Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | Weakness | Allowed | 21 |
| CWE-552 | Files or Directories Accessible to External Parties | Weakness | Allowed | 668 |
| CWE-553 | Command Shell in Externally Accessible Directory | Weakness | Allowed | 2 |
| CWE-554 | ASP.NET Misconfiguration: Not Using Input Validation Framework | Weakness | Allowed | 0 |
| CWE-555 | J2EE Misconfiguration: Plaintext Password in Configuration File | Weakness | Allowed | 3 |
| CWE-556 | ASP.NET Misconfiguration: Use of Identity Impersonation | Weakness | Allowed | 1 |
| CWE-557 | Concurrency Issues | Grouping | Prohibited | 1 |
| CWE-558 | Use of getlogin() in Multithreaded Application | Weakness | Allowed | 0 |
| CWE-559 | DEPRECATED: Often Misused: Arguments and Parameters | Grouping | Prohibited | 0 |
| CWE-560 | Use of umask() with chmod-style Argument | Weakness | Allowed | 0 |
| CWE-561 | Dead Code | Weakness | Allowed-with-Review | 14 |
| CWE-562 | Return of Stack Variable Address | Weakness | Allowed | 11 |
| CWE-563 | Assignment to Variable without Use | Weakness | Allowed | 4 |
| CWE-564 | Use of Hibernate with HQL/SQL Query String Containing External Input | Weakness | Allowed | 19 |
| CWE-565 | Reliance on Cookies without Validation and Integrity Checking | Weakness | Allowed | 95 |
| CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | Weakness | Allowed | 11 |
| CWE-567 | Unsynchronized Access to Shared Data in a Multithreaded Context | Weakness | Allowed | 10 |
| CWE-568 | finalize() Method Without super.finalize() | Weakness | Allowed | 0 |
| CWE-569 | Expression Issues | Grouping | Prohibited | 0 |
| CWE-570 | Expression is Always False | Weakness | Allowed | 2 |
| CWE-571 | Expression is Always True | Weakness | Allowed | 1 |
| CWE-572 | Call to Thread run() instead of start() | Weakness | Allowed | 0 |
| CWE-573 | Improper Following of Specification by Caller | Weakness | Allowed-with-Review | 13 |
| CWE-574 | EJB Bad Practices: Use of Synchronization Primitives | Weakness | Allowed | 0 |
| CWE-575 | EJB Bad Practices: Use of AWT Swing | Weakness | Allowed | 0 |
| CWE-576 | EJB Bad Practices: Use of Java I/O | Weakness | Allowed | 0 |
| CWE-577 | EJB Bad Practices: Use of Sockets | Weakness | Allowed | 0 |
| CWE-578 | EJB Bad Practices: Use of Class Loader | Weakness | Allowed | 0 |
| CWE-579 | J2EE Bad Practices: Non-serializable Object Stored in Session | Weakness | Allowed | 0 |
| CWE-580 | clone() Method Without super.clone() | Weakness | Allowed | 0 |
| CWE-581 | Object Model Violation: Just One of Equals and Hashcode Defined | Weakness | Allowed | 0 |
| CWE-582 | Array Declared Public, Final, and Static | Weakness | Allowed | 0 |
| CWE-583 | finalize() Method Declared Public | Weakness | Allowed | 0 |
| CWE-584 | Return Inside Finally Block | Weakness | Allowed | 0 |
| CWE-585 | Empty Synchronized Block | Weakness | Allowed | 0 |
| CWE-586 | Explicit Call to Finalize() | Weakness | Allowed | 0 |
| CWE-587 | Assignment of a Fixed Address to a Pointer | Weakness | Allowed | 2 |
| CWE-588 | Attempt to Access Child of a Non-structure Pointer | Weakness | Allowed | 3 |
| CWE-589 | Call to Non-ubiquitous API | Weakness | Allowed | 0 |
| CWE-590 | Free of Memory not on the Heap | Weakness | Allowed | 31 |
| CWE-591 | Sensitive Data Storage in Improperly Locked Memory | Weakness | Allowed | 106 |
| CWE-592 | DEPRECATED: Authentication Bypass Issues | Weakness | Prohibited | 22 |
| CWE-593 | Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created | Weakness | Allowed | 0 |
| CWE-594 | J2EE Framework: Saving Unserializable Objects to Disk | Weakness | Allowed | 0 |
| CWE-595 | Comparison of Object References Instead of Object Contents | Weakness | Allowed | 1 |
| CWE-596 | DEPRECATED: Incorrect Semantic Object Comparison | Weakness | Prohibited | 0 |
| CWE-597 | Use of Wrong Operator in String Comparison | Weakness | Allowed | 4 |
| CWE-598 | Use of HTTP Request With Sensitive Query String | Weakness | Allowed | 136 |
| CWE-599 | Missing Validation of OpenSSL Certificate | Weakness | Allowed | 16 |
| CWE-600 | Uncaught Exception in Servlet | Weakness | Allowed | 2 |