouraged | 63 |
| CWE-763 | Release of Invalid Pointer or Reference | Allowed | 62 |
| CWE-41 | Improper Resolution of Path Equivalence | Allowed | 62 |
| CWE-664 | Improper Control of a Resource Through its Lifetime | Discouraged | 60 |
| CWE-548 | Exposure of Information Through Directory Listing | Allowed | 60 |
| CWE-805 | Buffer Access with Incorrect Length Value | Allowed | 59 |
| CWE-778 | Insufficient Logging | Allowed | 59 |
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | Allowed | 59 |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | Allowed | 58 |
| CWE-304 | Missing Critical Step in Authentication | Allowed | 56 |
| CWE-385 | Covert Timing Channel | Allowed | 55 |
| CWE-289 | Authentication Bypass by Alternate Name | Allowed | 55 |
| CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | Allowed | 55 |
| CWE-440 | Expected Behavior Violation | Allowed | 54 |
| CWE-277 | Insecure Inherited Permissions | Allowed | 54 |
| CWE-185 | Incorrect Regular Expression | Allowed-with-Review | 54 |
| CWE-940 | Improper Verification of Source of a Communication Channel | Allowed | 53 |