Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-901 | SFP Primary Cluster: Privilege | Grouping | Prohibited | 0 |
| CWE-902 | SFP Primary Cluster: Channel | Grouping | Prohibited | 0 |
| CWE-903 | SFP Primary Cluster: Cryptography | Grouping | Prohibited | 0 |
| CWE-904 | SFP Primary Cluster: Malware | Grouping | Prohibited | 0 |
| CWE-905 | SFP Primary Cluster: Predictability | Grouping | Prohibited | 0 |
| CWE-906 | SFP Primary Cluster: UI | Grouping | Prohibited | 0 |
| CWE-907 | SFP Primary Cluster: Other | Grouping | Prohibited | 0 |
| CWE-908 | Use of Uninitialized Resource | Weakness | Allowed | 780 |
| CWE-909 | Missing Initialization of Resource | Weakness | Allowed-with-Review | 96 |
| CWE-910 | Use of Expired File Descriptor | Weakness | Allowed | 1 |
| CWE-911 | Improper Update of Reference Count | Weakness | Allowed | 25 |
| CWE-912 | Hidden Functionality | Weakness | Allowed-with-Review | 796 |
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | Weakness | Allowed-with-Review | 159 |
| CWE-914 | Improper Control of Dynamically-Identified Variables | Weakness | Allowed | 9 |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Weakness | Allowed | 258 |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | Weakness | Allowed | 161 |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement | Weakness | Allowed | 172 |
| CWE-918 | Server-Side Request Forgery | Weakness | Allowed | 6052 |
| CWE-919 | Weaknesses in Mobile Applications | View | Prohibited | 0 |
| CWE-920 | Improper Restriction of Power Consumption | Weakness | Allowed | 6 |
| CWE-921 | Storage of Sensitive Data in a Mechanism without Access Control | Weakness | Allowed | 17 |
| CWE-922 | Insecure Storage of Sensitive Information | Weakness | Allowed-with-Review | 437 |
| CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | Weakness | Allowed-with-Review | 105 |
| CWE-924 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | Weakness | Allowed | 50 |
| CWE-925 | Improper Verification of Intent by Broadcast Receiver | Weakness | Allowed | 7 |
| CWE-926 | Improper Export of Android Application Components | Weakness | Allowed | 149 |
| CWE-927 | Use of Implicit Intent for Sensitive Communication | Weakness | Allowed | 34 |
| CWE-928 | Weaknesses in OWASP Top Ten (2013) | View | Prohibited | 0 |
| CWE-929 | OWASP Top Ten 2013 Category A1 - Injection | Grouping | Prohibited | 0 |
| CWE-930 | OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management | Grouping | Prohibited | 0 |
| CWE-931 | OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS) | Grouping | Prohibited | 0 |
| CWE-932 | OWASP Top Ten 2013 Category A4 - Insecure Direct Object References | Grouping | Prohibited | 0 |
| CWE-933 | OWASP Top Ten 2013 Category A5 - Security Misconfiguration | Grouping | Prohibited | 0 |
| CWE-934 | OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure | Grouping | Prohibited | 0 |
| CWE-935 | OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control | Grouping | Prohibited | 0 |
| CWE-936 | OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF) | Grouping | Prohibited | 0 |
| CWE-937 | OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities | Grouping | Prohibited | 0 |
| CWE-938 | OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards | Grouping | Prohibited | 0 |
| CWE-939 | Improper Authorization in Handler for Custom URL Scheme | Weakness | Allowed | 38 |
| CWE-940 | Improper Verification of Source of a Communication Channel | Weakness | Allowed | 92 |
| CWE-941 | Incorrectly Specified Destination in a Communication Channel | Weakness | Allowed | 10 |
| CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | Weakness | Allowed | 170 |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | Weakness | Allowed-with-Review | 112 |
| CWE-944 | SFP Secondary Cluster: Access Management | Grouping | Prohibited | 0 |
| CWE-945 | SFP Secondary Cluster: Insecure Resource Access | Grouping | Prohibited | 0 |
| CWE-946 | SFP Secondary Cluster: Insecure Resource Permissions | Grouping | Prohibited | 0 |
| CWE-947 | SFP Secondary Cluster: Authentication Bypass | Grouping | Prohibited | 0 |
| CWE-948 | SFP Secondary Cluster: Digital Certificate | Grouping | Prohibited | 0 |
| CWE-949 | SFP Secondary Cluster: Faulty Endpoint Authentication | Grouping | Prohibited | 0 |
| CWE-950 | SFP Secondary Cluster: Hardcoded Sensitive Data | Grouping | Prohibited | 0 |