Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
1477 CWEs
API response| CWE | Name | Entry type | Mapping usage | Occurrences |
|---|---|---|---|---|
| CWE-301 | Reflection Attack in an Authentication Protocol | Weakness | Allowed | 1 |
| CWE-302 | Authentication Bypass by Assumed-Immutable Data | Weakness | Allowed | 63 |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | Weakness | Allowed | 148 |
| CWE-304 | Missing Critical Step in Authentication | Weakness | Allowed | 60 |
| CWE-305 | Authentication Bypass by Primary Weakness | Weakness | Allowed | 280 |
| CWE-306 | Missing Authentication for Critical Functionality | Weakness | Allowed | 4107 |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | Weakness | Allowed | 1310 |
| CWE-308 | Use of Single-factor Authentication | Weakness | Allowed | 22 |
| CWE-309 | Use of Password System for Primary Authentication | Weakness | Allowed | 3 |
| CWE-310 | Cryptographic Issues | Grouping | Prohibited | 79 |
| CWE-311 | Missing Encryption of Sensitive Data | Weakness | Discouraged | 801 |
| CWE-312 | Cleartext Storage of Sensitive Information | Weakness | Allowed | 1018 |
| CWE-313 | Cleartext Storage in a File or on Disk | Weakness | Allowed | 49 |
| CWE-314 | Cleartext Storage in the Registry | Weakness | Allowed | 1 |
| CWE-315 | Cleartext Storage of Sensitive Information in a Cookie | Weakness | Allowed | 12 |
| CWE-316 | Cleartext Storage of Sensitive Information in Memory | Weakness | Allowed | 61 |
| CWE-317 | Cleartext Storage of Sensitive Information in GUI | Weakness | Allowed | 13 |
| CWE-318 | Cleartext Storage of Sensitive Information in Executable | Weakness | Allowed | 2 |
| CWE-319 | Cleartext Transmission of Sensitive Information | Weakness | Allowed | 1151 |
| CWE-320 | Key Management Errors | Grouping | Prohibited | 56 |
| CWE-321 | Use of Hard-coded Cryptographic Key | Weakness | Allowed | 501 |
| CWE-322 | Key Exchange without Entity Authentication | Weakness | Allowed | 40 |
| CWE-323 | Reusing a Nonce, Key Pair in Encryption | Weakness | Allowed | 78 |
| CWE-324 | Use of a Key Past its Expiration Date | Weakness | Allowed | 41 |
| CWE-325 | Missing Cryptographic Step | Weakness | Allowed | 87 |
| CWE-326 | Inadequate Encryption Strength | Weakness | Allowed-with-Review | 628 |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | Weakness | Allowed-with-Review | 957 |
| CWE-328 | Use of Weak Hash | Weakness | Allowed | 148 |
| CWE-329 | Generation of Predictable IV with CBC Mode | Weakness | Allowed | 17 |
| CWE-330 | Use of Insufficiently Random Values | Weakness | Discouraged | 443 |
| CWE-331 | Insufficient Entropy | Weakness | Allowed | 203 |
| CWE-332 | Insufficient Entropy in PRNG | Weakness | Allowed | 17 |
| CWE-333 | Improper Handling of Insufficient Entropy in TRNG | Weakness | Allowed | 2 |
| CWE-334 | Small Space of Random Values | Weakness | Allowed | 23 |
| CWE-335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) | Weakness | Allowed | 53 |
| CWE-336 | Same Seed in Pseudo-Random Number Generator (PRNG) | Weakness | Allowed | 3 |
| CWE-337 | Predictable Seed in Pseudo-Random Number Generator (PRNG) | Weakness | Allowed | 23 |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | Weakness | Allowed | 290 |
| CWE-339 | Small Seed Space in PRNG | Weakness | Allowed | 3 |
| CWE-340 | Generation of Predictable Numbers or Identifiers | Weakness | Allowed-with-Review | 69 |
| CWE-341 | Predictable from Observable State | Weakness | Allowed | 20 |
| CWE-342 | Predictable Exact Value from Previous Values | Weakness | Allowed | 10 |
| CWE-343 | Predictable Value Range from Previous Values | Weakness | Allowed | 10 |
| CWE-344 | Use of Invariant Value in Dynamically Changing Context | Weakness | Allowed | 5 |
| CWE-345 | Insufficient Verification of Data Authenticity | Weakness | Discouraged | 913 |
| CWE-346 | Origin Validation Error | Weakness | Allowed-with-Review | 765 |
| CWE-347 | Improper Verification of Cryptographic Signature | Weakness | Allowed | 1103 |
| CWE-348 | Use of Less Trusted Source | Weakness | Allowed | 107 |
| CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | Weakness | Allowed | 76 |
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | Weakness | Allowed | 47 |