Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
793 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-620 | Unverified Password Change | Allowed | 129 |
| CWE-310 | Cryptographic Issues | Prohibited | 129 |
| CWE-521 | Weak Password Requirements | Allowed | 128 |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | Allowed | 127 |
| CWE-940 | Improper Verification of Source of a Communication Channel | Allowed | 123 |
| CWE-124 | Buffer Underwrite | Allowed | 123 |
| CWE-833 | Deadlock | Allowed | 122 |
| CWE-799 | Improper Control of Interaction Frequency | Allowed-with-Review | 122 |
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | Allowed-with-Review | 120 |
| CWE-641 | Improper Restriction of Names for Files and Other Resources | Allowed | 118 |
| CWE-471 | Modification of Assumed-Immutable Data (MAID) | Allowed | 118 |
| CWE-653 | Improper Isolation or Compartmentalization | Allowed | 116 |
| CWE-424 | Improper Protection of Alternate Path | Allowed-with-Review | 116 |
| CWE-598 | Use of HTTP Request With Sensitive Query String | Allowed | 115 |
| CWE-331 | Insufficient Entropy | Allowed | 114 |
| CWE-1395 | Dependency on Vulnerable Third-Party Component | Allowed-with-Review | 112 |
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs | Allowed | 111 |
| CWE-257 | Storing Passwords in a Recoverable Format | Allowed | 111 |
| CWE-926 | Improper Export of Android Application Components | Allowed | 108 |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | Allowed | 105 |
| CWE-328 | Use of Weak Hash | Allowed | 102 |
| CWE-187 | Partial String Comparison | Allowed | 101 |
| CWE-1035 | OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities | Prohibited | 100 |
| CWE-283 | Unverified Ownership | Allowed | 98 |
| CWE-912 | Hidden Functionality | Allowed-with-Review | 96 |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | Discouraged | 95 |
| CWE-214 | Invocation of Process Using Visible Sensitive Information | Allowed | 95 |
| CWE-778 | Insufficient Logging | Allowed | 94 |
| CWE-591 | Sensitive Data Storage in Improperly Locked Memory | Allowed | 91 |
| CWE-267 | Privilege Defined With Unsafe Actions | Allowed | 91 |
| CWE-299 | Improper Check for Certificate Revocation | Allowed | 90 |
| CWE-664 | Improper Control of a Resource Through its Lifetime | Discouraged | 89 |
| CWE-357 | Insufficient UI Warning of Dangerous Operations | Allowed | 89 |
| CWE-304 | Missing Critical Step in Authentication | Allowed | 89 |
| CWE-488 | Exposure of Data Element to Wrong Session | Allowed | 87 |
| CWE-805 | Buffer Access with Incorrect Length Value | Allowed | 84 |
| CWE-340 | Generation of Predictable Numbers or Identifiers | Allowed-with-Review | 84 |
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | Allowed | 84 |
| CWE-189 | Numeric Errors | Prohibited | 83 |
| CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation | Allowed | 83 |
| CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | Allowed | 82 |
| CWE-648 | Incorrect Use of Privileged APIs | Allowed | 78 |
| CWE-1419 | Incorrect Initialization of Resource | Allowed-with-Review | 78 |
| CWE-1023 | Incomplete Comparison with Missing Factors | Allowed-with-Review | 78 |
| CWE-696 | Incorrect Behavior Order | Allowed-with-Review | 77 |
| CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | Allowed | 77 |
| CWE-320 | Key Management Errors | Prohibited | 75 |
| CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | Allowed | 74 |
| CWE-420 | Unprotected Alternate Channel | Allowed | 74 |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement | Allowed | 73 |