Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-501 | Trust Boundary Violation | Weakness | Allowed | 49 |
| CWE-502 | Deserialization of Untrusted Data | Weakness | Allowed | 4739 |
| CWE-503 | DEPRECATED: Byte/Object Code | Grouping | Prohibited | 0 |
| CWE-504 | DEPRECATED: Motivation/Intent | Grouping | Prohibited | 0 |
| CWE-505 | DEPRECATED: Intentionally Introduced Weakness | Grouping | Prohibited | 0 |
| CWE-506 | Embedded Malicious Code | Weakness | Allowed-with-Review | 522 |
| CWE-507 | Trojan Horse | Weakness | Allowed | 1 |
| CWE-508 | Non-Replicating Malicious Code | Weakness | Allowed | 1 |
| CWE-509 | Replicating Malicious Code (Virus or Worm) | Weakness | Allowed | 2 |
| CWE-510 | Trapdoor | Weakness | Allowed | 0 |
| CWE-511 | Logic/Time Bomb | Weakness | Allowed | 1 |
| CWE-512 | Spyware | Weakness | Allowed | 0 |
| CWE-513 | DEPRECATED: Intentionally Introduced Nonmalicious Weakness | Grouping | Prohibited | 0 |
| CWE-514 | Covert Channel | Weakness | Allowed-with-Review | 2 |
| CWE-515 | Covert Storage Channel | Weakness | Allowed | 2 |
| CWE-516 | DEPRECATED: Covert Timing Channel | Weakness | Prohibited | 0 |
| CWE-517 | DEPRECATED: Other Intentional, Nonmalicious Weakness | Grouping | Prohibited | 0 |
| CWE-518 | DEPRECATED: Inadvertently Introduced Weakness | Grouping | Prohibited | 0 |
| CWE-519 | DEPRECATED: .NET Environment Issues | Grouping | Prohibited | 0 |
| CWE-520 | .NET Misconfiguration: Use of Impersonation | Weakness | Allowed | 5 |
| CWE-521 | Weak Password Requirements | Weakness | Allowed | 353 |
| CWE-522 | Insufficiently Protected Credentials | Weakness | Allowed-with-Review | 1818 |
| CWE-523 | Unprotected Transport of Credentials | Weakness | Allowed | 39 |
| CWE-524 | Use of Cache Containing Sensitive Information | Weakness | Allowed | 87 |
| CWE-525 | Use of Web Browser Cache Containing Sensitive Information | Weakness | Allowed | 60 |
| CWE-526 | Cleartext Storage of Sensitive Information in an Environment Variable | Weakness | Allowed | 37 |
| CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | Weakness | Allowed | 5 |
| CWE-528 | Exposure of Core Dump File to an Unauthorized Control Sphere | Weakness | Allowed | 4 |
| CWE-529 | Exposure of Access Control List Files to an Unauthorized Control Sphere | Weakness | Allowed | 2 |
| CWE-530 | Exposure of Backup File to an Unauthorized Control Sphere | Weakness | Allowed | 22 |
| CWE-531 | Inclusion of Sensitive Information in Test Code | Weakness | Allowed | 4 |
| CWE-532 | Insertion of Sensitive Information into Log File | Weakness | Allowed | 1730 |
| CWE-533 | DEPRECATED: Information Exposure Through Server Log Files | Weakness | Prohibited | 1 |
| CWE-534 | DEPRECATED: Information Exposure Through Debug Log Files | Weakness | Prohibited | 3 |
| CWE-535 | Exposure of Information Through Shell Error Message | Weakness | Allowed | 2 |
| CWE-536 | Servlet Runtime Error Message Containing Sensitive Information | Weakness | Allowed | 0 |
| CWE-537 | Java Runtime Error Message Containing Sensitive Information | Weakness | Allowed | 1 |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | Weakness | Allowed | 805 |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | Weakness | Allowed | 14 |
| CWE-540 | Inclusion of Sensitive Information in Source Code | Weakness | Allowed | 53 |
| CWE-541 | Inclusion of Sensitive Information in an Include File | Weakness | Allowed | 2 |
| CWE-542 | DEPRECATED: Information Exposure Through Cleanup Log Files | Weakness | Prohibited | 0 |
| CWE-543 | Use of Singleton Pattern Without Synchronization in a Multithreaded Context | Weakness | Allowed | 0 |
| CWE-544 | Missing Standardized Error Handling Mechanism | Weakness | Allowed | 12 |
| CWE-545 | DEPRECATED: Use of Dynamic Class Loading | Weakness | Prohibited | 0 |
| CWE-546 | Suspicious Comment | Weakness | Allowed | 0 |
| CWE-547 | Use of Hard-coded, Security-relevant Constants | Weakness | Allowed | 23 |
| CWE-548 | Exposure of Information Through Directory Listing | Weakness | Allowed | 101 |
| CWE-549 | Missing Password Field Masking | Weakness | Allowed | 26 |
| CWE-550 | Server-generated Error Message Containing Sensitive Information | Weakness | Allowed | 7 |