Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-801 | 2010 Top 25 - Insecure Interaction Between Components | Grouping | Prohibited | 0 |
| CWE-802 | 2010 Top 25 - Risky Resource Management | Grouping | Prohibited | 0 |
| CWE-803 | 2010 Top 25 - Porous Defenses | Grouping | Prohibited | 0 |
| CWE-804 | Guessable CAPTCHA | Weakness | Allowed | 24 |
| CWE-805 | Buffer Access with Incorrect Length Value | Weakness | Allowed | 84 |
| CWE-806 | Buffer Access Using Size of Source Buffer | Weakness | Allowed | 0 |
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | Weakness | Allowed | 144 |
| CWE-808 | 2010 Top 25 - Weaknesses On the Cusp | Grouping | Prohibited | 0 |
| CWE-809 | Weaknesses in OWASP Top Ten (2010) | View | Prohibited | 0 |
| CWE-810 | OWASP Top Ten 2010 Category A1 - Injection | Grouping | Prohibited | 0 |
| CWE-811 | OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS) | Grouping | Prohibited | 0 |
| CWE-812 | OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management | Grouping | Prohibited | 0 |
| CWE-813 | OWASP Top Ten 2010 Category A4 - Insecure Direct Object References | Grouping | Prohibited | 0 |
| CWE-814 | OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF) | Grouping | Prohibited | 0 |
| CWE-815 | OWASP Top Ten 2010 Category A6 - Security Misconfiguration | Grouping | Prohibited | 2 |
| CWE-816 | OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage | Grouping | Prohibited | 0 |
| CWE-817 | OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access | Grouping | Prohibited | 0 |
| CWE-818 | OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection | Grouping | Prohibited | 0 |
| CWE-819 | OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards | Grouping | Prohibited | 0 |
| CWE-820 | Missing Synchronization | Weakness | Allowed | 26 |
| CWE-821 | Incorrect Synchronization | Weakness | Allowed | 26 |
| CWE-822 | Untrusted Pointer Dereference | Weakness | Allowed | 359 |
| CWE-823 | Use of Out-of-range Pointer Offset | Weakness | Allowed | 178 |
| CWE-824 | Access of Uninitialized Pointer | Weakness | Allowed | 450 |
| CWE-825 | Expired Pointer Dereference | Weakness | Allowed | 103 |
| CWE-826 | Premature Release of Resource During Expected Lifetime | Weakness | Allowed | 14 |
| CWE-827 | Improper Control of Document Type Definition | Weakness | Allowed | 2 |
| CWE-828 | Signal Handler with Functionality that is not Asynchronous-Safe | Weakness | Allowed | 2 |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Weakness | Allowed | 774 |
| CWE-830 | Inclusion of Web Functionality from an Untrusted Source | Weakness | Allowed | 21 |
| CWE-831 | Signal Handler Function Associated with Multiple Signals | Weakness | Allowed | 0 |
| CWE-832 | Unlock of a Resource that is not Locked | Weakness | Allowed | 2 |
| CWE-833 | Deadlock | Weakness | Allowed | 39 |
| CWE-834 | Excessive Iteration | Weakness | Discouraged | 124 |
| CWE-835 | Loop with Unreachable Exit Condition | Weakness | Allowed | 1028 |
| CWE-836 | Use of Password Hash Instead of Password for Authentication | Weakness | Allowed | 30 |
| CWE-837 | Improper Enforcement of a Single, Unique Action | Weakness | Allowed | 32 |
| CWE-838 | Inappropriate Encoding for Output Context | Weakness | Allowed | 16 |
| CWE-839 | Numeric Range Comparison Without Minimum Check | Weakness | Allowed | 10 |
| CWE-840 | Business Logic Errors | Grouping | Prohibited | 88 |
| CWE-841 | Improper Enforcement of Behavioral Workflow | Weakness | Allowed | 86 |
| CWE-842 | Placement of User into Incorrect Group | Weakness | Allowed | 17 |
| CWE-843 | Access of Resource Using Incompatible Type | Weakness | Allowed | 1014 |
| CWE-844 | Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011) | View | Prohibited | 0 |
| CWE-845 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS) | Grouping | Prohibited | 0 |
| CWE-846 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL) | Grouping | Prohibited | 0 |
| CWE-847 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP) | Grouping | Prohibited | 0 |
| CWE-848 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM) | Grouping | Prohibited | 0 |
| CWE-849 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ) | Grouping | Prohibited | 0 |
| CWE-850 | The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET) | Grouping | Prohibited | 0 |