Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
774 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-662 | Improper Synchronization | Discouraged | 9 |
| CWE-64 | Windows Shortcut Following (.LNK) | Allowed | 9 |
| CWE-567 | Unsynchronized Access to Shared Data in a Multithreaded Context | Allowed | 9 |
| CWE-561 | Dead Code | Allowed | 9 |
| CWE-291 | Reliance on IP Address for Authentication | Allowed | 9 |
| CWE-258 | Empty Password in Configuration File | Allowed | 9 |
| CWE-179 | Incorrect Behavior Order: Early Validation | Allowed | 9 |
| CWE-172 | Encoding Error | Allowed-with-Review | 9 |
| CWE-127 | Buffer Under-read | Allowed | 9 |
| CWE-1262 | Improper Access Control for Register Interface | Allowed | 9 |
| CWE-81 | Improper Neutralization of Script in an Error Message Web Page | Allowed | 8 |
| CWE-628 | Function Call with Incorrectly Specified Arguments | Allowed | 8 |
| CWE-456 | Missing Initialization of a Variable | Allowed | 8 |
| CWE-408 | Incorrect Behavior Order: Early Amplification | Allowed | 8 |
| CWE-372 | Incomplete Internal State Distinction | Discouraged | 8 |
| CWE-1419 | Incorrect Initialization of Resource | Allowed-with-Review | 8 |
| CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | Allowed | 8 |
| CWE-1263 | Improper Physical Access Control | Allowed-with-Review | 8 |
| CWE-1250 | Improper Preservation of Consistency Between Independent Representations of Shared State | Allowed | 8 |
| CWE-1173 | Improper Use of Validation Framework | Allowed | 8 |
| CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | Allowed | 7 |
| CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | Allowed | 7 |
| CWE-777 | Regular Expression without Anchors | Allowed | 7 |
| CWE-599 | Missing Validation of OpenSSL Certificate | Allowed | 7 |
| CWE-421 | Race Condition During Access to Alternate Channel | Allowed | 7 |
| CWE-317 | Cleartext Storage of Sensitive Information in GUI | Allowed | 7 |
| CWE-1389 | Incorrect Parsing of Numbers with Different Radices | Allowed | 7 |
| CWE-112 | Missing XML Validation | Allowed | 7 |
| CWE-1088 | Synchronous Access of Remote Resource without Timeout | Allowed | 7 |
| CWE-914 | Improper Control of Dynamically-Identified Variables | Allowed | 6 |
| CWE-783 | Operator Precedence Logic Error | Allowed | 6 |
| CWE-775 | Missing Release of File Descriptor or Handle after Effective Lifetime | Allowed | 6 |
| CWE-710 | Improper Adherence to Coding Standards | Discouraged | 6 |
| CWE-671 | Lack of Administrator Control over Security | Allowed-with-Review | 6 |
| CWE-65 | Windows Hard Link | Allowed | 6 |
| CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | Allowed | 6 |
| CWE-562 | Return of Stack Variable Address | Allowed | 6 |
| CWE-539 | Use of Persistent Cookies Containing Sensitive Information | Allowed | 6 |
| CWE-520 | .NET Misconfiguration: Use of Impersonation | Allowed | 6 |
| CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | Allowed | 6 |
| CWE-37 | Path Traversal: '/absolute/pathname/here' | Allowed | 6 |
| CWE-342 | Predictable Exact Value from Previous Values | Allowed | 6 |
| CWE-315 | Cleartext Storage of Sensitive Information in a Cookie | Allowed | 6 |
| CWE-278 | Insecure Preserved Inherited Permissions | Allowed | 6 |
| CWE-262 | Not Using Password Aging | Allowed | 6 |
| CWE-249 | DEPRECATED: Often Misused: Path Manipulation | Prohibited | 6 |
| CWE-235 | Improper Handling of Extra Parameters | Allowed | 6 |
| CWE-192 | Integer Coercion Error | Allowed | 6 |
| CWE-173 | Improper Handling of Alternate Encoding | Allowed | 6 |