Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-201 | Insertion of Sensitive Information Into Sent Data | Weakness | Allowed | 668 |
| CWE-202 | Exposure of Sensitive Information Through Data Queries | Weakness | Allowed | 59 |
| CWE-203 | Observable Discrepancy | Weakness | Allowed | 831 |
| CWE-204 | Observable Response Discrepancy | Weakness | Allowed | 291 |
| CWE-205 | Observable Behavioral Discrepancy | Weakness | Allowed | 4 |
| CWE-206 | Observable Internal Behavioral Discrepancy | Weakness | Allowed | 0 |
| CWE-207 | Observable Behavioral Discrepancy With Equivalent Products | Weakness | Allowed | 2 |
| CWE-208 | Observable Timing Discrepancy | Weakness | Allowed | 299 |
| CWE-209 | Generation of Error Message Containing Sensitive Information | Weakness | Allowed | 835 |
| CWE-210 | Self-generated Error Message Containing Sensitive Information | Weakness | Allowed | 4 |
| CWE-211 | Externally-Generated Error Message Containing Sensitive Information | Weakness | Allowed | 0 |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | Weakness | Allowed | 154 |
| CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | Weakness | Allowed | 49 |
| CWE-214 | Invocation of Process Using Visible Sensitive Information | Weakness | Allowed | 35 |
| CWE-215 | Insertion of Sensitive Information Into Debugging Code | Weakness | Allowed | 31 |
| CWE-216 | DEPRECATED: Containment Errors (Container Errors) | Weakness | Prohibited | 4 |
| CWE-217 | DEPRECATED: Failure to Protect Stored Data from Modification | Weakness | Prohibited | 0 |
| CWE-218 | DEPRECATED: Failure to provide confidentiality for stored data | Weakness | Prohibited | 0 |
| CWE-219 | Storage of File with Sensitive Data Under Web Root | Weakness | Allowed | 10 |
| CWE-220 | Storage of File With Sensitive Data Under FTP Root | Weakness | Allowed | 1 |
| CWE-221 | Information Loss or Omission | Weakness | Allowed-with-Review | 3 |
| CWE-222 | Truncation of Security-relevant Information | Weakness | Allowed | 0 |
| CWE-223 | Omission of Security-relevant Information | Weakness | Allowed | 15 |
| CWE-224 | Obscured Security-relevant Information by Alternate Name | Weakness | Allowed | 0 |
| CWE-225 | DEPRECATED: General Information Management Problems | Weakness | Prohibited | 0 |
| CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | Weakness | Allowed | 60 |
| CWE-227 | 7PK - API Abuse | Grouping | Prohibited | 2 |
| CWE-228 | Improper Handling of Syntactically Invalid Structure | Weakness | Allowed-with-Review | 35 |
| CWE-229 | Improper Handling of Values | Weakness | Allowed | 26 |
| CWE-230 | Improper Handling of Missing Values | Weakness | Allowed | 24 |
| CWE-231 | Improper Handling of Extra Values | Weakness | Allowed | 9 |
| CWE-232 | Improper Handling of Undefined Values | Weakness | Allowed | 19 |
| CWE-233 | Improper Handling of Parameters | Weakness | Allowed | 49 |
| CWE-234 | Failure to Handle Missing Parameter | Weakness | Discouraged | 2 |
| CWE-235 | Improper Handling of Extra Parameters | Weakness | Allowed | 11 |
| CWE-236 | Improper Handling of Undefined Parameters | Weakness | Allowed | 1 |
| CWE-237 | Improper Handling of Structural Elements | Weakness | Allowed | 7 |
| CWE-238 | Improper Handling of Incomplete Structural Elements | Weakness | Allowed | 0 |
| CWE-239 | Failure to Handle Incomplete Element | Weakness | Allowed | 5 |
| CWE-240 | Improper Handling of Inconsistent Structural Elements | Weakness | Allowed | 8 |
| CWE-241 | Improper Handling of Unexpected Data Type | Weakness | Allowed | 55 |
| CWE-242 | Use of Inherently Dangerous Function | Weakness | Allowed | 19 |
| CWE-243 | Creation of chroot Jail Without Changing Working Directory | Weakness | Allowed | 0 |
| CWE-244 | Improper Clearing of Heap Memory Before Release | Weakness | Allowed | 36 |
| CWE-245 | J2EE Bad Practices: Direct Management of Connections | Weakness | Allowed | 0 |
| CWE-246 | J2EE Bad Practices: Direct Use of Sockets | Weakness | Allowed | 0 |
| CWE-247 | DEPRECATED: Reliance on DNS Lookups in a Security Decision | Weakness | Prohibited | 0 |
| CWE-248 | Uncaught Exception | Weakness | Allowed | 407 |
| CWE-249 | DEPRECATED: Often Misused: Path Manipulation | Weakness | Prohibited | 6 |
| CWE-250 | Execution with Unnecessary Privileges | Weakness | Allowed | 582 |