Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site | Weakness | Allowed | 2458 |
| CWE-602 | Client-Side Enforcement of Server-Side Security | Weakness | Allowed-with-Review | 230 |
| CWE-603 | Use of Client-Side Authentication | Weakness | Allowed | 41 |
| CWE-604 | Deprecated Entries | View | Prohibited | 0 |
| CWE-605 | Multiple Binds to the Same Port | Weakness | Allowed | 6 |
| CWE-606 | Unchecked Input for Loop Condition | Weakness | Allowed | 49 |
| CWE-607 | Public Static Final Field References Mutable Object | Weakness | Allowed | 0 |
| CWE-608 | Struts: Non-private Field in ActionForm Class | Weakness | Allowed | 0 |
| CWE-609 | Double-Checked Locking | Weakness | Allowed | 0 |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | Weakness | Discouraged | 277 |
| CWE-611 | Improper Restriction of XML External Entity Reference | Weakness | Allowed | 1683 |
| CWE-612 | Improper Authorization of Index Containing Sensitive Information | Weakness | Allowed | 21 |
| CWE-613 | DEPRECATED: Insufficient Session Expiration | Weakness | Prohibited | 1077 |
| CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | Weakness | Allowed | 115 |
| CWE-615 | Inclusion of Sensitive Information in Source Code Comments | Weakness | Allowed | 1 |
| CWE-616 | Incomplete Identification of Uploaded File Variables (PHP) | Weakness | Allowed | 9 |
| CWE-617 | Reachable Assertion | Weakness | Allowed | 978 |
| CWE-618 | Exposed Unsafe ActiveX Method | Weakness | Allowed | 2 |
| CWE-619 | Dangling Database Cursor | Weakness | Allowed | 0 |
| CWE-620 | Unverified Password Change | Weakness | Allowed | 153 |
| CWE-621 | Variable Extraction Error | Weakness | Allowed | 3 |
| CWE-622 | Improper Validation of Function Hook Arguments | Weakness | Allowed | 4 |
| CWE-623 | Unsafe ActiveX Control Marked Safe For Scripting | Weakness | Allowed | 5 |
| CWE-624 | Executable Regular Expression Error | Weakness | Allowed | 3 |
| CWE-625 | Permissive Regular Expression | Weakness | Allowed | 15 |
| CWE-626 | Null Byte Interaction Error (Poison Null Byte) | Weakness | Allowed | 8 |
| CWE-627 | Dynamic Variable Evaluation | Weakness | Allowed | 12 |
| CWE-628 | Function Call with Incorrectly Specified Arguments | Weakness | Allowed | 8 |
| CWE-629 | Weaknesses in OWASP Top Ten (2007) | View | Prohibited | 0 |
| CWE-630 | DEPRECATED: Weaknesses Examined by SAMATE | View | Prohibited | 0 |
| CWE-631 | DEPRECATED: Resource-specific Weaknesses | View | Prohibited | 0 |
| CWE-632 | DEPRECATED: Weaknesses that Affect Files or Directories | Grouping | Prohibited | 0 |
| CWE-633 | DEPRECATED: Weaknesses that Affect Memory | Grouping | Prohibited | 0 |
| CWE-634 | DEPRECATED: Weaknesses that Affect System Processes | Grouping | Prohibited | 0 |
| CWE-635 | Weaknesses Originally Used by NVD from 2008 to 2016 | View | Prohibited | 0 |
| CWE-636 | Not Failing Securely | Weakness | Allowed-with-Review | 74 |
| CWE-637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') | Weakness | Allowed-with-Review | 1 |
| CWE-638 | Not Using Complete Mediation | Weakness | Allowed-with-Review | 2 |
| CWE-639 | Authorization Bypass Through User-Controlled Key | Weakness | Allowed | 5095 |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | Weakness | Allowed-with-Review | 380 |
| CWE-641 | Improper Restriction of Names for Files and Other Resources | Weakness | Allowed | 28 |
| CWE-642 | External Control of Critical State Data | Weakness | Allowed-with-Review | 26 |
| CWE-643 | Improper Neutralization of Data within XPath Expressions | Weakness | Allowed | 25 |
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | Weakness | Allowed | 106 |
| CWE-645 | Overly Restrictive Account Lockout Mechanism | Weakness | Allowed | 13 |
| CWE-646 | Reliance on File Name or Extension of Externally-Supplied File | Weakness | Allowed | 23 |
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | Weakness | Allowed | 15 |
| CWE-648 | Incorrect Use of Privileged APIs | Weakness | Allowed | 113 |
| CWE-649 | Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking | Weakness | Allowed | 9 |
| CWE-650 | Trusting HTTP Permission Methods on the Server Side | Weakness | Allowed | 18 |