Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-1251 | Mirrored Regions with Different Values | Weakness | Allowed | 4 |
| CWE-1252 | CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations | Weakness | Allowed | 0 |
| CWE-1253 | Incorrect Selection of Fuse Values | Weakness | Allowed | 2 |
| CWE-1254 | Incorrect Comparison Logic Granularity | Weakness | Allowed | 12 |
| CWE-1255 | Comparison Logic is Vulnerable to Power Side-Channel Attacks | Weakness | Allowed | 5 |
| CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features | Weakness | Allowed | 9 |
| CWE-1257 | Improper Access Control Applied to Mirrored or Aliased Memory Regions | Weakness | Allowed | 5 |
| CWE-1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information | Weakness | Allowed | 19 |
| CWE-1259 | Improper Restriction of Security Token Assignment | Weakness | Allowed | 20 |
| CWE-1260 | Improper Handling of Overlap Between Protected Memory Ranges | Weakness | Allowed | 27 |
| CWE-1261 | Improper Handling of Single Event Upsets | Weakness | Allowed | 0 |
| CWE-1262 | Improper Access Control for Register Interface | Weakness | Allowed | 16 |
| CWE-1263 | Improper Physical Access Control | Weakness | Allowed-with-Review | 22 |
| CWE-1264 | Hardware Logic with Insecure De-Synchronization between Control and Data Channels | Weakness | Allowed | 4 |
| CWE-1265 | Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls | Weakness | Allowed | 1 |
| CWE-1266 | Improper Scrubbing of Sensitive Data from Decommissioned Device | Weakness | Allowed | 0 |
| CWE-1267 | Policy Uses Obsolete Encoding | Weakness | Allowed | 0 |
| CWE-1268 | Policy Privileges are not Assigned Consistently Between Control and Data Agents | Weakness | Allowed | 1 |
| CWE-1269 | Product Released in Non-Release Configuration | Weakness | Allowed | 4 |
| CWE-1270 | Generation of Incorrect Security Tokens | Weakness | Allowed | 9 |
| CWE-1271 | Uninitialized Value on Reset for Registers Holding Security Settings | Weakness | Allowed | 0 |
| CWE-1272 | Sensitive Information Uncleared Before Debug/Power State Transition | Weakness | Allowed | 2 |
| CWE-1273 | Device Unlock Credential Sharing | Weakness | Allowed | 0 |
| CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code | Weakness | Allowed | 14 |
| CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | Weakness | Allowed | 35 |
| CWE-1276 | Hardware Child Block Incorrectly Connected to Parent System | Weakness | Allowed | 0 |
| CWE-1277 | Firmware Not Updateable | Weakness | Allowed | 0 |
| CWE-1278 | Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques | Weakness | Allowed | 2 |
| CWE-1279 | Cryptographic Operations are Run Before Supporting Units are Ready | Weakness | Allowed | 5 |
| CWE-1280 | Access Control Check Implemented After Asset is Accessed | Weakness | Allowed | 2 |
| CWE-1281 | Sequence of Processor Instructions Leads to Unexpected Behavior | Weakness | Allowed | 11 |
| CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | Weakness | Allowed | 16 |
| CWE-1283 | Mutable Attestation or Measurement Reporting Data | Weakness | Allowed | 5 |
| CWE-1284 | Improper Validation of Specified Quantity in Input | Weakness | Allowed | 485 |
| CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | Weakness | Allowed | 94 |
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | Weakness | Allowed | 146 |
| CWE-1287 | Improper Validation of Specified Type of Input | Weakness | Allowed | 255 |
| CWE-1288 | Improper Validation of Consistency within Input | Weakness | Allowed | 42 |
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | Weakness | Allowed | 50 |
| CWE-1290 | Incorrect Decoding of Security Identifiers | Weakness | Allowed | 0 |
| CWE-1291 | Public Key Re-Use for Signing both Debug and Production Code | Weakness | Allowed | 1 |
| CWE-1292 | Incorrect Conversion of Security Identifiers | Weakness | Allowed | 0 |
| CWE-1293 | Missing Source Correlation of Multiple Independent Data | Weakness | Allowed | 0 |
| CWE-1294 | Insecure Security Identifier Mechanism | Weakness | Allowed-with-Review | 0 |
| CWE-1295 | Debug Messages Revealing Unnecessary Information | Weakness | Allowed | 41 |
| CWE-1296 | Incorrect Chaining or Granularity of Debug Components | Weakness | Allowed | 0 |
| CWE-1297 | Unprotected Confidential Information on Device is Accessible by OSAT Vendors | Weakness | Allowed | 0 |
| CWE-1298 | Hardware Logic Contains Race Conditions | Weakness | Allowed | 3 |
| CWE-1299 | Missing Protection Mechanism for Alternate Hardware Interface | Weakness | Allowed | 19 |
| CWE-1300 | Improper Protection of Physical Side Channels | Weakness | Allowed | 24 |