Common Weakness Enumeration
Browse CWEs ranked by the number of vulnerabilities referencing them, and pivot to weakness details, mitigations, and related attack patterns.
774 CWEs
API response| CWE | Name | Mapping usage | Occurrences |
|---|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | Allowed | 136 |
| CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | Allowed | 130 |
| CWE-15 | External Control of System or Configuration Setting | Allowed | 130 |
| CWE-704 | Incorrect Type Conversion or Cast | Allowed-with-Review | 129 |
| CWE-354 | Improper Validation of Integrity Check Value | Allowed | 128 |
| CWE-302 | Authentication Bypass by Assumed-Immutable Data | Allowed | 128 |
| CWE-703 | Improper Check or Handling of Exceptional Conditions | Discouraged | 127 |
| CWE-281 | Improper Preservation of Permissions | Allowed | 127 |
| CWE-665 | Improper Initialization | Discouraged | 126 |
| CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | Allowed | 125 |
| CWE-922 | Insecure Storage of Sensitive Information | Allowed-with-Review | 124 |
| CWE-521 | Weak Password Requirements | Allowed | 124 |
| CWE-506 | Embedded Malicious Code | Allowed-with-Review | 121 |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | Allowed-with-Review | 119 |
| CWE-117 | Improper Output Neutralization for Logs | Allowed | 118 |
| CWE-823 | Use of Out-of-range Pointer Offset | Allowed | 115 |
| CWE-697 | Incorrect Comparison | Discouraged | 114 |
| CWE-24 | Path Traversal: '../filedir' | Allowed | 113 |
| CWE-680 | Integer Overflow to Buffer Overflow | Discouraged | 112 |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | Allowed | 112 |
| CWE-99 | Improper Control of Resource Identifiers ('Resource Injection') | Allowed-with-Review | 111 |
| CWE-425 | Direct Request ('Forced Browsing') | Allowed | 111 |
| CWE-1392 | Use of Default Credentials | Allowed | 110 |
| CWE-807 | Reliance on Untrusted Inputs in a Security Decision | Allowed | 107 |
| CWE-297 | Improper Validation of Certificate with Host Mismatch | Allowed | 107 |
| CWE-672 | Operation on a Resource after Expiration or Release | Allowed-with-Review | 106 |
| CWE-606 | Unchecked Input for Loop Condition | Allowed | 105 |
| CWE-772 | Missing Release of Resource after Effective Lifetime | Allowed | 103 |
| CWE-377 | Insecure Temporary File | Allowed-with-Review | 103 |
| CWE-670 | Always-Incorrect Control Flow Implementation | Allowed-with-Review | 102 |
| CWE-91 | XML Injection (aka Blind XPath Injection) | Allowed-with-Review | 101 |
| CWE-825 | Expired Pointer Dereference | Allowed | 100 |
| CWE-331 | Insufficient Entropy | Allowed | 95 |
| CWE-620 | Unverified Password Change | Allowed | 94 |
| CWE-489 | Active Debug Code | Allowed | 94 |
| CWE-598 | Use of HTTP Request With Sensitive Query String | Allowed | 92 |
| CWE-328 | Use of Weak Hash | Allowed | 92 |
| CWE-926 | Improper Export of Android Application Components | Allowed | 91 |
| CWE-591 | Sensitive Data Storage in Improperly Locked Memory | Allowed | 91 |
| CWE-178 | Improper Handling of Case Sensitivity | Allowed | 91 |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | Allowed | 90 |
| CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | Allowed | 89 |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | Discouraged | 88 |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | Allowed-with-Review | 87 |
| CWE-348 | Use of Less Trusted Source | Allowed | 86 |
| CWE-471 | Modification of Assumed-Immutable Data (MAID) | Allowed | 85 |
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | Allowed | 85 |
| CWE-841 | Improper Enforcement of Behavioral Workflow | Allowed | 83 |