# cwe-code-review Perform CWE-grounded security code reviews and precise weakness mapping using a locally derived MITRE CWE corpus, relationship graphs, mapping notes, detection methods, mitigations, and schema semantics. Use when Codex needs to audit source code or pull requests, identify root-cause weakness classes, distinguish broad symptoms from mappable CWEs, justify CWE IDs in findings, or review code against CWE views such as Software Development, Research Concepts, Top 25, OWASP, language-specific, or AI/ML weakness sets. - **Kind:** skill - **Source:** https://github.com/SpecterOps/skills - **Page:** https://forefy.com/skills/1b133687-eba7-436c-ba6c-e0e4caf55813 - **API (JSON + files):** https://forefy.com/api/asr/1b133687-eba7-436c-ba6c-e0e4caf55813 --- ## SKILL.md --- name: cwe-code-review description: Perform CWE-grounded security code reviews and precise weakness mapping using a locally derived MITRE CWE corpus, relationship graphs, mapping notes, detection methods, mitigations, and schema semantics. Use when Codex needs to audit source code or pull requests, identify root-cause weakness classes, distinguish broad symptoms from mappable CWEs, justify CWE IDs in findings, or review code against CWE views such as Software Development, Research Concepts, Top 25, OWASP, language-specific, or AI/ML weakness sets. --- # CWE Code Review Use this skill for manual security review when the result needs defensible CWE mapping, not just a list of suspicious patterns. Prefer a narrower language, framework, CI, cloud, or infrastructure review skill when one clearly fits; use this skill to add CWE precision and cross-cutting review logic. ## Review Principles - Start from architecture, trust boundaries, attacker-controlled inputs, sensitive assets, and reachable sinks. - Confirm a code path before assigning a CWE. A keyword match or a dangerous API alone is not a finding. - Use CWE as a root-cause taxonomy. Prefer the most precise supported weakness over a broad Pillar, Class, Category, or View. - Treat mapping notes as part of the evidence. `Allowed` and `Allowed-with-Review` entries are usually better finding mappings than `Discouraged` or `Prohibited` entries. - Use Top 25, OWASP, language, and lifecycle views for coverage and prioritization context, not as severity proof. - Keep unsupported hypotheses as open questions or coverage gaps instead of forcing a CWE mapping. - Always create or update one standalone `poc_.py` artifact per confirmed finding in the review workspace, with exploit prerequisites and validation steps for that finding. ## References - Read [references/cwe-catalog-summary.md](references/cwe-catalog-summary.md) first for source metadata, corpus shape, mapping cautions, and the review-oriented view table. - Read [references/cwe-review-views.md](references/cwe-review-views.md) when scoping a review by software-development, research, Top 25, OWASP, language, lifecycle, mobile, or AI/ML views. - Search [references/cwe-weakness-index.md](references/cwe-weakness-index.md) when you need a fast grep-friendly catalog scan. - Read [references/cwe-schema-guide.md](references/cwe-schema-guide.md) when interpreting fields such as `Abstraction`, `Structure`, `Status`, `Mapping_Notes`, relationship nature, detection effectiveness, or mitigation strategy. - Use [references/cwe-records.jsonl](references/cwe-records.jsonl) through `scripts/cwe_lookup.py` rather than loading the full corpus into context. - Use [references/cwe-catalog-metadata.json](references/cwe-catalog-metadata.json) when you need machine-readable view or category metadata. ## Lookup Workflow Resolve this skill directory, then use the lookup helper from that directory: ```bash python3 scripts/cwe_lookup.py --query "server-side request forgery" python3 scripts/cwe_lookup.py --id 918 python3 scripts/cwe_lookup.py --id CWE-79 --full python3 scripts/cwe_lookup.py --view 1435 --limit 30 python3 scripts/cwe_lookup.py --phase Implementation --functional-area Authorization --limit 20 python3 scripts/cwe_lookup.py --impact "Execute Unauthorized Code or Commands" --mapping Allowed --limit 20 ``` Use `--query` to discover candidates, then `--id` to read the mapping notes, relationships, consequences, detection methods, and mitigations before naming a CWE in a finding. ## Review Process 1. Build a threat model and code inventory. - Identify components, entry points, identities, privilege levels, data stores, external integrations, sensitive assets, and deployment boundaries. - Record attacker-controlled inputs, security decisions, and trust assumptions. 2. Trace security-relevant paths. - Follow untrusted data to queries, templates, files, archives, URLs, deserializers, process execution, logs, caches, and client responses. - Follow identity, authorization, session, secret, cryptographic, and business-state decisions through alternate routes and asynchronous handlers. - Record controls, normalization, validation, encoding, authorization checks, failure behavior, and privilege transitions. 3. Discover candidate weaknesses. - Query by sink, violated control, impact, lifecycle phase, or functional area. - Use view references to widen coverage when the repository exposes a relevant language, platform, lifecycle, OWASP, Top 25, mobile, or AI/ML surface. - Use parent and child relationships to move from broad symptoms toward a precise root cause. 4. Validate the mapping. - Read the candidate record with `--id`. - Check `Abstraction`, `Status`, `Mapping Usage`, mapping rationale, relationship context, and suggestions. - Prefer Base or Variant entries when the evidence supports them. Use Compound entries when the exploit requires the combined condition. - Avoid mapping a finding to a Category or View. Avoid a Pillar or broad Class when a supported child weakness matches the actual failure. - If the best entry is `Allowed-with-Review`, state why the code path fits that entry. If the best visible entry is `Discouraged` or `Prohibited`, keep searching or explain the mapping gap. 5. Report only confirmed findings. - Tie each finding to file and line references, attacker influence, the missing or incorrect control, reachable impact, and a focused remediation. - Name one primary CWE mapping per finding. Mention secondary CWE relationships only when they explain a distinct contributing weakness or attack chain. - Include concise syntax-highlighted code blocks for the affected source or configuration sections that establish the input, missing control, sensitive sink, or authorization decision. - Include a regression test or validation step that would fail before the fix and pass after it. 6. Build the PoC artifacts. - Create or update one standalone `poc_.py` file in the review workspace for each confirmed finding. - Do not combine unrelated findings into one harness unless the user explicitly asks for a consolidated runner. - Make each path incremental: print or implement numbered steps for prerequisites, authentication or material acquisition, trigger, impact verification, and cleanup guidance. - State attacker position, required permissions, credentials or certificates, environmental dependencies, and any unproven prerequisite before sending requests. - Default to dry-run or harmless markers and require an explicit flag for state-changing validation. Do not overclaim impact when a later exploit step remains unproven. - If a confirmed finding has no runnable path, still create its per-finding PoC scaffold and explain the missing prerequisite or why exploitation was not confirmed. ## PoC Artifacts Per-finding PoC scripts are part of the review output, not an optional appendix. Each script should help another reviewer reproduce one finding without reconstructing the exploit chain from prose. - Prefer standalone standard-library scripts named `poc_.py`. Duplicating small amounts of transport or auth plumbing is acceptable when it keeps each PoC independently runnable. - Keep requirements discoverable through `python3 poc_.py --requirements` or equivalent help text. - Model chained findings explicitly. If one finding yields the credential or primitive required by another, state the dependency and expose the steps separately. - Use safe default destinations, fake secrets, and non-destructive checks where they still prove the root cause. Put stronger impact demonstrations behind explicit arguments and document the side effects. - Validate each script locally with syntax checks and dry runs, then record which live steps were and were not executed. ## Finding Standard Lead with findings ordered by severity. For each finding include `Severity`, `Location`, `Issue`, `CWE`, `Evidence`, `Exploit Path`, `Impact`, `Remediation`, and `Test`. For `CWE`, include the identifier, name, and one sentence explaining why that entry is the precise root-cause mapping. Note `Allowed-with-Review` caveats when applicable. For `Evidence`, include line-scoped fenced code blocks with an appropriate language tag such as `python`, `go`, `javascript`, `yaml`, `json`, `nginx`, `bash`, or `sql`. Put the source path and line range immediately above each block. Keep excerpts narrow enough to show the relevant control flow without dumping whole modules, and include supporting configuration blocks when they are part of the exploit path. For each finding, also include `PoC Requirements` and reference the corresponding `poc_.py` artifact and step sequence. After findings, include `Open Questions / Assumptions` and `Coverage`. If no confirmed findings exist, say so explicitly and still state the reviewed surfaces, unresolved risks, test gaps, and that no per-finding PoC artifacts were created. ## Regeneration Rebuild the derived corpus when a newer CWE catalog or schema is provided: ```bash python3 scripts/build_cwe_references.py \ --catalog /path/to/cwec.xml \ --schema /path/to/cwe_schema.xsd ``` Keep the generated references aligned with the source catalog and schema version recorded in `references/cwe-catalog-summary.md`. ## agents ``` ``` ## agents/openai.yaml ```yaml interface: display_name: "CWE Code Review" short_description: "Run CWE reviews with stepwise PoCs" default_prompt: "Use $cwe-code-review to review this codebase, map confirmed findings to precise CWE entries, and create one stepwise PoC script per confirmed finding." ``` ## references ``` ``` ## references/cwe-catalog-metadata.json ```json { "catalog": { "date": "2026-04-30", "name": "CWE", "namespace": "http://cwe.mitre.org/cwe-7", "schema_location": "http://cwe.mitre.org/cwe-7 http://cwe.mitre.org/data/xsd/cwe_schema_v7.3.xsd", "version": "4.20" }, "categories": { "1": { "id": "1", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Location", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "10": { "id": "10", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: ASP.NET Environment Issues", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It added unnecessary depth and complexity to its associated views." }, "100": { "id": "100", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Technology-Specific Input Validation Problems", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally intended as a \"catch-all\" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy." }, "1001": { "id": "1001", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Use of an Improper API", "relationships": [ { "cwe_id": "111", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "227", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "242", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "245", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "246", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "382", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "383", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "432", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "439", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "440", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "474", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "479", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "558", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "572", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "573", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "574", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "575", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "576", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "577", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "578", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "586", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "589", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "617", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "684", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "695", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Use of an Improper API cluster (SFP3)." }, "1002": { "id": "1002", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Unexpected Entry Points", "relationships": [ { "cwe_id": "489", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "491", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "493", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "500", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "531", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "568", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "580", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "582", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "583", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "608", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "766", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Unexpected Entry Points cluster." }, "1005": { "id": "1005", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - Input Validation and Representation", "relationships": [ { "cwe_id": "20", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "700" } ], "status": "Draft", "summary": "This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, \"Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input.\"" }, "1006": { "id": "1006", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Bad Coding Practices", "relationships": [ { "cwe_id": "358", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "360", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "478", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "487", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "489", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "547", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "561", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "562", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "563", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "581", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "586", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "605", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "654", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "656", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "694", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1041", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1043", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1044", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1045", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1046", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1048", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1049", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1050", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1063", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1065", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1066", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1067", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1070", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1071", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1072", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1073", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1079", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1082", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1084", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1085", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1087", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1089", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1092", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1094", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1097", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1098", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1099", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1101", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1102", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1103", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1104", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1106", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1107", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1108", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1109", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1113", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1114", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1115", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1116", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1117", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1126", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1127", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1235", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code." }, "1009": { "id": "1009", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Audit", "relationships": [ { "cwe_id": "117", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "223", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "224", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "778", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "779", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of audit-based components of the system. Frequently these deal with logging user activities in order to identify attackers and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed when designing or implementing a secure architecture." }, "101": { "id": "101", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Struts Validation Problems", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "1010": { "id": "1010", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Authenticate Actors", "relationships": [ { "cwe_id": "258", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "262", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "263", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "288", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "289", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "290", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "291", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "293", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "294", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "301", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "302", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "303", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "304", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "305", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "322", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "593", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "603", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "836", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "916", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of authentication components of the system. Frequently these deal with verifying the entity is indeed who it claims to be. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture." }, "1011": { "id": "1011", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Authorize Actors", "relationships": [ { "cwe_id": "114", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "15", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "219", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "220", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "267", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "270", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "271", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "273", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "274", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "277", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "280", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "281", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "282", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "283", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "286", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "300", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "341", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "403", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "419", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "420", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "527", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "528", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "529", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "530", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "538", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "551", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "566", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "642", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "647", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "653", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "656", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "668", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "669", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "671", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "673", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "708", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "782", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "827", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "921", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "923", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "939", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "942", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of a system's authorization components. Frequently these deal with enforcing that agents have the required permissions before performing certain operations, such as modifying data. The weaknesses in this category could lead to a degradation of quality of the authorization capability if they are not addressed when designing or implementing a secure architecture." }, "1012": { "id": "1012", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Cross Cutting", "relationships": [ { "cwe_id": "208", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "392", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "460", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "544", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "784", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of multiple security tactics and how they affect a system. For example, information exposure can impact the Limit Access and Limit Exposure security tactics. The weaknesses in this category could lead to a degradation of the quality of many capabilities if they are not addressed when designing or implementing a secure architecture." }, "1013": { "id": "1013", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Encrypt Data", "relationships": [ { "cwe_id": "256", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "257", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "260", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "261", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "313", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "314", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "315", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "316", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "317", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "318", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "323", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "332", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "333", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "334", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "339", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "757", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "759", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "760", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "780", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "922", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture." }, "1014": { "id": "1014", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Identify Actors", "relationships": [ { "cwe_id": "295", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "296", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "297", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "298", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "299", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "345", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "370", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "441", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "599", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "940", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "941", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of a system's identification management components. Frequently these deal with verifying that external agents provide inputs into the system. The weaknesses in this category could lead to a degradation of the quality of identification management if they are not addressed when designing or implementing a secure architecture." }, "1015": { "id": "1015", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Limit Access", "relationships": [ { "cwe_id": "201", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "212", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "243", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "250", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "610", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "73", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of system resources. Frequently these deal with restricting the amount of resources that are accessed by actors, such as memory, network connections, CPU or access points. The weaknesses in this category could lead to a degradation of the quality of authentication if they are not addressed when designing or implementing a secure architecture." }, "1016": { "id": "1016", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Limit Exposure", "relationships": [ { "cwe_id": "210", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "211", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "214", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "550", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "830", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of the entry points to a system. Frequently these deal with minimizing the attack surface through designing the system with the least needed amount of entry points. The weaknesses in this category could lead to a degradation of a system's defenses if they are not addressed when designing or implementing a secure architecture." }, "1017": { "id": "1017", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Lock Computer", "relationships": [ { "cwe_id": "645", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of a system's lockout mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts to access a given resource. The weaknesses in this category could lead to a degradation of access to system assets if they are not addressed when designing or implementing a secure architecture." }, "1018": { "id": "1018", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Manage User Sessions", "relationships": [ { "cwe_id": "384", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "488", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "579", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "6", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed when designing or implementing a secure architecture." }, "1019": { "id": "1019", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Validate Inputs", "relationships": [ { "cwe_id": "138", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "150", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "473", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "641", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "652", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "74", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "75", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "76", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "790", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "791", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "792", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "793", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "794", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "795", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "796", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "797", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "93", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "943", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "96", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "97", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "98", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of a system's input validation components. Frequently these deal with sanitizing, neutralizing and validating any externally provided inputs to minimize malformed data from entering the system and preventing code injection in the input data. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed when designing or implementing a secure architecture." }, "1020": { "id": "1020", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Verify Message Integrity", "relationships": [ { "cwe_id": "353", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "354", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "565", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "649", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "707", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "755", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "924", "kind": "Has_Member", "view_id": "1008" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and architecture of a system's data integrity components. Frequently these deal with ensuring integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed when designing or implementing a secure architecture." }, "1027": { "id": "1027", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A1 - Injection", "relationships": [ { "cwe_id": "77", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "564", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "917", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "943", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2017." }, "1028": { "id": "1028", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A2 - Broken Authentication", "relationships": [ { "cwe_id": "287", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "256", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2017." }, "1029": { "id": "1029", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure", "relationships": [ { "cwe_id": "220", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "320", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2017." }, "1030": { "id": "1030", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)", "relationships": [ { "cwe_id": "611", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "776", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2017." }, "1031": { "id": "1031", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A5 - Broken Access Control", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2017." }, "1032": { "id": "1032", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A6 - Security Misconfiguration", "relationships": [ { "cwe_id": "16", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "548", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2017." }, "1033": { "id": "1033", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)", "relationships": [ { "cwe_id": "79", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2017." }, "1034": { "id": "1034", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A8 - Insecure Deserialization", "relationships": [ { "cwe_id": "502", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2017." }, "1035": { "id": "1035", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2017." }, "1036": { "id": "1036", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring", "relationships": [ { "cwe_id": "223", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "778", "kind": "Has_Member", "view_id": "1026" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2017." }, "1129": { "id": "1129", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures (2016) - Reliability", "relationships": [ { "cwe_id": "120", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "396", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "674", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "788", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1045", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1047", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1051", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1056", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1058", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1062", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1065", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1066", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1069", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1070", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1077", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1079", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1082", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1083", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1087", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1088", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1097", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1096", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1098", "kind": "Has_Member", "view_id": "1128" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Reliability, as documented in 2016 with the Automated Source Code CISQ Reliability Measure (ASCRM) Specification 1.0. Presence of these weaknesses could reduce the reliability of the software." }, "1130": { "id": "1130", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures (2016) - Maintainability", "relationships": [ { "cwe_id": "561", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1041", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1044", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1047", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1048", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1052", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1054", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1055", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1064", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1074", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1075", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1080", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "766", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1084", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1085", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1086", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1090", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1092", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1095", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1121", "kind": "Has_Member", "view_id": "1128" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Maintainability, as documented in 2016 with the Automated Source Code Maintainability Measure (ASCMM) Specification 1.0. Presence of these weaknesses could reduce the maintainability of the software." }, "1131": { "id": "1131", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures (2016) - Security", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "396", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "789", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "835", "kind": "Has_Member", "view_id": "1128" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software." }, "1132": { "id": "1132", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures (2016) - Performance Efficiency", "relationships": [ { "cwe_id": "1042", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1043", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1046", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1049", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1050", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1057", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1060", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1063", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1067", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1072", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1073", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1089", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1091", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1094", "kind": "Has_Member", "view_id": "1128" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Performance Efficiency, as documented in 2016 with the Automated Source Code Performance Efficiency Measure (ASCPEM) Specification 1.0. Presence of these weaknesses could reduce the performance efficiency of the software." }, "1134": { "id": "1134", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)", "relationships": [ { "cwe_id": "116", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "180", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "289", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "117", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "144", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "150", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "409", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "182", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1135": { "id": "1135", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL)", "relationships": [ { "cwe_id": "665", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1136": { "id": "1136", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)", "relationships": [ { "cwe_id": "252", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "597", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "595", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1137": { "id": "1137", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM)", "relationships": [ { "cwe_id": "190", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "191", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1138": { "id": "1138", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR)", "relationships": [ { "cwe_id": "838", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1139": { "id": "1139", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)", "relationships": [ { "cwe_id": "374", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "375", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "486", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "491", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "492", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "498", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "500", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "766", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1140": { "id": "1140", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)", "relationships": [ { "cwe_id": "617", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "589", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "697", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "581", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "573", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "586", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "583", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "568", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1141": { "id": "1141", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR)", "relationships": [ { "cwe_id": "460", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "584", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "382", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1142": { "id": "1142", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA)", "relationships": [ { "cwe_id": "362", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "413", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "567", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1143": { "id": "1143", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK)", "relationships": [ { "cwe_id": "412", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "609", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "820", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1144": { "id": "1144", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI)", "relationships": [ { "cwe_id": "572", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Thread APIs (THI) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1145": { "id": "1145", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)", "relationships": [ { "cwe_id": "392", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "405", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "410", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1146": { "id": "1146", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM)", "relationships": [], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Thread-Safety Miscellaneous (TSM) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1147": { "id": "1147", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO)", "relationships": [ { "cwe_id": "67", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "180", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "198", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "405", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "647", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1148": { "id": "1148", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER)", "relationships": [ { "cwe_id": "319", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "499", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1149": { "id": "1149", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC)", "relationships": [ { "cwe_id": "266", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1150": { "id": "1150", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV)", "relationships": [ { "cwe_id": "349", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1151": { "id": "1151", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI)", "relationships": [ { "cwe_id": "111", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Java Native Interface (JNI) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1152": { "id": "1152", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)", "relationships": [ { "cwe_id": "259", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "332", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "401", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1133" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1153": { "id": "1153", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD)", "relationships": [], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Android (DRD) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1155": { "id": "1155", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE)", "relationships": [], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) section of the SEI CERT C Coding Standard." }, "1156": { "id": "1156", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL)", "relationships": [ { "cwe_id": "562", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT C Coding Standard." }, "1157": { "id": "1157", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)", "relationships": [ { "cwe_id": "758", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "908", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "690", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "685", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "843", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "481", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT C Coding Standard." }, "1158": { "id": "1158", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 04. Integers (INT)", "relationships": [ { "cwe_id": "190", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "191", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "680", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "192", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "194", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "195", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "587", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT C Coding Standard." }, "1159": { "id": "1159", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)", "relationships": [ { "cwe_id": "682", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) section of the SEI CERT C Coding Standard." }, "1160": { "id": "1160", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "786", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "123", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "469", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "121", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "468", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) section of the SEI CERT C Coding Standard." }, "1161": { "id": "1161", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR)", "relationships": [ { "cwe_id": "120", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "121", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "122", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "123", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT C Coding Standard." }, "1162": { "id": "1162", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)", "relationships": [ { "cwe_id": "416", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "666", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "415", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "401", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "771", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "590", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "680", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "467", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "789", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) section of the SEI CERT C Coding Standard." }, "1163": { "id": "1163", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)", "relationships": [ { "cwe_id": "134", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "67", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "241", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "664", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "773", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "775", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "771", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "910", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "666", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "685", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT C Coding Standard." }, "1165": { "id": "1165", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 10. Environment (ENV)", "relationships": [ { "cwe_id": "705", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) section of the SEI CERT C Coding Standard." }, "1166": { "id": "1166", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 11. Signals (SIG)", "relationships": [ { "cwe_id": "479", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) section of the SEI CERT C Coding Standard." }, "1167": { "id": "1167", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)", "relationships": [ { "cwe_id": "456", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "253", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) section of the SEI CERT C Coding Standard." }, "1168": { "id": "1168", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API)", "relationships": [], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Application Programming Interfaces (API) section of the SEI CERT C Coding Standard." }, "1169": { "id": "1169", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON)", "relationships": [ { "cwe_id": "667", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT C Coding Standard." }, "1170": { "id": "1170", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)", "relationships": [ { "cwe_id": "327", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT C Coding Standard." }, "1171": { "id": "1171", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)", "relationships": [ { "cwe_id": "170", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "242", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "363", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "696", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "273", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "253", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) section of the SEI CERT C Coding Standard." }, "1172": { "id": "1172", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN)", "relationships": [ { "cwe_id": "762", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "590", "kind": "Has_Member", "view_id": "1154" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Microsoft Windows (WIN) section of the SEI CERT C Coding Standard." }, "1175": { "id": "1175", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON)", "relationships": [], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT Oracle Secure Coding Standard for Java." }, "1179": { "id": "1179", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS)", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "789", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "116", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "1178" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Perl Coding Standard." }, "1180": { "id": "1180", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL)", "relationships": [ { "cwe_id": "628", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "457", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "1178" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Perl Coding Standard." }, "1181": { "id": "1181", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP)", "relationships": [ { "cwe_id": "394", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "460", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "690", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "375", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "597", "kind": "Has_Member", "view_id": "1178" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Perl Coding Standard." }, "1182": { "id": "1182", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT)", "relationships": [ { "cwe_id": "189", "kind": "Has_Member", "view_id": "1178" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Integers (INT) section of the SEI CERT Perl Coding Standard." }, "1183": { "id": "1183", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 05. Strings (STR)", "relationships": [], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Strings (STR) section of the SEI CERT Perl Coding Standard." }, "1184": { "id": "1184", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 06. Object-Oriented Programming (OOP)", "relationships": [ { "cwe_id": "767", "kind": "Has_Member", "view_id": "1178" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Object-Oriented Programming (OOP) section of the SEI CERT Perl Coding Standard." }, "1185": { "id": "1185", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 07. File Input and Output (FIO)", "relationships": [ { "cwe_id": "59", "kind": "Has_Member", "view_id": "1178" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the File Input and Output (FIO) section of the SEI CERT Perl Coding Standard." }, "1186": { "id": "1186", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)", "relationships": [ { "cwe_id": "561", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "563", "kind": "Has_Member", "view_id": "1178" } ], "status": "Stable", "summary": "Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Perl Coding Standard." }, "1195": { "id": "1195", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Manufacturing and Life Cycle Management Concerns", "relationships": [ { "cwe_id": "1059", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1248", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1266", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1269", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1273", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1297", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are root-caused to defects that arise in the semiconductor-manufacturing process or during the life cycle and supply chain." }, "1196": { "id": "1196", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Security Flow Issues", "relationships": [ { "cwe_id": "1190", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1193", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1264", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1274", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1283", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1310", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1326", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1328", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper design of full-system security flows, including but not limited to secure boot, secure update, and hardware-device attestation." }, "1197": { "id": "1197", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Integration Issues", "relationships": [ { "cwe_id": "1276", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are those that arise due to integration of multiple hardware Intellectual Property (IP) cores, from System-on-a-Chip (SoC) subsystem interactions, or from hardware platform subsystem interactions." }, "1198": { "id": "1198", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Privilege Separation and Access Control Issues", "relationships": [ { "cwe_id": "276", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "441", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1189", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1192", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1220", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1222", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1242", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1260", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1262", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1267", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1268", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1280", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1294", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1299", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1302", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1303", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1314", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1318", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1334", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1420", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to features and mechanisms providing hardware-based isolation and access control (e.g., identity, policy, locking control) of sensitive shared hardware resources such as registers and fuses." }, "1199": { "id": "1199", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "General Circuit and Logic Design Concerns", "relationships": [ { "cwe_id": "1209", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1221", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1223", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1224", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1231", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1232", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1233", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1234", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1245", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1250", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1253", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1254", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1261", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1298", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to hardware-circuit design and logic (e.g., CMOS transistors, finite state machines, and registers) as well as issues related to hardware description languages such as System Verilog and VHDL." }, "1201": { "id": "1201", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Core and Compute Issues", "relationships": [ { "cwe_id": "1252", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1281", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1342", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1420", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are typically associated with CPUs, Graphics, Vision, AI, FPGA, and microcontrollers." }, "1202": { "id": "1202", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Memory and Storage Issues", "relationships": [ { "cwe_id": "226", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1246", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1251", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1257", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1282", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1420", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are typically associated with memory (e.g., DRAM, SRAM) and storage technologies (e.g., NAND Flash, OTP, EEPROM, and eMMC)." }, "1203": { "id": "1203", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Peripherals, On-chip Fabric, and Interface/IO Problems", "relationships": [ { "cwe_id": "1311", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1312", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1315", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1316", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1317", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1331", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to hardware security problems that apply to peripheral devices, IO interfaces, on-chip interconnects, network-on-chip (NoC), and buses. For example, this category includes issues related to design of hardware interconnect and/or protocols such as PCIe, USB, SMBUS, general-purpose IO pins, and user-input peripherals such as mouse and keyboard." }, "1205": { "id": "1205", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Security Primitives and Cryptography Issues", "relationships": [ { "cwe_id": "203", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1240", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1241", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1279", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1351", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1431", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to hardware implementations of cryptographic protocols and other hardware-security primitives such as physical unclonable functions (PUFs) and random number generators (RNGs)." }, "1206": { "id": "1206", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Power, Clock, Thermal, and Reset Concerns", "relationships": [ { "cwe_id": "1232", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1247", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1248", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1255", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1256", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1271", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1304", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1314", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1320", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1332", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1338", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to system power, voltage, current, temperature, clocks, system state saving/restoring, and resets at the platform and SoC level." }, "1207": { "id": "1207", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Debug and Test Problems", "relationships": [ { "cwe_id": "1191", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1234", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1243", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1244", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1258", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1272", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1291", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1295", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1296", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1313", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1323", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to hardware debug and test interfaces such as JTAG and scan chain." }, "1208": { "id": "1208", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Cross-Cutting Problems", "relationships": [ { "cwe_id": "440", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1053", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1059", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1263", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1277", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1301", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1329", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1357", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1429", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category can arise in multiple areas of hardware design or can apply to a wide cross-section of components." }, "1210": { "id": "1210", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Audit / Logging Errors", "relationships": [ { "cwe_id": "117", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "222", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "223", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "224", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "778", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "779", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to audit-based components of a software system. Frequently these deal with logging user activities in order to identify undesired access and modifications to the system. The weaknesses in this category could lead to a degradation of the quality of the audit capability if they are not addressed." }, "1211": { "id": "1211", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Authentication Errors", "relationships": [ { "cwe_id": "289", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "290", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "294", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "301", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "303", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "305", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "309", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "322", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "603", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "645", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "804", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "836", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to authentication components of a system. Frequently these deal with the ability to verify that an entity is indeed who it claims to be. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authentication capability." }, "1212": { "id": "1212", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Authorization Errors", "relationships": [ { "cwe_id": "425", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "551", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "653", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "939", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "842", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1220", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1230", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to authorization components of a system. Frequently these deal with the ability to enforce that agents have the required permissions before performing certain operations, such as modifying data. If not addressed when designing or implementing a software system, these weaknesses could lead to a degradation of the quality of the authorization capability." }, "1213": { "id": "1213", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Random Number Issues", "relationships": [ { "cwe_id": "331", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "334", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "341", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "342", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "343", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "344", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1241", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to a software system's random number generation." }, "1214": { "id": "1214", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Data Integrity Issues", "relationships": [ { "cwe_id": "322", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "348", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "351", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "353", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "354", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "565", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "649", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "924", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to a software system's data integrity components. Frequently these deal with the ability to ensure the integrity of data, such as messages, resource files, deployment files, and configuration files. The weaknesses in this category could lead to a degradation of data integrity quality if they are not addressed." }, "1215": { "id": "1215", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Data Validation Issues", "relationships": [ { "cwe_id": "112", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "179", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "183", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "184", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "641", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1173", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1284", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1285", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1286", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1287", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1288", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1289", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product \"safe\" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed." }, "1216": { "id": "1216", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Lockout Mechanism Errors", "relationships": [ { "cwe_id": "645", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to a software system's lockout mechanism. Frequently these deal with scenarios that take effect in case of multiple failed attempts to access a given resource. The weaknesses in this category could lead to a degradation of access to system assets if they are not addressed." }, "1217": { "id": "1217", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "User Session Errors", "relationships": [ { "cwe_id": "488", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to session management. Frequently these deal with the information or status about each user and their access rights for the duration of multiple requests. The weaknesses in this category could lead to a degradation of the quality of session management if they are not addressed." }, "1218": { "id": "1218", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Memory Buffer Errors", "relationships": [ { "cwe_id": "120", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "124", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "786", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "787", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "788", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1284", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the handling of memory buffers within a software system." }, "1219": { "id": "1219", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "File Handling Issues", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "41", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "66", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "378", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "379", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "427", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "428", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the handling of files within a software system. Files, directories, and folders are so central to information technology that many different weaknesses and variants have been discovered." }, "1225": { "id": "1225", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Documentation Issues", "relationships": [ { "cwe_id": "1053", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1068", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1110", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1111", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1112", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1118", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the documentation provided to support, create, or analyze a product." }, "1226": { "id": "1226", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Complexity Issues", "relationships": [ { "cwe_id": "1043", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1047", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1055", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1056", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1060", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1064", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1074", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1075", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1080", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1086", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1095", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1119", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1121", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1122", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1123", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1124", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1125", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1333", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are associated with things being overly complex." }, "1227": { "id": "1227", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Encapsulation Issues", "relationships": [ { "cwe_id": "1054", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1057", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1062", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1083", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1090", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1100", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1105", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to issues surrounding the bundling of data with the methods intended to operate on that data." }, "1228": { "id": "1228", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "API / Function Errors", "relationships": [ { "cwe_id": "242", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "474", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "475", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "695", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "749", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the use of built-in functions or external APIs." }, "1237": { "id": "1237", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Faulty Resource Release", "relationships": [ { "cwe_id": "415", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "762", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "763", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Release cluster (SFP37)." }, "1238": { "id": "1238", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Failure to Release Memory", "relationships": [ { "cwe_id": "401", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Failure to Release Memory cluster (SFP38)." }, "1306": { "id": "1306", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures - Reliability", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "394", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "424", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "484", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "562", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "595", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "835", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "908", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1045", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1051", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1066", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1070", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1077", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1079", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1082", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1083", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1087", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1088", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1098", "kind": "Has_Member", "view_id": "1305" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software." }, "1307": { "id": "1307", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures - Maintainability", "relationships": [ { "cwe_id": "407", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "478", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "484", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "561", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "570", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "571", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1041", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1045", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1047", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1048", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1051", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1052", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1054", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1055", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1062", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1064", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1074", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1075", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1079", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1080", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1084", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1085", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1086", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1087", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1090", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1095", "kind": "Has_Member", "view_id": "1305" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software." }, "1308": { "id": "1308", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures - Security", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "424", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "570", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "571", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "652", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "778", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "789", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "835", "kind": "Has_Member", "view_id": "1305" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software." }, "1309": { "id": "1309", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CISQ Quality Measures - Efficiency", "relationships": [ { "cwe_id": "404", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "424", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1042", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1043", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1046", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1049", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1050", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1057", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1060", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1067", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1072", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1073", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1089", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1091", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1094", "kind": "Has_Member", "view_id": "1305" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the CISQ Quality Measures for Efficiency. Presence of these weaknesses could reduce the efficiency of the software." }, "133": { "id": "133", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "String Errors", "relationships": [ { "cwe_id": "134", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "135", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the creation and modification of strings." }, "1345": { "id": "1345", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A01:2021 - Broken Access Control", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "23", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "35", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "201", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "219", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "264", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "275", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "402", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "441", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "538", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "540", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "548", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "566", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "651", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "668", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "706", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "913", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "922", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1275", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A01 category \"Broken Access Control\" in the OWASP Top Ten 2021." }, "1346": { "id": "1346", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures", "relationships": [ { "cwe_id": "261", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "296", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "310", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "322", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "323", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "329", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "340", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "720", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "757", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "759", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "760", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "780", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "818", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "916", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A02 category \"Cryptographic Failures\" in the OWASP Top Ten 2021." }, "1347": { "id": "1347", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A03:2021 - Injection", "relationships": [ { "cwe_id": "20", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "74", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "75", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "80", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "83", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "87", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "93", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "96", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "97", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "98", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "113", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "116", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "138", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "184", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "471", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "564", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "610", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "644", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "652", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "917", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A03 category \"Injection\" in the OWASP Top Ten 2021." }, "1348": { "id": "1348", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A04:2021 - Insecure Design", "relationships": [ { "cwe_id": "73", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "183", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "213", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "235", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "256", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "257", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "280", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "313", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "316", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "419", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "430", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "444", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "451", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "501", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "525", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "539", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "579", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "598", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "642", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "646", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "650", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "653", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "656", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "657", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "799", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "840", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "927", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1021", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1173", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A04 \"Insecure Design\" category in the OWASP Top Ten 2021." }, "1349": { "id": "1349", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration", "relationships": [ { "cwe_id": "2", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "11", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "13", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "15", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "16", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "260", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "315", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "520", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "526", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "537", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "541", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "547", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "614", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "756", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "776", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "942", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1004", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1032", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1174", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A05 category \"Security Misconfiguration\" in the OWASP Top Ten 2021." }, "1352": { "id": "1352", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components", "relationships": [ { "cwe_id": "937", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1035", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1104", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A06 category \"Vulnerable and Outdated Components\" in the OWASP Top Ten 2021." }, "1353": { "id": "1353", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures", "relationships": [ { "cwe_id": "255", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "288", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "290", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "294", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "297", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "300", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "302", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "304", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "940", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1216", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A07 category \"Identification and Authentication Failures\" in the OWASP Top Ten 2021." }, "1354": { "id": "1354", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures", "relationships": [ { "cwe_id": "345", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "353", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "565", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "784", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "830", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "915", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A08 category \"Software and Data Integrity Failures\" in the OWASP Top Ten 2021." }, "1355": { "id": "1355", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures", "relationships": [ { "cwe_id": "117", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "223", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "778", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A09 category \"Security Logging and Monitoring Failures\" in the OWASP Top Ten 2021." }, "1356": { "id": "1356", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF)", "relationships": [ { "cwe_id": "918", "kind": "Has_Member", "view_id": "1344" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A10 category \"Server-Side Request Forgery (SSRF)\" in the OWASP Top Ten 2021." }, "1359": { "id": "1359", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Communications", "relationships": [ { "cwe_id": "1364", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1365", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1366", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"ICS Communications\" super category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022." }, "136": { "id": "136", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Type Errors", "relationships": [ { "cwe_id": "681", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "843", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1287", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are caused by improper data type transformation or improper handling of multiple data types." }, "1360": { "id": "1360", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Dependencies (& Architecture)", "relationships": [ { "cwe_id": "1367", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1368", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"ICS Dependencies (& Architecture)\" super category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022." }, "1361": { "id": "1361", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Supply Chain", "relationships": [ { "cwe_id": "1369", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1370", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1371", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1372", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"ICS Supply Chain\" super category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022." }, "1362": { "id": "1362", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Engineering (Constructions/Deployment)", "relationships": [ { "cwe_id": "1373", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1374", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1375", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1376", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1377", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"ICS Engineering (Constructions/Deployment)\" super category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022." }, "1363": { "id": "1363", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Operations (& Maintenance)", "relationships": [ { "cwe_id": "1378", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1379", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1380", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1381", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1382", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1383", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"ICS Operations (& Maintenance)\" super category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022." }, "1364": { "id": "1364", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Communications: Zone Boundary Failures", "relationships": [ { "cwe_id": "212", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "288", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "501", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "668", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "669", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1189", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1263", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1303", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1393", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Zone Boundary Failures\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Within an ICS system, for traffic that crosses through network zone boundaries, vulnerabilities arise when those boundaries were designed for safety or other purposes but are being repurposed for security.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1365": { "id": "1365", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Communications: Unreliability", "relationships": [ { "cwe_id": "121", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1247", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1261", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1332", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1351", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1384", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Unreliability\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Vulnerabilities arise in reaction to disruptions in the physical layer (e.g. creating electrical noise) used to carry the traffic.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1366": { "id": "1366", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Communications: Frail Security in Protocols", "relationships": [ { "cwe_id": "121", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "290", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "341", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "358", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "648", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "787", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1189", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1303", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1393", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Frail Security in Protocols\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Vulnerabilities arise as a result of mis-implementation or incomplete implementation of security in ICS implementations of communication protocols.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1367": { "id": "1367", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Dependencies (& Architecture): External Physical Systems", "relationships": [ { "cwe_id": "1247", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1338", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1357", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1384", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"External Physical Systems\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Due to the highly interconnected technologies in use, an external dependency on another physical system could cause an availability interruption for the protected system.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1368": { "id": "1368", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Dependencies (& Architecture): External Digital Systems", "relationships": [ { "cwe_id": "15", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "440", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "603", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "610", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "638", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1059", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1068", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1104", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1329", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1357", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1393", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"External Digital Systems\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Due to the highly interconnected technologies in use, an external dependency on another digital system could cause a confidentiality, integrity, or availability incident for the protected system.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1369": { "id": "1369", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Supply Chain: IT/OT Convergence/Expansion", "relationships": [ { "cwe_id": "636", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"IT/OT Convergence/Expansion\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"The increased penetration of DER devices and smart loads make emerging ICS networks more like IT networks and thus susceptible to vulnerabilities similar to those of IT networks.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "137": { "id": "137", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Data Neutralization Issues", "relationships": [ { "cwe_id": "76", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "93", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "117", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "140", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "463", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "464", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "641", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "694", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "791", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "838", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "917", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1236", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the creation or neutralization of data using an incorrect format." }, "1370": { "id": "1370", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Supply Chain: Common Mode Frailties", "relationships": [ { "cwe_id": "664", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "707", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "710", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1357", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "329", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "693", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Common Mode Frailties\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"At the component level, most ICS systems are assembled from common parts made by other companies. One or more of these common parts might contain a vulnerability that could result in a wide-spread incident.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1371": { "id": "1371", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Supply Chain: Poorly Documented or Undocumented Features", "relationships": [ { "cwe_id": "489", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "912", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1059", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1242", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Poorly Documented or Undocumented Features\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Undocumented capabilities and configurations pose a risk by not having a clear understanding of what the device is specifically supposed to do and only do. Therefore possibly opening up the attack surface and vulnerabilities.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1372": { "id": "1372", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Supply Chain: OT Counterfeit and Malicious Corruption", "relationships": [ { "cwe_id": "1278", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1198", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1231", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1233", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"OT Counterfeit and Malicious Corruption\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"In ICS, when this procurement process results in a vulnerability or component damage, it can have grid impacts or cause physical harm.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1373": { "id": "1373", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Engineering (Construction/Deployment): Trust Model Problems", "relationships": [ { "cwe_id": "269", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Trust Model Problems\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Assumptions made about the user during the design or construction phase may result in vulnerabilities after the system is installed if the user operates it using a different security approach or process than what was designed or built.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1374": { "id": "1374", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Engineering (Construction/Deployment): Maker Breaker Blindness", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Maker Breaker Blindness\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Lack of awareness of deliberate attack techniques by people (vs failure modes from natural causes like weather or metal fatigue) may lead to insufficient security controls being built into ICS systems.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1375": { "id": "1375", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Engineering (Construction/Deployment): Gaps in Details/Data", "relationships": [ { "cwe_id": "1059", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1110", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "710", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1053", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1111", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Gaps in Details/Data\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Highly complex systems are often operated by personnel who have years of experience in managing that particular facility or plant. Much of their knowledge is passed along through verbal or hands-on training but may not be fully documented in written practices and procedures.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1376": { "id": "1376", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Engineering (Construction/Deployment): Security Gaps in Commissioning", "relationships": [ { "cwe_id": "276", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1393", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Security Gaps in Commissioning\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"As a large system is brought online components of the system may remain vulnerable until the entire system is operating and functional and security controls are put in place. This creates a window of opportunity for an adversary during the commissioning process.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1377": { "id": "1377", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Engineering (Construction/Deployment): Inherent Predictability in Design", "relationships": [ { "cwe_id": "1278", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Inherent Predictability in Design\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"The commonality of design (in ICS/SCADA architectures) for energy systems and environments opens up the possibility of scaled compromise by leveraging the inherent predictability in the design.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1378": { "id": "1378", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Operations (& Maintenance): Gaps in obligations and training", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Gaps in obligations and training\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"OT ownership and responsibility for identifying and mitigating vulnerabilities are not clearly defined or communicated within an organization, leaving environments unpatched, exploitable, and with a broader attack surface.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1379": { "id": "1379", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Operations (& Maintenance): Human factors in ICS environments", "relationships": [ { "cwe_id": "655", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "451", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Human factors in ICS environments\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Environmental factors in ICS including physical duress, system complexities, and isolation may result in security gaps or inadequacies in the performance of individual duties and responsibilities.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1380": { "id": "1380", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Operations (& Maintenance): Post-analysis changes", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Post-analysis changes\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Changes made to a previously analyzed and approved ICS environment can introduce new security vulnerabilities (as opposed to safety).\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1381": { "id": "1381", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Operations (& Maintenance): Exploitable Standard Operational Procedures", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Exploitable Standard Operational Procedures\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"Standard ICS Operational Procedures developed for safety and operational functionality in a closed, controlled communications environment can introduce vulnerabilities in a more connected environment.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1382": { "id": "1382", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Operations (& Maintenance): Emerging Energy Technologies", "relationships": [ { "cwe_id": "20", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "296", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "406", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Emerging Energy Technologies\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"With the rapid evolution of the energy system accelerated by the emergence of new technologies such as DERs, electric vehicles, advanced communications (5G+), novel and diverse challenges arise for secure and resilient operation of the system.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1383": { "id": "1383", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements", "relationships": [ { "cwe_id": "710", "kind": "Has_Member", "view_id": "1358" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the \"Compliance/Conformance with Regulatory Requirements\" category from the SEI ETF \"Categories of Security Vulnerabilities in ICS\" as published in March 2022: \"The ICS environment faces overlapping regulatory regimes and authorities with multiple focus areas (e.g., operational resiliency, physical safety, interoperability, and security) which can result in cyber security vulnerabilities when implemented as written due to gaps in considerations, outdatedness, or conflicting requirements.\" Note: members of this category include \"Nearest IT Neighbor\" recommendations from the report, as well as suggestions by the CWE team. These relationships are likely to change in future CWE versions." }, "1388": { "id": "1388", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Physical Access Issues and Concerns", "relationships": [ { "cwe_id": "1384", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1319", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1247", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1261", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1332", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1351", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1278", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1255", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1300", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1248", "kind": "Has_Member", "view_id": "1194" } ], "status": "Draft", "summary": "Weaknesses in this category are related to concerns of physical access." }, "139": { "id": "139", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: General Special Element Problems", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It is a leftover from PLOVER, but CWE-138 is a more appropriate mapping." }, "1396": { "id": "1396", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Access Control", "relationships": [ { "cwe_id": "9", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "13", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "202", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "256", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "257", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "258", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "260", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "261", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "262", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "263", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "267", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "270", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "271", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "273", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "274", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "277", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "278", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "280", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "281", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "282", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "283", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "286", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "288", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "289", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "290", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "291", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "293", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "294", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "296", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "297", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "298", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "299", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "300", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "301", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "302", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "303", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "304", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "305", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "309", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "322", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "350", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "370", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "419", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "420", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "421", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "422", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "441", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "520", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "549", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "551", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "555", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "556", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "566", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "593", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "599", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "603", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "612", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "623", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "645", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "647", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "648", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "708", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "804", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "836", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "842", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "921", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "923", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "925", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "926", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "927", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "939", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "940", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "941", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "942", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1004", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1021", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1022", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1191", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1220", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1222", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1224", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1230", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1231", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1233", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1242", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1243", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1244", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1252", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1256", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1257", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1259", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1260", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1262", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1263", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1267", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1268", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1270", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1274", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1275", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1276", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1283", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1290", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1292", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1294", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1296", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1297", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1299", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1302", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1304", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1311", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1312", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1313", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1314", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1315", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1316", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1317", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1320", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1323", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1328", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1334", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1390", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1391", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1392", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1393", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1394", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to access control." }, "1397": { "id": "1397", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Comparison", "relationships": [ { "cwe_id": "183", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "185", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "186", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "187", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "478", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "486", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "595", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "597", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "625", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "697", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "777", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "839", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1023", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1024", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1025", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1077", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to comparison." }, "1398": { "id": "1398", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Component Interaction", "relationships": [ { "cwe_id": "14", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "115", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "435", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "436", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "437", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "439", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "444", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "650", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "733", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1037", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1038", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to component interaction." }, "1399": { "id": "1399", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Memory Safety", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "121", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "122", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "123", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "124", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "126", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "127", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "188", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "198", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "244", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "401", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "415", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "466", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "562", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "587", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "590", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "680", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "690", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "761", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "762", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "763", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "786", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "787", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "788", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "789", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "806", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "822", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "823", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "824", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "825", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to memory safety." }, "1401": { "id": "1401", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Concurrency", "relationships": [ { "cwe_id": "362", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "363", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "364", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "367", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "368", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "412", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "413", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "414", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "432", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "479", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "543", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "558", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "567", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "572", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "574", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "591", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "609", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "663", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "689", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "764", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "765", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "820", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "821", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "828", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "831", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "832", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "833", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1058", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1088", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1096", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1223", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1232", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1234", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1264", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1298", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to concurrency." }, "1402": { "id": "1402", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Encryption", "relationships": [ { "cwe_id": "5", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "313", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "314", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "315", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "316", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "317", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "318", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "614", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "759", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "760", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "780", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "916", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1240", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1428", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to encryption." }, "1403": { "id": "1403", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Exposed Resource", "relationships": [ { "cwe_id": "8", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "15", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "73", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "114", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "219", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "220", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "374", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "375", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "378", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "379", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "402", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "403", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "427", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "428", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "433", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "488", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "491", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "492", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "493", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "498", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "499", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "500", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "524", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "525", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "527", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "528", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "529", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "530", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "539", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "553", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "565", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "582", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "583", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "608", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "619", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "642", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "668", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "767", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "784", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1282", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1327", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to exposed resource." }, "1404": { "id": "1404", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: File Handling", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "23", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "24", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "25", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "26", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "27", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "28", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "29", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "30", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "31", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "32", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "33", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "34", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "35", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "36", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "37", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "38", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "39", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "40", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "41", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "42", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "43", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "44", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "45", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "46", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "47", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "48", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "49", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "50", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "51", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "52", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "53", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "54", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "55", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "56", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "57", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "58", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "61", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "62", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "64", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "65", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "66", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "67", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "69", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "72", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to file handling." }, "1405": { "id": "1405", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions", "relationships": [ { "cwe_id": "7", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "12", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "394", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "544", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "755", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "756", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1247", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1261", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1332", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1351", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1384", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to improper check or handling of exceptional conditions." }, "1406": { "id": "1406", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Improper Input Validation", "relationships": [ { "cwe_id": "20", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "105", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "106", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "108", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "109", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "112", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "554", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "622", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "781", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1173", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1174", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1284", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1285", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1286", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1287", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1288", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1289", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to improper input validation." }, "1407": { "id": "1407", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Improper Neutralization", "relationships": [ { "cwe_id": "116", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "117", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "130", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "138", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "140", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "141", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "142", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "143", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "144", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "145", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "146", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "147", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "148", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "149", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "150", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "151", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "152", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "153", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "154", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "155", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "156", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "157", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "158", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "159", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "160", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "161", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "162", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "163", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "164", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "165", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "166", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "167", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "168", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "172", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "173", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "174", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "175", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "176", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "177", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "228", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "229", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "230", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "231", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "232", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "233", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "234", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "235", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "236", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "237", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "238", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "239", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "240", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "241", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "463", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "464", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "626", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "644", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "707", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "790", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "791", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "792", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "793", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "794", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "795", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "796", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "797", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "838", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to improper neutralization." }, "1408": { "id": "1408", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Incorrect Calculation", "relationships": [ { "cwe_id": "128", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "135", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "191", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "193", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "467", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "468", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "469", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1335", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1339", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to incorrect calculation." }, "1409": { "id": "1409", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Injection", "relationships": [ { "cwe_id": "74", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "75", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "76", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "80", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "81", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "82", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "83", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "84", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "85", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "86", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "87", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "93", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "96", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "97", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "102", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "113", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "564", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "621", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "624", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "627", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "641", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "652", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "692", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "694", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "914", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "917", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "943", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1236", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1336", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1426", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1427", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to injection." }, "1410": { "id": "1410", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Insufficient Control Flow Management", "relationships": [ { "cwe_id": "179", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "180", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "181", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "382", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "395", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "396", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "408", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "430", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "431", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "455", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "481", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "482", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "483", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "584", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "600", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "617", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "670", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "674", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "691", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "696", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "698", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "768", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "799", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "834", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "835", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "837", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1190", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1193", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1265", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1280", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1281", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1322", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to insufficient control flow management." }, "1411": { "id": "1411", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Insufficient Verification of Data Authenticity", "relationships": [ { "cwe_id": "345", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "348", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "351", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "353", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "354", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "360", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "616", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "646", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "649", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "924", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1293", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1385", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to insufficient verification of data authenticity." }, "1412": { "id": "1412", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Poor Coding Practices", "relationships": [ { "cwe_id": "11", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "103", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "104", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "107", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "110", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "111", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "242", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "245", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "246", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "253", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "358", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "383", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "392", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "393", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "440", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "446", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "448", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "449", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "451", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "462", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "474", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "475", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "484", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "489", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "506", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "507", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "508", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "509", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "510", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "511", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "512", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "546", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "547", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "560", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "561", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "563", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "570", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "571", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "573", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "575", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "576", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "577", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "578", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "579", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "581", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "585", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "586", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "589", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "594", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "605", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "675", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "683", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "684", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "685", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "687", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "688", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "695", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "710", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "758", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "766", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "785", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "912", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1007", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1041", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1043", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1044", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1045", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1047", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1048", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1053", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1054", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1055", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1056", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1057", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1059", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1060", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1061", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1062", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1064", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1065", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1066", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1068", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1069", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1070", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1071", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1074", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1075", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1076", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1078", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1079", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1080", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1082", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1083", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1085", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1086", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1087", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1090", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1092", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1093", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1095", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1097", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1098", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1099", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1100", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1101", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1102", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1103", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1105", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1106", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1107", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1108", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1109", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1110", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1111", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1112", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1113", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1114", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1115", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1116", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1117", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1118", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1119", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1120", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1121", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1122", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1123", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1124", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1125", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1126", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1127", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1164", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1177", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1209", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1245", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1341", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1357", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1434", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to poor coding practices." }, "1413": { "id": "1413", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Protection Mechanism Failure", "relationships": [ { "cwe_id": "182", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "184", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "222", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "223", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "224", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "356", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "357", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "450", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "693", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "757", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "778", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1039", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1248", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1253", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1269", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1278", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1291", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1318", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1319", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1326", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1338", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1429", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to protection mechanism failure." }, "1414": { "id": "1414", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Randomness", "relationships": [ { "cwe_id": "6", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "323", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "329", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "332", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "333", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "334", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "339", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "340", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "341", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "342", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "343", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "344", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1204", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1241", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to randomness." }, "1415": { "id": "1415", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Resource Control", "relationships": [ { "cwe_id": "385", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "473", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "514", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "515", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "826", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "910", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "915", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1104", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1249", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1251", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1277", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1310", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1321", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1329", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to resource control." }, "1416": { "id": "1416", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Resource Lifecycle Management", "relationships": [ { "cwe_id": "98", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "118", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "178", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "192", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "194", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "195", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "196", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "212", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "221", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "226", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "243", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "372", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "386", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "405", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "406", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "407", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "409", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "410", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "453", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "454", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "457", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "460", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "471", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "487", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "495", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "496", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "501", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "568", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "580", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "588", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "607", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "610", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "618", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "664", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "666", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "669", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "673", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "706", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "749", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "771", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "773", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "774", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "775", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "776", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "779", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "782", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "827", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "830", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "843", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "908", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "909", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "911", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "913", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "920", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "922", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1042", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1046", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1049", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1050", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1051", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1052", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1063", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1067", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1072", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1073", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1084", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1089", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1091", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1094", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1176", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1188", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1221", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1229", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1235", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1239", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1246", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1250", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1258", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1266", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1271", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1272", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1279", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1301", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1325", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1330", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1333", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1342", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1386", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1389", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1419", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1420", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1421", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1422", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1423", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to resource lifecycle management." }, "1417": { "id": "1417", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Sensitive Information Exposure", "relationships": [ { "cwe_id": "200", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "201", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "203", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "204", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "205", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "206", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "207", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "208", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "210", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "211", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "213", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "214", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "215", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "526", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "531", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "535", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "536", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "537", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "538", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "540", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "541", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "548", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "550", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "598", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "615", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "651", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1254", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1255", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1273", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1295", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1300", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1431", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to sensitive information exposure." }, "1418": { "id": "1418", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1330].", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Comprehensive Categorization: Violation of Secure Design Principles", "relationships": [ { "cwe_id": "250", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "424", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "447", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "636", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "637", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "638", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "653", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "654", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "655", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "656", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "657", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "671", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1189", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1192", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1303", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1331", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1395", "kind": "Has_Member", "view_id": "1400" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to violation of secure design principles." }, "1433": { "id": "1433", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2025 MIHW Supplement: Expert Insights", "relationships": [ { "cwe_id": "1231", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1233", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1244", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1272", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1431", "kind": "Has_Member", "view_id": "1432" } ], "status": "Obsolete", "summary": "Weaknesses in this category were not included in the 2025 Most Important Hardware Weaknesses (MIHW) because they did not have sufficient weakness data to support their inclusion. However, they stand out as expert-driven selections. Each of these weaknesses received high scores from Subject Matter Experts, reflecting strong consensus among those with deep domain knowledge." }, "1436": { "id": "1436", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A01:2025 - Broken Access Control", "relationships": [ { "cwe_id": "1275", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "201", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "219", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "23", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "281", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "282", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "283", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "36", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "379", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "402", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "424", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "441", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "538", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "540", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "548", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "566", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "61", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "615", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "65", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "668", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "749", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "922", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A01 category \"Broken Access Control\" in the OWASP Top Ten 2025." }, "1437": { "id": "1437", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A02:2025 - Security Misconfiguration", "relationships": [ { "cwe_id": "1004", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "11", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1174", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "13", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "15", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "16", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "260", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "315", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "489", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "5", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "526", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "547", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "614", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "776", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "942", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A02 category \"Security Misconfiguration\" in the OWASP Top Ten 2025." }, "1438": { "id": "1438", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A03:2025 - Software Supply Chain Failures", "relationships": [ { "cwe_id": "1035", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1104", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1329", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1395", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "447", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A03 category \"Software Supply Chain Failures\" in the OWASP Top Ten 2025." }, "1439": { "id": "1439", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A04:2025 - Cryptographic Failures", "relationships": [ { "cwe_id": "1240", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1241", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "261", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "296", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "320", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "322", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "323", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "329", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "332", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "334", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "340", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "342", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "757", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "759", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "760", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "780", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "916", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A04 category \"Cryptographic Failures\" in the OWASP Top Ten 2025." }, "1440": { "id": "1440", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A05:2025 - Injection", "relationships": [ { "cwe_id": "103", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "104", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "112", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "113", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "114", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "115", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "116", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "159", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "493", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "500", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "564", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "610", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "644", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "74", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "76", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "80", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "83", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "86", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "917", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "93", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "96", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "97", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "98", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A05 category \"Injection\" in the OWASP Top Ten 2025." }, "1441": { "id": "1441", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A06:2025 - Insecure Design", "relationships": [ { "cwe_id": "1021", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1022", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1125", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "183", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "256", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "286", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "313", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "316", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "382", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "419", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "436", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "444", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "451", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "454", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "501", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "525", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "539", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "598", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "642", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "646", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "653", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "656", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "657", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "693", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "73", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "799", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A06 category \"Insecure Design\" in the OWASP Top Ten 2025." }, "1442": { "id": "1442", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A07:2025 - Authentication Failures", "relationships": [ { "cwe_id": "1390", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1391", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1392", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1393", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "258", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "288", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "289", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "290", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "291", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "293", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "294", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "297", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "298", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "299", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "300", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "302", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "303", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "304", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "305", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "309", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "350", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "940", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "941", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A07 category \"Authentication Failures\" in the OWASP Top Ten 2025." }, "1443": { "id": "1443", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A08:2025 - Software or Data Integrity Failures", "relationships": [ { "cwe_id": "345", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "353", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "427", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "506", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "509", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "565", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "784", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "830", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "915", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "926", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A08 category \"Software or Data Integrity Failures\" in the OWASP Top Ten 2025." }, "1444": { "id": "1444", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A09:2025 - Logging & Alerting Failures", "relationships": [ { "cwe_id": "117", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "221", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "223", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "778", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A09 category \"Logging & Alerting Failures\" in the OWASP Top Ten 2025." }, "1445": { "id": "1445", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2025 Category A10:2025 - Mishandling of Exceptional Conditions", "relationships": [ { "cwe_id": "209", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "215", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "234", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "235", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "274", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "280", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "394", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "396", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "460", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "478", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "484", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "550", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "636", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "755", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "756", "kind": "Has_Member", "view_id": "1450" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the A10 category \"Mishandling of Exceptional Conditions\" in the OWASP Top Ten 2025." }, "1446": { "id": "1446", "mapping": { "comments": "CWE users might be tempted to use this CWE for mapping, but it is a category (see Reasons). Mappers should consider whether a weakness is unique to AI/ML (in which case a high-level Pillar or class might still apply), or if it is a general software weakness that happens to appear in AI/ML related software.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Frequent Misuse" ], "suggestions": [], "usage": "Prohibited" }, "name": "Weaknesses That are Specific to AI/ML Technology", "relationships": [ { "cwe_id": "1039", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1426", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1427", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1434", "kind": "Has_Member", "view_id": "1448" } ], "status": "Incomplete", "summary": "This category identifies weaknesses that are uniquely applicable to AI/ML technology." }, "1447": { "id": "1447", "mapping": { "comments": "CWE users might be tempted to use this CWE for mapping, but it is a category (see Reasons). Mappers should consider whether a weakness is unique to AI/ML (in which case a high-level Pillar or class might still apply), or if it is a general software weakness that happens to appear in AI/ML related software.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Frequent Misuse" ], "suggestions": [], "usage": "Prohibited" }, "name": "General Software Weaknesses that Appear in Products that Use or Support AI/ML Technology", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "116", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "250", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1336", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1426", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1427", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1434", "kind": "Has_Member", "view_id": "1448" } ], "status": "Incomplete", "summary": "This category lists general software weaknesses in software that insecurely uses AI/ML components, but frequently appear in many kinds of software products that do not use AI/ML." }, "16": { "id": "16", "mapping": { "comments": "As of CWE 4.9, \"Configuration\" is beginning to be treated as an aspect of the SDLC in which a product is directed (by a human or automated process) to perform an insecure behavior. CWE mapping should be conducted by analyzing the weakness in the behavior that has been set by the configuration, such as those related to access control (descendants of CWE-284) or resource management (CWE-400), etc.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1287]. This CWE entry may have become widely-used because of NIST's usage in NVD from 2008 to 2016 (see CWE-635 view, updated to the CWE-1003 view in 2016). Mapping is also Prohibited because this entry's status is Obsolete.", "reasons": [ "Category", "Frequent Misuse" ], "suggestions": [], "usage": "Prohibited" }, "name": "Configuration", "relationships": [], "status": "Obsolete", "summary": "Weaknesses in this category are typically introduced during the configuration of the software." }, "169": { "id": "169", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Technology-Specific Special Elements", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally intended as a \"catch-all\" for input validation problems in technologies that did not have their own CWE, but introduces unnecessary depth to the hierarchy." }, "17": { "id": "17", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Code", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "171": { "id": "171", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Cleansing, Canonicalization, and Comparison Errors", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree. Weaknesses in this category were related to improper handling of data within protection mechanisms that attempt to perform neutralization for untrusted data. These weaknesses can be found in other similar categories." }, "18": { "id": "18", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Source Code", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "189": { "id": "189", "mapping": { "comments": "Most number-handling issues are probably descendants under Incorrect Calculation (CWE-682) or Incorrect Conversion between Numeric Types (CWE-681).", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1287]. This CWE ID may have become widely-used because of NIST's usage in NVD from 2008 to 2016 (see CWE-635 view, updated to the CWE-1003 view in 2016).", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Numeric Errors", "relationships": [ { "cwe_id": "128", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "191", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "193", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "839", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1335", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1339", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1389", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper calculation or conversion of numbers." }, "19": { "id": "19", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Data Processing Errors", "relationships": [ { "cwe_id": "130", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "166", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "167", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "168", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "178", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "182", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "186", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "229", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "233", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "237", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "241", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "409", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "624", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "625", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "776", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1024", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are typically found in functionality that processes data. Data processing is the manipulation of input to retrieve or save information." }, "199": { "id": "199", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Information Management Errors", "relationships": [ { "cwe_id": "201", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "204", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "205", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "208", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "212", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "213", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "214", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "215", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "524", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "538", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "921", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1230", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper handling of sensitive information." }, "2": { "id": "2", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - Environment", "relationships": [ { "cwe_id": "11", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "12", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "13", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "14", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "5", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "6", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "7", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "8", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "9", "kind": "Has_Member", "view_id": "700" } ], "status": "Draft", "summary": "This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, \"This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms.\"" }, "21": { "id": "21", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Pathname Traversal and Equivalence Errors", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally used for organizing weaknesses involving file names, which enabled access to files outside of a restricted directory (path traversal) or to perform operations on files that would otherwise be restricted (path equivalence). Consider using either the File Handling Issues category (CWE-1219) or the class Use of Incorrectly-Resolved Name or Reference (CWE-706)." }, "227": { "id": "227", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - API Abuse", "relationships": [ { "cwe_id": "242", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "243", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "244", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "245", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "246", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "250", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "251", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "558", "kind": "Has_Member", "view_id": "700" } ], "status": "Draft", "summary": "This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, \"An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated.\"" }, "251": { "id": "251", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Often Misused: String Management", "relationships": [], "status": "Incomplete", "summary": "Functions that manipulate strings encourage buffer overflows." }, "254": { "id": "254", "mapping": { "comments": "Consider mapping to weaknesses that are members of this Category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - Security Features", "relationships": [ { "cwe_id": "256", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "258", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "260", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "261", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "700" } ], "status": "Incomplete", "summary": "Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management." }, "255": { "id": "255", "mapping": { "comments": "Some weakness-oriented alternatives might be found under Improper Authentication (CWE-287) or keyword searches for credentials.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1287]. This CWE ID may have become widely-used because of NIST's usage in NVD from 2008 to 2016 (see CWE-635 view, updated to the CWE-1003 view in 2016).", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Credentials Management Errors", "relationships": [ { "cwe_id": "256", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "257", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "260", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "261", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "262", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "263", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "549", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "916", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1392", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the management of credentials." }, "264": { "id": "264", "mapping": { "comments": "Some weakness-oriented alternatives might be found as descendants under Improper Access Control (CWE-284). Note: use of CWE-284 is Discouraged; see CWE-284's Mapping Notes.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1287]. This CWE ID may have become widely-used because of NIST's usage in NVD from 2008 to 2016 (see CWE-635 view, updated to the CWE-1003 view in 2016).", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Permissions, Privileges, and Access Controls", "relationships": [], "status": "Obsolete", "summary": "Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control." }, "265": { "id": "265", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Privilege Issues", "relationships": [ { "cwe_id": "243", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "250", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "267", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "270", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "273", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "274", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "280", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "501", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "580", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "648", "kind": "Has_Member", "view_id": "699" } ], "status": "Incomplete", "summary": "Weaknesses in this category occur with improper handling, assignment, or management of privileges. A privilege is a property of an agent, such as a user. It lets the agent do things that are not ordinarily allowed. For example, there are privileges which allow an agent to perform maintenance functions such as restart a computer." }, "275": { "id": "275", "mapping": { "comments": "Consider mapping to weaknesses that are members of this Category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Permission Issues", "relationships": [ { "cwe_id": "276", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "277", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "278", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "280", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "281", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "618", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "766", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "767", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper assignment or handling of permissions." }, "3": { "id": "3", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Technology-specific Environment Issues", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally intended as a \"catch-all\" for environment issues for technologies that did not have their own CWE, but it introduced unnecessary depth and complexity to the Development View (CWE-699)." }, "310": { "id": "310", "mapping": { "comments": "Some weakness-oriented alternatives might be found as descendants under Use of a Broken or Risky Cryptographic Algorithm (CWE-327)", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1287]. This CWE ID may have become widely-used because of NIST's usage in NVD from 2008 to 2016 (see CWE-635 view, updated to the CWE-1003 view in 2016).", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Cryptographic Issues", "relationships": [ { "cwe_id": "261", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "334", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "916", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1204", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1240", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to the design and implementation of data confidentiality and integrity. Frequently these deal with the use of encoding techniques, encryption libraries, and hashing algorithms. The weaknesses in this category could lead to a degradation of the quality data if they are not addressed." }, "320": { "id": "320", "mapping": { "comments": "Consider mapping to weaknesses that are members of this Category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Key Management Errors", "relationships": [ { "cwe_id": "322", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "323", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "699" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to errors in the management of cryptographic keys." }, "355": { "id": "355", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "User Interface Security Issues", "relationships": [ { "cwe_id": "356", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "357", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "447", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "448", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "449", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "549", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1007", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1021", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to or introduced in the User Interface (UI)." }, "361": { "id": "361", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - Time and State", "relationships": [ { "cwe_id": "364", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "367", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "382", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "383", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "412", "kind": "Has_Member", "view_id": "700" } ], "status": "Incomplete", "summary": "This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, \"Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information.\"" }, "371": { "id": "371", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "State Issues", "relationships": [ { "cwe_id": "15", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "372", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "374", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "375", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1265", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper management of system state." }, "376": { "id": "376", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Temporary File Issues", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree. Consider using the File Handling Issues category (CWE-1219)." }, "380": { "id": "380", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Technology-Specific Time and State Issues", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "381": { "id": "381", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: J2EE Time and State Issues", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "387": { "id": "387", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Signal Errors", "relationships": [ { "cwe_id": "364", "kind": "Has_Member", "view_id": "699" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to the improper handling of signals." }, "388": { "id": "388", "mapping": { "comments": "Consider mapping to weaknesses that are members of this Category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - Errors", "relationships": [ { "cwe_id": "391", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "395", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "396", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "700" } ], "status": "Draft", "summary": "This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, \"Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle.\"" }, "389": { "id": "389", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Error Conditions, Return Values, Status Codes", "relationships": [ { "cwe_id": "209", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "253", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "392", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "393", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "394", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "395", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "396", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "544", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "584", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "617", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "756", "kind": "Has_Member", "view_id": "699" } ], "status": "Incomplete", "summary": "This category includes weaknesses that occur if a function does not generate the correct return/status code, or if the application does not handle all possible return/status codes that could be generated by a function. This type of problem is most often found in conditions that are rarely encountered during the normal operation of the product. Presumably, most bugs related to common conditions are found and eliminated during development and testing. In some cases, the attacker can directly control or influence the environment to trigger the rare conditions." }, "398": { "id": "398", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - Code Quality", "relationships": [ { "cwe_id": "401", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "415", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "457", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "474", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "475", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "477", "kind": "Has_Member", "view_id": "700" } ], "status": "Draft", "summary": "This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, \"Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways.\"" }, "399": { "id": "399", "mapping": { "comments": "Some weakness-oriented alternatives might be found as descendants under Uncontrolled Resource Consumption (CWE-400).", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves [REF-1287]. This CWE ID may have become widely-used because of NIST's usage in NVD from 2008 to 2016 (see CWE-635 view, updated to the CWE-1003 view in 2016).", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Resource Management Errors", "relationships": [ { "cwe_id": "73", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "403", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "410", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "619", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "641", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "694", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "763", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "771", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "826", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "908", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "909", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "910", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "911", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "914", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "915", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "920", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1188", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1341", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper management of system resources." }, "4": { "id": "4", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: J2EE Environment Issues", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "411": { "id": "411", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Resource Locking Problems", "relationships": [ { "cwe_id": "412", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "413", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "414", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "609", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "764", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "765", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "832", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "833", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper handling of locks that are used to control access to resources." }, "417": { "id": "417", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Communication Channel Errors", "relationships": [ { "cwe_id": "322", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "385", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "419", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "420", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "515", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "924", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "940", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "941", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1327", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper handling of communication channels and access paths. These weaknesses include problems in creating, managing, or removing alternate channels and alternate paths. Some of these can overlap virtual file problems and are commonly used in \"bypass\" attacks, such as those that exploit authentication errors." }, "418": { "id": "418", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Channel Errors", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated because it redundant with the grouping provided by CWE-417." }, "429": { "id": "429", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Handler Errors", "relationships": [ { "cwe_id": "430", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "431", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper management of handlers." }, "438": { "id": "438", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Behavioral Problems", "relationships": [ { "cwe_id": "115", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "179", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "408", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "437", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "439", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "440", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "444", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "483", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "484", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "551", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "698", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "733", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "835", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "837", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1025", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1037", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to unexpected behaviors from code that an application uses." }, "442": { "id": "442", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Web Problems", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "445": { "id": "445", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: User Interface Errors", "relationships": [], "status": "Deprecated", "summary": "This weakness has been deprecated because it was a duplicate of CWE-355. All content has been transferred to CWE-355." }, "452": { "id": "452", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Initialization and Cleanup Errors", "relationships": [ { "cwe_id": "212", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "454", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "455", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1051", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1052", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1188", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category occur in behaviors that are used for initialization and breakdown." }, "461": { "id": "461", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Data Structure Issues", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "465": { "id": "465", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Pointer Issues", "relationships": [ { "cwe_id": "466", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "468", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "469", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "587", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "763", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "822", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "823", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "824", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "825", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to improper handling of pointers." }, "485": { "id": "485", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "7PK - Encapsulation", "relationships": [ { "cwe_id": "486", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "488", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "489", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "491", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "492", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "493", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "495", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "496", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "501", "kind": "Has_Member", "view_id": "700" } ], "status": "Draft", "summary": "This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, \"Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not.\"" }, "490": { "id": "490", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Mobile Code Issues", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "503": { "id": "503", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Byte/Object Code", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "504": { "id": "504", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Motivation/Intent", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "505": { "id": "505", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Intentionally Introduced Weakness", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "513": { "id": "513", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Intentionally Introduced Nonmalicious Weakness", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "517": { "id": "517", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Other Intentional, Nonmalicious Weakness", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "518": { "id": "518", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Inadvertently Introduced Weakness", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated as it was originally used for organizing the Development View (CWE-699), but it introduced unnecessary complexity and depth to the resulting tree." }, "519": { "id": "519", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: .NET Environment Issues", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "557": { "id": "557", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Concurrency Issues", "relationships": [ { "cwe_id": "364", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "367", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "368", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "386", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "421", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "663", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "820", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "821", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1058", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1322", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to concurrent use of shared resources." }, "559": { "id": "559", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Often Misused: Arguments and Parameters", "relationships": [], "status": "Deprecated", "summary": "This entry has been deprecated. It was originally used for organizing the Development View (CWE-699) and some other views, but it introduced unnecessary complexity and depth to the resulting tree." }, "569": { "id": "569", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "Expression Issues", "relationships": [ { "cwe_id": "480", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "570", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "571", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "699" } ], "status": "Draft", "summary": "Weaknesses in this category are related to incorrectly written expressions within code." }, "60": { "id": "60", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: UNIX Path Link Problems", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It covered a very low level of abstraction based on operating system, which was not useful for any existing view." }, "63": { "id": "63", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Windows Path Link Problems", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It covered a very low level of abstraction based on operating system, which was not useful for any existing view." }, "632": { "id": "632", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Weaknesses that Affect Files or Directories", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE." }, "633": { "id": "633", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Weaknesses that Affect Memory", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE." }, "634": { "id": "634", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Weaknesses that Affect System Processes", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated. It was not actively maintained, and it was not useful to stakeholders. It was originally created before CWE 1.0 as part of view CWE-631, which was a simple example of how views could be structured within CWE." }, "68": { "id": "68", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Windows Virtual File Problems", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships." }, "70": { "id": "70", "mapping": { "comments": "See the summary, which might have suggestions for other CWEs to consider.", "rationale": "This CWE has been deprecated. It is also a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "name": "DEPRECATED: Mac Virtual File Problems", "relationships": [], "status": "Deprecated", "summary": "This category has been deprecated as it was found to be an unnecessary abstraction of platform specific details. Please refer to the category CWE-632 and weakness CWE-66 for relevant relationships." }, "712": { "id": "712", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)", "relationships": [ { "cwe_id": "79", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2007." }, "713": { "id": "713", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A2 - Injection Flaws", "relationships": [ { "cwe_id": "77", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "93", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2007." }, "714": { "id": "714", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A3 - Malicious File Execution", "relationships": [ { "cwe_id": "434", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "98", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2007." }, "715": { "id": "715", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2007." }, "716": { "id": "716", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A5 - Cross Site Request Forgery (CSRF)", "relationships": [ { "cwe_id": "352", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2007." }, "717": { "id": "717", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling", "relationships": [ { "cwe_id": "200", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "203", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "215", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2007." }, "718": { "id": "718", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management", "relationships": [ { "cwe_id": "287", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "301", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2007." }, "719": { "id": "719", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage", "relationships": [ { "cwe_id": "311", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2007." }, "720": { "id": "720", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A9 - Insecure Communications", "relationships": [ { "cwe_id": "311", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2007." }, "721": { "id": "721", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access", "relationships": [ { "cwe_id": "285", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "288", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "629" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2007." }, "722": { "id": "722", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A1 - Unvalidated Input", "relationships": [ { "cwe_id": "102", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "103", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "104", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "106", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "109", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "166", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "167", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "179", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "180", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "181", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "182", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "183", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2004." }, "723": { "id": "723", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A2 - Broken Access Control", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "275", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "283", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "41", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "525", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "551", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "556", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "708", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "73", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "9", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2004." }, "724": { "id": "724", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management", "relationships": [ { "cwe_id": "255", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "296", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "298", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "302", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "304", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "309", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "345", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "525", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2004." }, "725": { "id": "725", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws", "relationships": [ { "cwe_id": "644", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2004." }, "726": { "id": "726", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A5 - Buffer Overflows", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2004." }, "727": { "id": "727", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A6 - Injection Flaws", "relationships": [ { "cwe_id": "117", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "74", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "98", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2004." }, "728": { "id": "728", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A7 - Improper Error Handling", "relationships": [ { "cwe_id": "203", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "228", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "389", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "394", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "636", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "7", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2004." }, "729": { "id": "729", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A8 - Insecure Storage", "relationships": [ { "cwe_id": "14", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "226", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "261", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "539", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "591", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "598", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2004." }, "730": { "id": "730", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A9 - Denial of Service", "relationships": [ { "cwe_id": "170", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "382", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "401", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "405", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "410", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "412", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "674", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2004." }, "731": { "id": "731", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2004 Category A10 - Insecure Configuration Management", "relationships": [ { "cwe_id": "209", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "215", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "219", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "275", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "5", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "555", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "6", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "7", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "8", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "9", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "489", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "11", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "12", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "13", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "520", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "554", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "556", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "526", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "527", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "528", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "529", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "530", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "531", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "540", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "541", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "548", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "711" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2004." }, "735": { "id": "735", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE)", "relationships": [ { "cwe_id": "684", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Preprocessor (PRE) chapter of the CERT C Secure Coding Standard (2008)." }, "736": { "id": "736", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL)", "relationships": [ { "cwe_id": "547", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) chapter of the CERT C Secure Coding Standard (2008)." }, "737": { "id": "737", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)", "relationships": [ { "cwe_id": "467", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "468", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) chapter of the CERT C Secure Coding Standard (2008)." }, "738": { "id": "738", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT)", "relationships": [ { "cwe_id": "129", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "192", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "466", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "587", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Integers (INT) chapter of the CERT C Secure Coding Standard (2008)." }, "739": { "id": "739", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP)", "relationships": [ { "cwe_id": "369", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Floating Point (FLP) chapter of the CERT C Secure Coding Standard (2008)." }, "740": { "id": "740", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "467", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "469", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Arrays (ARR) chapter of the CERT C Secure Coding Standard (2008)." }, "741": { "id": "741", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "135", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "193", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "464", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) chapter of the CERT C Secure Coding Standard (2008)." }, "742": { "id": "742", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "128", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "226", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "244", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "415", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "528", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "590", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "591", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "687", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Memory Management (MEM) chapter of the CERT C Secure Coding Standard (2008)." }, "743": { "id": "743", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "241", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "367", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "37", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "379", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "38", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "39", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "403", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "41", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "62", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "64", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "65", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "67", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "675", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) chapter of the CERT C Secure Coding Standard (2008)." }, "744": { "id": "744", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "462", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Environment (ENV) chapter of the CERT C Secure Coding Standard (2008)." }, "745": { "id": "745", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)", "relationships": [ { "cwe_id": "479", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Signals (SIG) chapter of the CERT C Secure Coding Standard (2008)." }, "746": { "id": "746", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR)", "relationships": [ { "cwe_id": "20", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "544", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Error Handling (ERR) chapter of the CERT C Secure Coding Standard (2008)." }, "747": { "id": "747", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)", "relationships": [ { "cwe_id": "14", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "176", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "482", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "561", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "563", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "570", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "571", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "697", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) chapter of the CERT C Secure Coding Standard (2008)." }, "748": { "id": "748", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)", "relationships": [ { "cwe_id": "170", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "242", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "273", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "363", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "562", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "696", "kind": "Has_Member", "view_id": "734" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the rules and recommendations in the POSIX (POS) appendix of the CERT C Secure Coding Standard (2008)." }, "751": { "id": "751", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2009 Top 25 - Insecure Interaction Between Components", "relationships": [ { "cwe_id": "116", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "750" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Insecure Interaction Between Components\" section of the 2009 CWE/SANS Top 25 Programming Errors." }, "752": { "id": "752", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2009 Top 25 - Risky Resource Management", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "642", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "73", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "750" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Risky Resource Management\" section of the 2009 CWE/SANS Top 25 Programming Errors." }, "753": { "id": "753", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2009 Top 25 - Porous Defenses", "relationships": [ { "cwe_id": "250", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "285", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "750" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Porous Defenses\" section of the 2009 CWE/SANS Top 25 Programming Errors." }, "801": { "id": "801", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2010 Top 25 - Insecure Interaction Between Components", "relationships": [ { "cwe_id": "209", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "800" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Insecure Interaction Between Components\" section of the 2010 CWE/SANS Top 25 Programming Errors." }, "802": { "id": "802", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2010 Top 25 - Risky Resource Management", "relationships": [ { "cwe_id": "120", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "98", "kind": "Has_Member", "view_id": "800" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Risky Resource Management\" section of the 2010 CWE/SANS Top 25 Programming Errors." }, "803": { "id": "803", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2010 Top 25 - Porous Defenses", "relationships": [ { "cwe_id": "285", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "800" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Porous Defenses\" section of the 2010 CWE/SANS Top 25 Programming Errors." }, "808": { "id": "808", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2010 Top 25 - Weaknesses On the Cusp", "relationships": [ { "cwe_id": "134", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "212", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "454", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "749", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "799", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "804", "kind": "Has_Member", "view_id": "800" } ], "status": "Obsolete", "summary": "Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn." }, "810": { "id": "810", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A1 - Injection", "relationships": [ { "cwe_id": "78", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2010." }, "811": { "id": "811", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)", "relationships": [ { "cwe_id": "79", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2010." }, "812": { "id": "812", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management", "relationships": [ { "cwe_id": "287", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2010." }, "813": { "id": "813", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A4 - Insecure Direct Object References", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2010." }, "814": { "id": "814", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A5 - Cross-Site Request Forgery(CSRF)", "relationships": [ { "cwe_id": "352", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2010." }, "815": { "id": "815", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A6 - Security Misconfiguration", "relationships": [ { "cwe_id": "209", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "219", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "250", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "538", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2010." }, "816": { "id": "816", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage", "relationships": [ { "cwe_id": "311", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "759", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2010." }, "817": { "id": "817", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access", "relationships": [ { "cwe_id": "285", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2010." }, "818": { "id": "818", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection", "relationships": [ { "cwe_id": "311", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2010." }, "819": { "id": "819", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards", "relationships": [ { "cwe_id": "601", "kind": "Has_Member", "view_id": "809" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2010." }, "840": { "id": "840", "mapping": { "comments": "The \"Business Logic\" term generally reflects product-specific logic errors that can be characterized by various weaknesses related to issues such as access control, workflow, input validation, etc. Perform root cause analysis to determine what mistake led to the logic error. Consult the member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category", "Frequent Misuse" ], "suggestions": [], "usage": "Prohibited" }, "name": "Business Logic Errors", "relationships": [ { "cwe_id": "283", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "708", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "826", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "837", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "699" } ], "status": "Incomplete", "summary": "Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application. Errors in business logic can be devastating to an entire application. They can be difficult to find automatically, since they typically involve legitimate use of the application's functionality. However, many business logic errors can exhibit patterns that are similar to well-understood implementation and design weaknesses." }, "845": { "id": "845", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS)", "relationships": [ { "cwe_id": "116", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "144", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "150", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "180", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "182", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "289", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "409", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "625", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "647", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "838", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "846": { "id": "846", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL)", "relationships": [ { "cwe_id": "665", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "847": { "id": "847", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP)", "relationships": [ { "cwe_id": "252", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "479", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "595", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "597", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "848": { "id": "848", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM)", "relationships": [ { "cwe_id": "197", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "849": { "id": "849", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ)", "relationships": [ { "cwe_id": "374", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "375", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "486", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "491", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "492", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "493", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "498", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "500", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "582", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "766", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "850": { "id": "850", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)", "relationships": [ { "cwe_id": "487", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "568", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "573", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "581", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "583", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "586", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "589", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "617", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "851": { "id": "851", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)", "relationships": [ { "cwe_id": "209", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "230", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "232", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "382", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "395", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "460", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "584", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "600", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "690", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "852": { "id": "852", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA)", "relationships": [ { "cwe_id": "362", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "413", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "567", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "853": { "id": "853", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK)", "relationships": [ { "cwe_id": "412", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "413", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "609", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "820", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "833", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "854": { "id": "854", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI)", "relationships": [ { "cwe_id": "572", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "855": { "id": "855", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)", "relationships": [ { "cwe_id": "392", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "405", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "410", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "856": { "id": "856", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 13 - Thread-Safety Miscellaneous (TSM)", "relationships": [], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Thread-Safety Miscellaneous (TSM) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "857": { "id": "857", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO)", "relationships": [ { "cwe_id": "135", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "198", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "377", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "405", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "67", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "858": { "id": "858", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER)", "relationships": [ { "cwe_id": "250", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "499", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "589", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "859": { "id": "859", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC)", "relationships": [ { "cwe_id": "111", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "300", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "302", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "860": { "id": "860", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV)", "relationships": [ { "cwe_id": "349", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "861": { "id": "861", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC)", "relationships": [ { "cwe_id": "259", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "332", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "333", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "401", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "543", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "844" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011)." }, "864": { "id": "864", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2011 Top 25 - Insecure Interaction Between Components", "relationships": [ { "cwe_id": "352", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "900" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Insecure Interaction Between Components\" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors." }, "865": { "id": "865", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2011 Top 25 - Risky Resource Management", "relationships": [ { "cwe_id": "120", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "900" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Risky Resource Management\" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors." }, "866": { "id": "866", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2011 Top 25 - Porous Defenses", "relationships": [ { "cwe_id": "250", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "759", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "900" } ], "status": "Obsolete", "summary": "Weaknesses in this category are listed in the \"Porous Defenses\" section of the 2011 CWE/SANS Top 25 Most Dangerous Software Errors." }, "867": { "id": "867", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "2011 Top 25 - Weaknesses On the Cusp", "relationships": [ { "cwe_id": "129", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "212", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "822", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "825", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "838", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "900" } ], "status": "Obsolete", "summary": "Weaknesses in this category are not part of the general Top 25, but they were part of the original nominee list from which the Top 25 was drawn." }, "869": { "id": "869", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 01 - Preprocessor (PRE)", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Preprocessor (PRE) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "870": { "id": "870", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL)", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "871": { "id": "871", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 03 - Expressions (EXP)", "relationships": [ { "cwe_id": "476", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "768", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Expressions (EXP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "872": { "id": "872", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 04 - Integers (INT)", "relationships": [ { "cwe_id": "129", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "192", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "466", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "587", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Integers (INT) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "873": { "id": "873", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)", "relationships": [ { "cwe_id": "369", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Floating Point Arithmetic (FLP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "874": { "id": "874", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "467", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "469", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Arrays and the STL (ARR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "875": { "id": "875", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 07 - Characters and Strings (STR)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "193", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "464", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Characters and Strings (STR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "876": { "id": "876", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 08 - Memory Management (MEM)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "128", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "226", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "244", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "415", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "528", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "590", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "591", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "687", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "690", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "762", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "822", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "877": { "id": "877", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 09 - Input Output (FIO)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "241", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "367", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "37", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "379", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "38", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "39", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "403", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "41", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "62", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "64", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "65", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "67", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "675", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "73", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "878": { "id": "878", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 10 - Environment (ENV)", "relationships": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "462", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Environment (ENV) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "879": { "id": "879", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 11 - Signals (SIG)", "relationships": [ { "cwe_id": "479", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Signals (SIG) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "880": { "id": "880", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)", "relationships": [ { "cwe_id": "209", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "460", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "544", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "755", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Exceptions and Error Handling (ERR) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "881": { "id": "881", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP)", "relationships": [], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Object Oriented Programming (OOP) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "882": { "id": "882", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 14 - Concurrency (CON)", "relationships": [ { "cwe_id": "362", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "488", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Concurrency (CON) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "883": { "id": "883", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)", "relationships": [ { "cwe_id": "116", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "14", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "176", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "482", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "561", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "563", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "570", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "571", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "697", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "868" } ], "status": "Incomplete", "summary": "Weaknesses in this category are related to rules in the Miscellaneous (MSC) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete." }, "885": { "id": "885", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Risky Values", "relationships": [ { "cwe_id": "998", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Risky Values cluster (SFP1)." }, "886": { "id": "886", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Unused entities", "relationships": [ { "cwe_id": "482", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "561", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "563", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Unused entities cluster (SFP2)." }, "887": { "id": "887", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: API", "relationships": [ { "cwe_id": "1001", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the API cluster (SFP3)." }, "889": { "id": "889", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Exception Management", "relationships": [ { "cwe_id": "960", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "961", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "962", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Exception Management cluster (SFP4, SFP5, SFP6)." }, "890": { "id": "890", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Memory Access", "relationships": [ { "cwe_id": "970", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "971", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "972", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "973", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "974", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Memory Access cluster (SFP7, SFP8)." }, "891": { "id": "891", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Memory Management", "relationships": [ { "cwe_id": "969", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Memory Management cluster (SFP38)." }, "892": { "id": "892", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Resource Management", "relationships": [ { "cwe_id": "982", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "983", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "984", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "985", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Resource Management cluster (SFP37)." }, "893": { "id": "893", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Path Resolution", "relationships": [ { "cwe_id": "979", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "980", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "981", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Path Resolution cluster (SFP16, SFP17, SFP18)." }, "894": { "id": "894", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Synchronization", "relationships": [ { "cwe_id": "986", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "987", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "988", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "989", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Synchronization cluster (SFP19, SFP20, SFP21, SFP22)." }, "895": { "id": "895", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Information Leak", "relationships": [ { "cwe_id": "963", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "964", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "965", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "966", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "967", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Information Leak cluster (SFP23)." }, "896": { "id": "896", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Tainted Input", "relationships": [ { "cwe_id": "990", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "991", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "992", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "993", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "994", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Tainted Input cluster (SFP24, SFP25, SFP26, SFP27)." }, "897": { "id": "897", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Entry Points", "relationships": [ { "cwe_id": "1002", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Entry Points cluster (SFP28)." }, "898": { "id": "898", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Authentication", "relationships": [ { "cwe_id": "947", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "948", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "949", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "950", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "951", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "952", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "953", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "954", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "955", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Authentication cluster (SFP29, SFP30, SFP31, SFP32, SFP33, SFP34)." }, "899": { "id": "899", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Access Control", "relationships": [ { "cwe_id": "944", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "945", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "946", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Access Control cluster (SFP35)." }, "901": { "id": "901", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Privilege", "relationships": [ { "cwe_id": "250", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "267", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "270", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "271", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "272", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "274", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "520", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "653", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "9", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Privilege cluster (SFP36)." }, "902": { "id": "902", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Channel", "relationships": [ { "cwe_id": "956", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "957", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Channel cluster." }, "903": { "id": "903", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Cryptography", "relationships": [ { "cwe_id": "958", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "959", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Cryptography cluster." }, "904": { "id": "904", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Malware", "relationships": [ { "cwe_id": "506", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "507", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "508", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "509", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "510", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "511", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "512", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "69", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "968", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Malware cluster." }, "905": { "id": "905", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Predictability", "relationships": [ { "cwe_id": "330", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "332", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "333", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "334", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "336", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "337", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "339", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "340", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "341", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "342", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "343", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "344", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Predictability cluster." }, "906": { "id": "906", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: UI", "relationships": [ { "cwe_id": "995", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "996", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "997", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the UI cluster." }, "907": { "id": "907", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Primary Cluster: Other", "relationships": [ { "cwe_id": "975", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "976", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "977", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "978", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Other cluster." }, "929": { "id": "929", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A1 - Injection", "relationships": [ { "cwe_id": "74", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "652", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A1 category in the OWASP Top Ten 2013." }, "930": { "id": "930", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management", "relationships": [ { "cwe_id": "256", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "384", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A2 category in the OWASP Top Ten 2013." }, "931": { "id": "931", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)", "relationships": [ { "cwe_id": "79", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A3 category in the OWASP Top Ten 2013." }, "932": { "id": "932", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A4 - Insecure Direct Object References", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "706", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A4 category in the OWASP Top Ten 2013." }, "933": { "id": "933", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A5 - Security Misconfiguration", "relationships": [ { "cwe_id": "2", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "16", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "215", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "548", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A5 category in the OWASP Top Ten 2013." }, "934": { "id": "934", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure", "relationships": [ { "cwe_id": "311", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "320", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A6 category in the OWASP Top Ten 2013." }, "935": { "id": "935", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control", "relationships": [ { "cwe_id": "285", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A7 category in the OWASP Top Ten 2013." }, "936": { "id": "936", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A8 - Cross-Site Request Forgery (CSRF)", "relationships": [ { "cwe_id": "352", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A8 category in the OWASP Top Ten 2013." }, "937": { "id": "937", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities", "relationships": [], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A9 category in the OWASP Top Ten 2013." }, "938": { "id": "938", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards", "relationships": [ { "cwe_id": "601", "kind": "Has_Member", "view_id": "928" } ], "status": "Obsolete", "summary": "Weaknesses in this category are related to the A10 category in the OWASP Top Ten 2013." }, "944": { "id": "944", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Access Management", "relationships": [ { "cwe_id": "282", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "283", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "286", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "708", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Access Management cluster." }, "945": { "id": "945", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Insecure Resource Access", "relationships": [ { "cwe_id": "285", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "424", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "650", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Access cluster (SFP35)." }, "946": { "id": "946", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Insecure Resource Permissions", "relationships": [ { "cwe_id": "276", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "277", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "278", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "279", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "281", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "560", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Insecure Resource Permissions cluster." }, "947": { "id": "947", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Authentication Bypass", "relationships": [ { "cwe_id": "287", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "288", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "289", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "303", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "304", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "305", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "309", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "603", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Authentication Bypass cluster." }, "948": { "id": "948", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Digital Certificate", "relationships": [ { "cwe_id": "296", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "297", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "298", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "299", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "593", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "599", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Digital Certificate cluster." }, "949": { "id": "949", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Faulty Endpoint Authentication", "relationships": [ { "cwe_id": "293", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "302", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "345", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "346", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "350", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "360", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "551", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "565", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "647", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Endpoint Authentication cluster (SFP29)." }, "950": { "id": "950", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Hardcoded Sensitive Data", "relationships": [ { "cwe_id": "258", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "259", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "321", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "547", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Hardcoded Sensitive Data cluster (SFP33)." }, "951": { "id": "951", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Insecure Authentication Policy", "relationships": [ { "cwe_id": "262", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "263", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "556", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "613", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "645", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Insecure Authentication Policy cluster." }, "952": { "id": "952", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Missing Authentication", "relationships": [ { "cwe_id": "306", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "620", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Missing Authentication cluster." }, "953": { "id": "953", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Missing Endpoint Authentication", "relationships": [ { "cwe_id": "422", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "425", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Missing Endpoint Authentication cluster (SFP30)." }, "954": { "id": "954", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Multiple Binds to the Same Port", "relationships": [ { "cwe_id": "605", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Multiple Binds to the Same Port cluster (SFP32)." }, "955": { "id": "955", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Unrestricted Authentication", "relationships": [ { "cwe_id": "307", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Unrestricted Authentication cluster (SFP34)." }, "956": { "id": "956", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Channel Attack", "relationships": [ { "cwe_id": "290", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "294", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "300", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "301", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "419", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "420", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "421", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "441", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Channel Attack cluster." }, "957": { "id": "957", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Protocol Error", "relationships": [ { "cwe_id": "353", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "435", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "436", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "437", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "757", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Protocol Error cluster." }, "958": { "id": "958", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Broken Cryptography", "relationships": [ { "cwe_id": "325", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "328", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "759", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "760", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Broken Cryptography cluster." }, "959": { "id": "959", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Weak Cryptography", "relationships": [ { "cwe_id": "261", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "322", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "323", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "324", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "329", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "640", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Weak Cryptography cluster." }, "960": { "id": "960", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Ambiguous Exception Type", "relationships": [ { "cwe_id": "396", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "397", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Ambiguous Exception Type cluster (SFP5)." }, "961": { "id": "961", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Incorrect Exception Behavior", "relationships": [ { "cwe_id": "392", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "393", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "455", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "460", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "544", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "584", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "636", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Incorrect Exception Behavior cluster (SFP6)." }, "962": { "id": "962", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Unchecked Status Condition", "relationships": [ { "cwe_id": "248", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "253", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "273", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "280", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "372", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "391", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "394", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "395", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "431", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "478", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "484", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "600", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "755", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Unchecked Status Condition cluster (SFP4)." }, "963": { "id": "963", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Exposed Data", "relationships": [ { "cwe_id": "11", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "117", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "12", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "13", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "14", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "201", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "210", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "211", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "212", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "213", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "214", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "215", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "219", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "220", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "226", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "244", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "256", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "257", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "260", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "313", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "314", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "315", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "316", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "317", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "318", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "374", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "375", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "402", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "403", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "433", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "495", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "497", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "498", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "499", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "5", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "501", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "523", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "526", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "527", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "528", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "529", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "530", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "532", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "535", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "536", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "537", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "538", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "539", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "540", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "541", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "546", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "548", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "550", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "552", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "555", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "591", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "598", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "607", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "612", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "615", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "642", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "668", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "669", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "7", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "756", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "767", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "8", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Exposed Data cluster (SFP23)." }, "964": { "id": "964", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Exposure Temporary File", "relationships": [ { "cwe_id": "377", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "378", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "379", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Exposure Temporary File cluster." }, "965": { "id": "965", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Insecure Session Management", "relationships": [ { "cwe_id": "488", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "524", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "6", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Insecure Session Management cluster." }, "966": { "id": "966", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Other Exposures", "relationships": [ { "cwe_id": "453", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "487", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "492", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "525", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "614", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "651", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Other Exposures cluster." }, "967": { "id": "967", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: State Disclosure", "relationships": [ { "cwe_id": "202", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "203", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "204", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "205", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "206", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "207", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "208", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the State Disclosure cluster." }, "968": { "id": "968", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Covert Channel", "relationships": [ { "cwe_id": "385", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "514", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "515", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Covert Channel cluster." }, "969": { "id": "969", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Faulty Memory Release", "relationships": [ { "cwe_id": "415", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "590", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "761", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "763", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Memory Release cluster (SFP12)." }, "970": { "id": "970", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Faulty Buffer Access", "relationships": [ { "cwe_id": "118", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "121", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "122", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "123", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "124", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "126", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "127", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Buffer Access cluster (SFP8)." }, "971": { "id": "971", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Faulty Pointer Use", "relationships": [ { "cwe_id": "469", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "588", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Pointer Use cluster (SFP7)." }, "972": { "id": "972", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Faulty String Expansion", "relationships": [ { "cwe_id": "785", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty String Expansion cluster (SFP9)." }, "973": { "id": "973", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Improper NULL Termination", "relationships": [ { "cwe_id": "170", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Improper NULL Termination cluster (SFP11)." }, "974": { "id": "974", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Incorrect Buffer Length Computation", "relationships": [ { "cwe_id": "131", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "135", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "251", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "467", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Incorrect Buffer Length Computation cluster (SFP10)." }, "975": { "id": "975", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Architecture", "relationships": [ { "cwe_id": "348", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "637", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "649", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "654", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "656", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "657", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "671", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "693", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "749", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Architecture cluster." }, "976": { "id": "976", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Compiler", "relationships": [ { "cwe_id": "733", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Compiler cluster." }, "977": { "id": "977", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Design", "relationships": [ { "cwe_id": "115", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "187", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "188", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "193", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "405", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "406", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "407", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "408", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "409", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "410", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "430", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "462", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "463", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "464", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "483", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "581", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "595", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "618", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "648", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "670", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "691", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "696", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "697", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "698", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "705", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Design cluster." }, "978": { "id": "978", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Implementation", "relationships": [ { "cwe_id": "358", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "398", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "623", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "710", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Implementation cluster." }, "979": { "id": "979", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Failed Chroot Jail", "relationships": [ { "cwe_id": "243", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Failed Chroot Jail cluster (SFP17)." }, "980": { "id": "980", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Link in Resource Name Resolution", "relationships": [ { "cwe_id": "386", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "610", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "62", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "64", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "65", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Link in Resource Name Resolution cluster (SFP18)." }, "981": { "id": "981", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Path Traversal", "relationships": [ { "cwe_id": "22", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "23", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "24", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "25", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "26", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "27", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "28", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "29", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "30", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "31", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "32", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "33", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "34", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "35", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "36", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "37", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "38", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "39", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "40", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "41", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "42", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "428", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "43", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "44", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "45", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "46", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "47", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "48", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "49", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "50", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "51", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "52", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "53", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "54", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "55", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "56", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "57", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "58", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "66", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "67", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "706", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "72", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "73", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Path Traversal cluster (SFP16)." }, "982": { "id": "982", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Failure to Release Resource", "relationships": [ { "cwe_id": "404", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "459", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "771", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "773", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "775", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Failure to Release Resource cluster (SFP14)." }, "983": { "id": "983", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Faulty Resource Use", "relationships": [ { "cwe_id": "416", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Resource Use cluster (SFP15)." }, "984": { "id": "984", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Life Cycle", "relationships": [ { "cwe_id": "664", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "666", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "675", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "694", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Life Cycle cluster." }, "985": { "id": "985", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Unrestricted Consumption", "relationships": [ { "cwe_id": "400", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "674", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "774", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Unrestricted Consumption cluster (SFP13)." }, "986": { "id": "986", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Missing Lock", "relationships": [ { "cwe_id": "364", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "366", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "368", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "413", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "414", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "543", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "567", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "609", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "663", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Missing Lock cluster (SFP19)." }, "987": { "id": "987", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Multiple Locks/Unlocks", "relationships": [ { "cwe_id": "585", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "764", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "765", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Multiple Locks/Unlocks cluster (SFP21)." }, "988": { "id": "988", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Race Condition Window", "relationships": [ { "cwe_id": "362", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "363", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "367", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "370", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "638", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Race Condition Window cluster (SFP20)." }, "989": { "id": "989", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Unrestricted Lock", "relationships": [ { "cwe_id": "412", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Unrestricted Lock cluster (SFP22)." }, "990": { "id": "990", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Tainted Input to Command", "relationships": [ { "cwe_id": "102", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "103", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "104", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "105", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "106", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "107", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "108", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "109", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "110", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "112", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "113", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "130", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "138", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "140", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "141", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "142", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "143", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "144", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "145", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "146", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "147", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "148", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "149", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "150", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "151", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "152", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "153", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "154", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "155", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "156", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "157", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "158", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "159", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "160", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "161", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "162", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "163", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "164", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "165", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "183", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "184", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "185", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "186", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "444", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "553", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "554", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "564", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "619", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "621", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "624", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "625", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "626", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "627", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "641", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "644", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "646", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "652", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "687", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "707", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "74", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "75", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "76", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "80", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "81", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "82", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "83", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "84", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "85", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "86", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "87", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "93", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "96", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "97", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24)." }, "991": { "id": "991", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Tainted Input to Environment", "relationships": [ { "cwe_id": "114", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "427", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "471", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "472", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "473", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "622", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "673", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Environment cluster (SFP27)." }, "992": { "id": "992", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Faulty Input Transformation", "relationships": [ { "cwe_id": "116", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "166", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "167", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "168", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "172", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "173", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "174", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "175", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "176", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "177", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "178", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "179", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "180", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "181", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "182", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Faulty Input Transformation cluster." }, "993": { "id": "993", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Incorrect Input Handling", "relationships": [ { "cwe_id": "198", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "228", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "229", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "230", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "231", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "232", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "233", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "234", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "235", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "236", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "237", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "238", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "239", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "240", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "241", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "351", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "354", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Incorrect Input Handling cluster." }, "994": { "id": "994", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Tainted Input to Variable", "relationships": [ { "cwe_id": "15", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "454", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "496", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "566", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "616", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Variable cluster (SFP25)." }, "995": { "id": "995", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Feature", "relationships": [ { "cwe_id": "447", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "448", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "449", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "450", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "451", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "549", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "655", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Feature cluster." }, "996": { "id": "996", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Security", "relationships": [ { "cwe_id": "356", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "357", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "446", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Security cluster." }, "997": { "id": "997", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Information Loss", "relationships": [ { "cwe_id": "221", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "222", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "223", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "224", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Information Loss cluster." }, "998": { "id": "998", "mapping": { "comments": "See member weaknesses of this category.", "rationale": "This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.", "reasons": [ "Category" ], "suggestions": [], "usage": "Prohibited" }, "name": "SFP Secondary Cluster: Glitch in Computation", "relationships": [ { "cwe_id": "128", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "191", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "194", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "195", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "196", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "197", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "457", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "466", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "468", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "475", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "481", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "486", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "562", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "570", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "571", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "579", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "587", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "594", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "597", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "683", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "685", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "686", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "688", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "768", "kind": "Has_Member", "view_id": "888" } ], "status": "Incomplete", "summary": "This category identifies Software Fault Patterns (SFPs) within the Glitch in Computation cluster (SFP1)." } }, "schema": { "date": "December 11, 2025", "documentation": "The CWE Schema is maintained by The MITRE Corporation and developed in partnership with the public CWE Community. For more information, including how to get involved in the project and how to submit change requests, please visit the CWE website at https://cwe.mitre.org.", "schema": "Core Definition", "version": "7.3" }, "views": { "1000": { "filter": "", "id": "1000", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "284", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "435", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "664", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "691", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "693", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "697", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "707", "kind": "Has_Member", "view_id": "1000" }, { "cwe_id": "710", "kind": "Has_Member", "view_id": "1000" } ], "name": "Research Concepts", "objective": "This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "5", "6", "7", "8", "9", "11", "12", "13", "14", "15", "20", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "61", "62", "64", "65", "66", "67", "69", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "90", "91", "93", "94", "95", "96", "97", "98", "99", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "115", "116", "117", "118", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "134", "135", "138", "140", "141", "142", "143", "144", "145", "146", "147", "148", "149", "150", "151", "152", "153", "154", "155", "156", "157", "158", "159", "160", "161", "162", "163", "164", "165", "166", "167", "168", "170", "172", "173", "174", "175", "176", "177", "178", "179", "180", "181", "182", "183", "184", "185", "186", "187", "188", "190", "191", "192", "193", "194", "195", "196", "197", "198", "200", "201", "202", "203", "204", "205", "206", "207", "208", "209", "210", "211", "212", "213", "214", "215", "219", "220", "221", "222", "223", "224", "226", "228", "229", "230", "231", "232", "233", "234", "235", "236", "237", "238", "239", "240", "241", "242", "243", "244", "245", "246", "248", "250", "252", "253", "256", "257", "258", "259", "260", "261", "262", "263", "266", "267", "268", "269", "270", "271", "272", "273", "274", "276", "277", "278", "279", "280", "281", "282", "283", "284", "285", "286", "287", "288", "289", "290", "291", "293", "294", "295", "296", "297", "298", "299", "300", "301", "302", "303", "304", "305", "306", "307", "308", "309", "311", "312", "313", "314", "315", "316", "317", "318", "319", "321", "322", "323", "324", "325", "326", "327", "328", "329", "330", "331", "332", "333", "334", "335", "336", "337", "338", "339", "340", "341", "342", "343", "344", "345", "346", "347", "348", "349", "350", "351", "352", "353", "354", "356", "357", "358", "359", "360", "362", "363", "364", "366", "367", "368", "369", "370", "372", "374", "375", "377", "378", "379", "382", "383", "384", "385", "386", "390", "391", "392", "393", "394", "395", "396", "397", "400", "401", "402", "403", "404", "405", "406", "407", "408", "409", "410", "412", "413", "414", "415", "416", "419", "420", "421", "422", "424", "425", "426", "427", "428", "430", "431", "432", "433", "434", "435", "436", "437", "439", "440", "441", "444", "446", "447", "448", "449", "450", "451", "453", "454", "455", "456", "457", "459", "460", "462", "463", "464", "466", "467", "468", "469", "470", "471", "472", "473", "474", "475", "476", "477", "478", "479", "480", "481", "482", "483", "484", "486", "487", "488", "489", "491", "492", "493", "494", "495", "496", "497", "498", "499", "500", "501", "502", "506", "507", "508", "509", "510", "511", "512", "514", "515", "520", "521", "522", "523", "524", "525", "526", "527", "528", "529", "530", "531", "532", "535", "536", "537", "538", "539", "540", "541", "543", "544", "546", "547", "548", "549", "550", "551", "552", "553", "554", "555", "556", "558", "560", "561", "562", "563", "564", "565", "566", "567", "568", "570", "571", "572", "573", "574", "575", "576", "577", "578", "579", "580", "581", "582", "583", "584", "585", "586", "587", "588", "589", "590", "591", "593", "594", "595", "597", "598", "599", "600", "601", "602", "603", "605", "606", "607", "608", "609", "610", "611", "612", "613", "614", "615", "616", "617", "618", "619", "620", "621", "622", "623", "624", "625", "626", "627", "628", "636", "637", "638", "639", "640", "641", "642", "643", "644", "645", "646", "647", "648", "649", "650", "651", "652", "653", "654", "655", "656", "657", "662", "663", "664", "665", "666", "667", "668", "669", "670", "671", "672", "673", "674", "675", "676", "680", "681", "682", "683", "684", "685", "686", "687", "688", "689", "690", "691", "692", "693", "694", "695", "696", "697", "698", "703", "704", "705", "706", "707", "708", "710", "732", "733", "749", "754", "755", "756", "757", "758", "759", "760", "761", "762", "763", "764", "765", "766", "767", "768", "770", "771", "772", "773", "774", "775", "776", "777", "778", "779", "780", "781", "782", "783", "784", "785", "786", "787", "788", "789", "790", "791", "792", "793", "794", "795", "796", "797", "798", "799", "804", "805", "806", "807", "820", "821", "822", "823", "824", "825", "826", "827", "828", "829", "830", "831", "832", "833", "834", "835", "836", "837", "838", "839", "841", "842", "843", "862", "863", "908", "909", "910", "911", "912", "913", "914", "915", "916", "917", "918", "920", "921", "922", "923", "924", "925", "926", "927", "939", "940", "941", "942", "943", "1004", "1007", "1021", "1022", "1023", "1024", "1025", "1037", "1038", "1039", "1041", "1042", "1043", "1044", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1053", "1054", "1055", "1056", "1057", "1058", "1059", "1060", "1061", "1062", "1063", "1064", "1065", "1066", "1067", "1068", "1069", "1070", "1071", "1072", "1073", "1074", "1075", "1076", "1077", "1078", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1088", "1089", "1090", "1091", "1092", "1093", "1094", "1095", "1096", "1097", "1098", "1099", "1100", "1101", "1102", "1103", "1104", "1105", "1106", "1107", "1108", "1109", "1110", "1111", "1112", "1113", "1114", "1115", "1116", "1117", "1118", "1119", "1120", "1121", "1122", "1123", "1124", "1125", "1126", "1127", "1164", "1173", "1174", "1176", "1177", "1188", "1189", "1190", "1191", "1192", "1193", "1204", "1209", "1220", "1221", "1222", "1223", "1224", "1229", "1230", "1231", "1232", "1233", "1234", "1235", "1236", "1239", "1240", "1241", "1242", "1243", "1244", "1245", "1246", "1247", "1248", "1249", "1250", "1251", "1252", "1253", "1254", "1255", "1256", "1257", "1258", "1259", "1260", "1261", "1262", "1263", "1264", "1265", "1266", "1267", "1268", "1269", "1270", "1271", "1272", "1273", "1274", "1275", "1276", "1277", "1278", "1279", "1280", "1281", "1282", "1283", "1284", "1285", "1286", "1287", "1288", "1289", "1290", "1291", "1292", "1293", "1294", "1295", "1296", "1297", "1298", "1299", "1300", "1301", "1302", "1303", "1304", "1310", "1311", "1312", "1313", "1314", "1315", "1316", "1317", "1318", "1319", "1320", "1321", "1322", "1323", "1325", "1326", "1327", "1328", "1329", "1330", "1331", "1332", "1333", "1334", "1335", "1336", "1338", "1339", "1341", "1342", "1351", "1357", "1384", "1385", "1386", "1389", "1390", "1391", "1392", "1393", "1394", "1395", "1419", "1420", "1421", "1422", "1423", "1426", "1427", "1428", "1429", "1431", "1434" ] }, "1003": { "filter": "", "id": "1003", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "20", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "74", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "116", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "326", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "330", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "345", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "407", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "436", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "610", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "668", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "669", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "670", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "674", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "697", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "706", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "754", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "755", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "834", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "913", "kind": "Has_Member", "view_id": "1003" }, { "cwe_id": "922", "kind": "Has_Member", "view_id": "1003" } ], "name": "Weaknesses for Simplified Mapping of Published Vulnerabilities", "objective": "CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete. It is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex navigation of the entire CWE corpus.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "20", "22", "59", "74", "77", "78", "79", "88", "89", "91", "94", "116", "119", "120", "125", "129", "131", "134", "178", "190", "191", "193", "200", "203", "209", "212", "252", "269", "273", "276", "281", "287", "290", "294", "295", "306", "307", "311", "312", "319", "326", "327", "330", "331", "335", "338", "345", "346", "347", "352", "354", "362", "367", "369", "384", "400", "401", "404", "407", "415", "416", "425", "426", "427", "428", "434", "436", "444", "459", "470", "476", "494", "502", "521", "522", "532", "552", "565", "601", "610", "611", "613", "617", "639", "640", "662", "665", "667", "668", "669", "670", "672", "674", "681", "682", "697", "704", "706", "732", "754", "755", "763", "770", "772", "776", "787", "798", "824", "829", "834", "835", "838", "843", "862", "863", "908", "909", "913", "916", "917", "918", "920", "922", "924", "1021", "1188", "1236", "1284", "1321", "1333" ] }, "1008": { "filter": "", "id": "1008", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1009", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1010", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1011", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1012", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1013", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1014", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1015", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1016", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1017", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1018", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1019", "kind": "Has_Member", "view_id": "1008" }, { "cwe_id": "1020", "kind": "Has_Member", "view_id": "1008" } ], "name": "Architectural Concepts", "objective": "This view organizes weaknesses according to common architectural security tactics. It is intended to assist architects in identifying potential mistakes that can be made when designing software.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "6", "15", "20", "59", "73", "74", "75", "76", "77", "78", "79", "88", "89", "90", "91", "93", "94", "95", "96", "97", "98", "99", "114", "117", "138", "150", "201", "208", "209", "210", "211", "212", "214", "219", "220", "223", "224", "243", "250", "256", "257", "258", "259", "260", "261", "262", "263", "266", "267", "268", "269", "270", "271", "272", "273", "274", "276", "277", "279", "280", "281", "282", "283", "284", "285", "286", "287", "288", "289", "290", "291", "293", "294", "295", "296", "297", "298", "299", "300", "301", "302", "303", "304", "305", "306", "307", "308", "311", "312", "313", "314", "315", "316", "317", "318", "319", "321", "322", "323", "324", "325", "326", "327", "328", "330", "331", "332", "333", "334", "335", "336", "337", "338", "339", "341", "345", "346", "347", "349", "352", "353", "354", "359", "370", "384", "390", "391", "392", "403", "419", "420", "425", "426", "434", "441", "460", "472", "473", "488", "494", "502", "521", "522", "523", "527", "528", "529", "530", "532", "538", "544", "550", "551", "552", "565", "566", "579", "593", "599", "601", "602", "603", "610", "611", "613", "620", "639", "640", "641", "642", "643", "645", "647", "649", "652", "653", "656", "668", "669", "671", "673", "703", "707", "708", "732", "754", "755", "757", "759", "760", "770", "778", "779", "780", "782", "784", "790", "791", "792", "793", "794", "795", "796", "797", "798", "807", "827", "829", "830", "836", "841", "862", "863", "916", "921", "922", "923", "924", "939", "940", "941", "942", "943" ] }, "1026": { "filter": "", "id": "1026", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1027", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1028", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1029", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1030", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1031", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1032", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1033", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1034", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1035", "kind": "Has_Member", "view_id": "1026" }, { "cwe_id": "1036", "kind": "Has_Member", "view_id": "1026" } ], "name": "Weaknesses in OWASP Top Ten (2017)", "objective": "CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2017.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "22", "77", "78", "79", "88", "89", "90", "91", "209", "220", "223", "256", "284", "285", "287", "295", "308", "311", "312", "319", "325", "326", "327", "328", "359", "384", "425", "502", "522", "523", "548", "564", "611", "613", "620", "639", "640", "776", "778", "917", "943" ] }, "1040": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[Weakness_Ordinalities/Weakness_Ordinality/Ordinality='Indirect']", "id": "1040", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Quality Weaknesses with Indirect Security Impacts", "objective": "CWE identifiers in this view (slice) are quality issues that only indirectly make it easier to introduce a vulnerability and/or make the vulnerability more difficult to detect or mitigate.", "status": "Incomplete", "type": "Implicit", "weakness_member_ids": [ "456", "474", "475", "477", "483", "484", "489", "546", "547", "554", "561", "562", "563", "585", "587", "589", "594", "676", "684", "710", "758", "766", "1041", "1042", "1043", "1044", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1053", "1054", "1055", "1056", "1057", "1058", "1059", "1060", "1061", "1062", "1063", "1064", "1065", "1066", "1067", "1068", "1069", "1070", "1071", "1072", "1073", "1074", "1075", "1076", "1077", "1078", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1088", "1089", "1090", "1091", "1092", "1093", "1094", "1095", "1096", "1097", "1098", "1099", "1100", "1101", "1102", "1103", "1104", "1105", "1106", "1107", "1108", "1109", "1110", "1111", "1112", "1113", "1114", "1115", "1116", "1117", "1118", "1119", "1120", "1121", "1122", "1123", "1124", "1125", "1126", "1127", "1164", "1173", "1174", "1176", "1177", "1357" ] }, "1081": { "filter": "/Weakness_Catalog/*/*[Notes/Note[@Type='Maintenance']]", "id": "1081", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Entries with Maintenance Notes", "objective": "CWE entries in this view have maintenance notes. Maintenance notes are an indicator that an entry might change significantly in future versions. This view was created due to feedback from the CWE Board and participants in the CWE Compatibility Summit in March 2021.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "20", "32", "33", "73", "74", "91", "99", "103", "114", "131", "138", "159", "170", "172", "192", "194", "202", "208", "213", "226", "228", "234", "250", "257", "259", "263", "267", "269", "271", "272", "274", "276", "280", "282", "284", "286", "300", "301", "327", "328", "329", "330", "331", "332", "333", "334", "335", "336", "337", "338", "339", "340", "341", "342", "343", "345", "346", "350", "359", "362", "372", "385", "391", "428", "441", "446", "451", "453", "466", "502", "514", "515", "538", "600", "610", "613", "639", "640", "654", "664", "667", "670", "697", "707", "708", "732", "760", "761", "763", "764", "765", "767", "772", "780", "784", "785", "820", "821", "822", "823", "824", "825", "915", "917", "922", "924", "925", "1037", "1188", "1204", "1240", "1241", "1253", "1254", "1259", "1260", "1263", "1264", "1266", "1268", "1271", "1273", "1278", "1282", "1283", "1284", "1285", "1286", "1287", "1288", "1289", "1294", "1296", "1297", "1301", "1303", "1316", "1319", "1336", "1342", "1357", "1386", "1426" ] }, "1128": { "filter": "", "id": "1128", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1129", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1130", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1131", "kind": "Has_Member", "view_id": "1128" }, { "cwe_id": "1132", "kind": "Has_Member", "view_id": "1128" } ], "name": "CISQ Quality Measures (2016)", "objective": "This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2016. These measures are derived from Object Management Group (OMG) standards.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "22", "78", "79", "89", "99", "120", "129", "134", "252", "327", "396", "397", "434", "456", "561", "606", "667", "672", "674", "681", "704", "766", "772", "788", "789", "798", "835", "1041", "1042", "1043", "1044", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1054", "1055", "1056", "1057", "1058", "1060", "1062", "1063", "1064", "1065", "1066", "1067", "1069", "1070", "1072", "1073", "1074", "1075", "1077", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1088", "1089", "1090", "1091", "1092", "1094", "1095", "1096", "1097", "1098", "1121" ] }, "1133": { "filter": "", "id": "1133", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1134", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1135", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1136", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1137", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1138", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1139", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1140", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1141", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1142", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1143", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1144", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1145", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1146", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1147", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1148", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1149", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1150", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1151", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1152", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1153", "kind": "Has_Member", "view_id": "1133" }, { "cwe_id": "1175", "kind": "Has_Member", "view_id": "1133" } ], "name": "Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java", "objective": "CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.", "status": "Stable", "type": "Graph", "weakness_member_ids": [ "67", "78", "111", "116", "117", "134", "144", "150", "180", "182", "190", "191", "197", "198", "248", "252", "259", "266", "272", "276", "279", "289", "311", "319", "327", "330", "332", "336", "337", "349", "359", "362", "366", "369", "374", "375", "377", "382", "392", "397", "400", "401", "404", "405", "409", "410", "412", "413", "459", "460", "476", "486", "491", "492", "498", "499", "500", "502", "532", "567", "568", "572", "573", "581", "583", "584", "586", "589", "595", "597", "609", "617", "647", "662", "665", "667", "681", "682", "697", "703", "705", "732", "754", "766", "770", "798", "820", "838" ] }, "1154": { "filter": "", "id": "1154", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1155", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1156", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1157", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1158", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1159", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1160", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1161", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1162", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1163", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1165", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1166", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1167", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1168", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1169", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1170", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1171", "kind": "Has_Member", "view_id": "1154" }, { "cwe_id": "1172", "kind": "Has_Member", "view_id": "1154" } ], "name": "Weaknesses Addressed by the SEI CERT C Coding Standard", "objective": "CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT C Coding Standard.", "status": "Stable", "type": "Graph", "weakness_member_ids": [ "20", "67", "78", "88", "119", "120", "121", "122", "123", "125", "129", "131", "134", "170", "190", "191", "192", "194", "195", "197", "241", "242", "252", "253", "273", "327", "330", "331", "338", "363", "366", "369", "377", "391", "401", "404", "415", "416", "456", "459", "467", "468", "469", "476", "479", "480", "481", "562", "587", "590", "628", "662", "664", "666", "667", "672", "676", "680", "681", "682", "685", "686", "690", "696", "704", "705", "758", "762", "771", "772", "773", "775", "786", "789", "805", "843", "908", "910" ] }, "1178": { "filter": "", "id": "1178", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1179", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "1180", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "1181", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "1182", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "1183", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "1184", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "1185", "kind": "Has_Member", "view_id": "1178" }, { "cwe_id": "1186", "kind": "Has_Member", "view_id": "1178" } ], "name": "Weaknesses Addressed by the SEI CERT Perl Coding Standard", "objective": "CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Perl Coding Standard.", "status": "Stable", "type": "Graph", "weakness_member_ids": [ "22", "59", "77", "95", "116", "129", "134", "248", "252", "375", "391", "394", "456", "457", "460", "477", "561", "563", "597", "628", "690", "705", "754", "767", "783", "789" ] }, "1194": { "filter": "", "id": "1194", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1195", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1196", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1197", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1198", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1199", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1201", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1202", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1203", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1205", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1206", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1207", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1208", "kind": "Has_Member", "view_id": "1194" }, { "cwe_id": "1388", "kind": "Has_Member", "view_id": "1194" } ], "name": "Hardware Design", "objective": "This view organizes weaknesses around concepts that are frequently used or encountered in hardware design. Accordingly, this view can align closely with the perspectives of designers, manufacturers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "203", "226", "276", "319", "325", "440", "441", "1053", "1059", "1189", "1190", "1191", "1192", "1193", "1209", "1220", "1221", "1222", "1223", "1224", "1231", "1232", "1233", "1234", "1239", "1240", "1241", "1242", "1243", "1244", "1245", "1246", "1247", "1248", "1250", "1251", "1252", "1253", "1254", "1255", "1256", "1257", "1258", "1259", "1260", "1261", "1262", "1263", "1264", "1266", "1267", "1268", "1269", "1270", "1271", "1272", "1273", "1274", "1276", "1277", "1278", "1279", "1280", "1281", "1282", "1283", "1290", "1291", "1292", "1294", "1295", "1296", "1297", "1298", "1299", "1300", "1301", "1302", "1303", "1304", "1310", "1311", "1312", "1313", "1314", "1315", "1316", "1317", "1318", "1319", "1320", "1323", "1326", "1328", "1329", "1330", "1331", "1332", "1334", "1338", "1342", "1351", "1357", "1384", "1420", "1421", "1422", "1423", "1429", "1431" ] }, "1200": { "filter": "", "id": "1200", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "787", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "426", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1200" }, { "cwe_id": "295", "kind": "Has_Member", "view_id": "1200" } ], "name": "Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors", "objective": "CWE entries in this view are listed in the 2019 CWE Top 25 Most Dangerous Software Errors.", "status": "Stable", "type": "Graph", "weakness_member_ids": [ "20", "22", "78", "79", "89", "94", "119", "125", "190", "200", "269", "287", "295", "352", "400", "416", "426", "434", "476", "502", "611", "732", "772", "787", "798" ] }, "1305": { "filter": "", "id": "1305", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1306", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1307", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1308", "kind": "Has_Member", "view_id": "1305" }, { "cwe_id": "1309", "kind": "Has_Member", "view_id": "1305" } ], "name": "CISQ Quality Measures (2020)", "objective": "This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "22", "23", "36", "77", "78", "79", "88", "89", "90", "91", "99", "119", "120", "123", "125", "129", "130", "131", "134", "170", "194", "195", "196", "197", "248", "252", "259", "321", "366", "369", "390", "391", "392", "394", "401", "404", "407", "415", "416", "424", "434", "456", "457", "459", "476", "477", "478", "480", "484", "502", "543", "561", "562", "564", "567", "570", "571", "595", "597", "606", "611", "624", "643", "652", "662", "665", "667", "672", "681", "682", "703", "704", "732", "758", "764", "772", "775", "778", "783", "786", "787", "788", "789", "798", "805", "820", "821", "822", "823", "824", "825", "833", "835", "908", "917", "1041", "1042", "1043", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1054", "1055", "1057", "1058", "1060", "1062", "1064", "1066", "1067", "1070", "1072", "1073", "1074", "1075", "1077", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1088", "1089", "1090", "1091", "1094", "1095", "1096", "1097", "1098" ] }, "1337": { "filter": "", "id": "1337", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "787", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1337" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1337" } ], "name": "Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses", "objective": "CWE entries in this view are listed in the 2021 CWE Top 25 Most Dangerous Software Weaknesses.", "status": "Stable", "type": "Graph", "weakness_member_ids": [ "20", "22", "77", "78", "79", "89", "119", "125", "190", "200", "276", "287", "306", "352", "416", "434", "476", "502", "522", "611", "732", "787", "798", "862", "918" ] }, "1340": { "filter": "", "id": "1340", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "119", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "665", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "404", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "652", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "643", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "91", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "1051", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "424", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "662", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "704", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "562", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "606", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "703", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "908", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "682", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "213", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "915", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "311", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "359", "kind": "Has_Member", "view_id": "1340" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1340" } ], "name": "CISQ Data Protection Measures", "objective": "This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "22", "23", "36", "77", "78", "79", "88", "89", "90", "91", "99", "119", "120", "123", "125", "129", "130", "131", "134", "170", "194", "195", "196", "197", "213", "248", "259", "284", "285", "287", "288", "311", "321", "359", "366", "369", "391", "392", "404", "415", "416", "424", "434", "456", "457", "502", "543", "562", "567", "606", "611", "624", "639", "643", "652", "662", "665", "667", "672", "681", "682", "703", "704", "732", "761", "762", "763", "764", "772", "775", "786", "787", "788", "798", "805", "820", "821", "822", "823", "824", "825", "862", "863", "908", "915", "917", "1051", "1058", "1096" ] }, "1343": { "filter": "", "id": "1343", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1189", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1191", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1231", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1233", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1240", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1244", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1256", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1260", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1272", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1274", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1277", "kind": "Has_Member", "view_id": "1343" }, { "cwe_id": "1300", "kind": "Has_Member", "view_id": "1343" } ], "name": "Weaknesses in the 2021 CWE Most Important Hardware Weaknesses List", "objective": "CWE entries in this view are listed in the 2021 CWE Most Important Hardware Weaknesses List, as determined by the Hardware CWE Special Interest Group (HW CWE SIG).", "status": "Stable", "type": "Explicit", "weakness_member_ids": [ "1189", "1191", "1231", "1233", "1240", "1244", "1256", "1260", "1272", "1274", "1277", "1300" ] }, "1344": { "filter": "", "id": "1344", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1345", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1346", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1347", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1348", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1349", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1352", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1353", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1354", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1355", "kind": "Has_Member", "view_id": "1344" }, { "cwe_id": "1356", "kind": "Has_Member", "view_id": "1344" } ], "name": "Weaknesses in OWASP Top Ten (2021)", "objective": "CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "11", "13", "15", "20", "22", "23", "35", "59", "73", "74", "75", "77", "78", "79", "80", "83", "87", "88", "89", "90", "91", "93", "94", "95", "96", "97", "98", "99", "113", "116", "117", "138", "183", "184", "200", "201", "209", "213", "219", "223", "235", "256", "257", "259", "260", "261", "266", "269", "276", "280", "284", "285", "287", "288", "290", "294", "295", "296", "297", "300", "302", "304", "306", "307", "311", "312", "313", "315", "316", "319", "321", "322", "323", "324", "325", "326", "327", "328", "329", "330", "331", "335", "336", "337", "338", "340", "345", "346", "347", "352", "353", "359", "377", "384", "402", "419", "425", "426", "430", "434", "441", "444", "451", "470", "471", "472", "494", "497", "501", "502", "520", "521", "522", "523", "525", "526", "532", "537", "538", "539", "540", "541", "547", "548", "552", "564", "565", "566", "579", "598", "601", "602", "610", "611", "613", "614", "620", "639", "640", "642", "643", "644", "646", "650", "651", "652", "653", "656", "657", "668", "706", "756", "757", "759", "760", "776", "778", "780", "784", "798", "799", "807", "829", "830", "841", "862", "863", "913", "915", "916", "917", "918", "922", "927", "940", "942", "1004", "1021", "1104", "1173", "1174", "1275" ] }, "1350": { "filter": "", "id": "1350", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "79", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "787", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1350" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1350" } ], "name": "Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses", "objective": "CWE entries in this view are listed in the 2020 CWE Top 25 Most Dangerous Software Weaknesses.", "status": "Stable", "type": "Graph", "weakness_member_ids": [ "20", "22", "78", "79", "89", "94", "119", "125", "190", "200", "269", "287", "306", "352", "400", "416", "434", "476", "502", "522", "611", "732", "787", "798", "862" ] }, "1358": { "filter": "", "id": "1358", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1359", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1360", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1361", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1362", "kind": "Has_Member", "view_id": "1358" }, { "cwe_id": "1363", "kind": "Has_Member", "view_id": "1358" } ], "name": "Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS", "objective": "CWE entries in this view (graph) are associated with the Categories of Security Vulnerabilities in ICS, as published by the Securing Energy Infrastructure Executive Task Force (SEI ETF) in March 2022. Weaknesses and categories in this view are focused on issues that affect ICS (Industrial Control Systems) but have not been traditionally covered by CWE in the past due to its earlier emphasis on enterprise IT software. Note: weaknesses in this view are based on \"Nearest IT Neighbor\" recommendations and other suggestions by the CWE team. These relationships are likely to change in future CWE versions.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "15", "20", "121", "125", "212", "268", "269", "276", "284", "285", "287", "288", "290", "295", "296", "306", "308", "311", "312", "319", "325", "327", "329", "330", "336", "337", "341", "346", "349", "358", "362", "377", "384", "406", "434", "440", "451", "470", "489", "494", "501", "601", "603", "610", "636", "638", "648", "655", "664", "668", "669", "693", "707", "710", "754", "787", "807", "829", "912", "1053", "1059", "1068", "1104", "1110", "1111", "1189", "1231", "1233", "1242", "1247", "1261", "1263", "1278", "1303", "1329", "1332", "1338", "1351", "1357", "1384", "1393" ] }, "1387": { "filter": "", "id": "1387", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "787", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "611", "kind": "Has_Member", "view_id": "1387" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1387" } ], "name": "Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses", "objective": "CWE entries in this view are listed in the 2022 CWE Top 25 Most Dangerous Software Weaknesses.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "20", "22", "77", "78", "79", "89", "94", "119", "125", "190", "276", "287", "306", "352", "362", "400", "416", "434", "476", "502", "611", "787", "798", "862", "918" ] }, "1400": { "filter": "", "id": "1400", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1396", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1397", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1398", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1401", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1402", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1403", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1404", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1405", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1406", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1407", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1408", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1409", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1410", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1411", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1399", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1412", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1413", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1414", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1415", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1416", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1417", "kind": "Has_Member", "view_id": "1400" }, { "cwe_id": "1418", "kind": "Has_Member", "view_id": "1400" } ], "name": "Comprehensive Categorization for Software Assurance Trends", "objective": "This view organizes weaknesses around categories that are of interest to large-scale software assurance research to support the elimination of weaknesses using tactics such as secure language development. It is also intended to help tracking weakness trends in publicly disclosed vulnerability data. This view is comprehensive in that every weakness must be contained in it, unlike most other views that only use a subset of weaknesses. This view is structured with categories at the top level, with a second level of only weaknesses. Relationships among the weaknesses presented under the research view (CWE-1000) are not shown. Each weakness is added to only one category. All categories are mutually exclusive; that is, no weakness can be a member of more than one category. While weaknesses defy strict categorization along only one characteristic, the forced bucketing into a single category can simplify certain kinds of analysis. Note that the size of each category can vary widely because (1) CWE is not as well fleshed-out in some areas compared to others; (2) abstraction of the CWEs in the grouping might go down to Variant level for some buckets, versus others.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "5", "6", "7", "8", "9", "11", "12", "13", "14", "15", "20", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "61", "62", "64", "65", "66", "67", "69", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "90", "91", "93", "94", "95", "96", "97", "98", "99", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "115", "116", "117", "118", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "134", "135", "138", "140", "141", "142", "143", "144", "145", "146", "147", "148", "149", "150", "151", "152", "153", "154", "155", "156", "157", "158", "159", "160", "161", "162", "163", "164", "165", "166", "167", "168", "170", "172", "173", "174", "175", "176", "177", "178", "179", "180", "181", "182", "183", "184", "185", "186", "187", "188", "190", "191", "192", "193", "194", "195", "196", "197", "198", "200", "201", "202", "203", "204", "205", "206", "207", "208", "209", "210", "211", "212", "213", "214", "215", "219", "220", "221", "222", "223", "224", "226", "228", "229", "230", "231", "232", "233", "234", "235", "236", "237", "238", "239", "240", "241", "242", "243", "244", "245", "246", "248", "250", "252", "253", "256", "257", "258", "259", "260", "261", "262", "263", "266", "267", "268", "269", "270", "271", "272", "273", "274", "276", "277", "278", "279", "280", "281", "282", "283", "284", "285", "286", "287", "288", "289", "290", "291", "293", "294", "295", "296", "297", "298", "299", "300", "301", "302", "303", "304", "305", "306", "307", "308", "309", "311", "312", "313", "314", "315", "316", "317", "318", "319", "321", "322", "323", "324", "325", "326", "327", "328", "329", "330", "331", "332", "333", "334", "335", "336", "337", "338", "339", "340", "341", "342", "343", "344", "345", "346", "347", "348", "349", "350", "351", "352", "353", "354", "356", "357", "358", "359", "360", "362", "363", "364", "366", "367", "368", "369", "370", "372", "374", "375", "377", "378", "379", "382", "383", "384", "385", "386", "390", "391", "392", "393", "394", "395", "396", "397", "400", "401", "402", "403", "404", "405", "406", "407", "408", "409", "410", "412", "413", "414", "415", "416", "419", "420", "421", "422", "424", "425", "426", "427", "428", "430", "431", "432", "433", "434", "435", "436", "437", "439", "440", "441", "444", "446", "447", "448", "449", "450", "451", "453", "454", "455", "456", "457", "459", "460", "462", "463", "464", "466", "467", "468", "469", "470", "471", "472", "473", "474", "475", "476", "477", "478", "479", "480", "481", "482", "483", "484", "486", "487", "488", "489", "491", "492", "493", "494", "495", "496", "497", "498", "499", "500", "501", "502", "506", "507", "508", "509", "510", "511", "512", "514", "515", "520", "521", "522", "523", "524", "525", "526", "527", "528", "529", "530", "531", "532", "535", "536", "537", "538", "539", "540", "541", "543", "544", "546", "547", "548", "549", "550", "551", "552", "553", "554", "555", "556", "558", "560", "561", "562", "563", "564", "565", "566", "567", "568", "570", "571", "572", "573", "574", "575", "576", "577", "578", "579", "580", "581", "582", "583", "584", "585", "586", "587", "588", "589", "590", "591", "593", "594", "595", "597", "598", "599", "600", "601", "602", "603", "605", "606", "607", "608", "609", "610", "611", "612", "613", "614", "615", "616", "617", "618", "619", "620", "621", "622", "623", "624", "625", "626", "627", "628", "636", "637", "638", "639", "640", "641", "642", "643", "644", "645", "646", "647", "648", "649", "650", "651", "652", "653", "654", "655", "656", "657", "662", "663", "664", "665", "666", "667", "668", "669", "670", "671", "672", "673", "674", "675", "676", "680", "681", "682", "683", "684", "685", "686", "687", "688", "689", "690", "691", "692", "693", "694", "695", "696", "697", "698", "703", "704", "705", "706", "707", "708", "710", "732", "733", "749", "754", "755", "756", "757", "758", "759", "760", "761", "762", "763", "764", "765", "766", "767", "768", "770", "771", "772", "773", "774", "775", "776", "777", "778", "779", "780", "781", "782", "783", "784", "785", "786", "787", "788", "789", "790", "791", "792", "793", "794", "795", "796", "797", "798", "799", "804", "805", "806", "807", "820", "821", "822", "823", "824", "825", "826", "827", "828", "829", "830", "831", "832", "833", "834", "835", "836", "837", "838", "839", "841", "842", "843", "862", "863", "908", "909", "910", "911", "912", "913", "914", "915", "916", "917", "918", "920", "921", "922", "923", "924", "925", "926", "927", "939", "940", "941", "942", "943", "1004", "1007", "1021", "1022", "1023", "1024", "1025", "1037", "1038", "1039", "1041", "1042", "1043", "1044", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1053", "1054", "1055", "1056", "1057", "1058", "1059", "1060", "1061", "1062", "1063", "1064", "1065", "1066", "1067", "1068", "1069", "1070", "1071", "1072", "1073", "1074", "1075", "1076", "1077", "1078", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1088", "1089", "1090", "1091", "1092", "1093", "1094", "1095", "1096", "1097", "1098", "1099", "1100", "1101", "1102", "1103", "1104", "1105", "1106", "1107", "1108", "1109", "1110", "1111", "1112", "1113", "1114", "1115", "1116", "1117", "1118", "1119", "1120", "1121", "1122", "1123", "1124", "1125", "1126", "1127", "1164", "1173", "1174", "1176", "1177", "1188", "1189", "1190", "1191", "1192", "1193", "1204", "1209", "1220", "1221", "1222", "1223", "1224", "1229", "1230", "1231", "1232", "1233", "1234", "1235", "1236", "1239", "1240", "1241", "1242", "1243", "1244", "1245", "1246", "1247", "1248", "1249", "1250", "1251", "1252", "1253", "1254", "1255", "1256", "1257", "1258", "1259", "1260", "1261", "1262", "1263", "1264", "1265", "1266", "1267", "1268", "1269", "1270", "1271", "1272", "1273", "1274", "1275", "1276", "1277", "1278", "1279", "1280", "1281", "1282", "1283", "1284", "1285", "1286", "1287", "1288", "1289", "1290", "1291", "1292", "1293", "1294", "1295", "1296", "1297", "1298", "1299", "1300", "1301", "1302", "1303", "1304", "1310", "1311", "1312", "1313", "1314", "1315", "1316", "1317", "1318", "1319", "1320", "1321", "1322", "1323", "1325", "1326", "1327", "1328", "1329", "1330", "1331", "1332", "1333", "1334", "1335", "1336", "1338", "1339", "1341", "1342", "1351", "1357", "1384", "1385", "1386", "1389", "1390", "1391", "1392", "1393", "1394", "1395", "1419", "1420", "1421", "1422", "1423", "1426", "1427", "1428", "1429", "1431", "1434" ] }, "1424": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[./Taxonomy_Mappings/Taxonomy_Mapping/@Taxonomy_Name='ISA/IEC 62443']", "id": "1424", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses Addressed by ISA/IEC 62443 Requirements", "objective": "This view (slice) covers weaknesses that are addressed by following requirements in the ISA/IEC 62443 series of standards for industrial automation and control systems (IACS). Members of the CWE ICS/OT SIG analyzed a set of CWEs and mapped them to specific requirements covered by ISA/IEC 62443. These mappings are recorded in Taxonomy_Mapping elements.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "94", "122", "190", "250", "256", "269", "276", "287", "306", "311", "312", "319", "321", "327", "346", "347", "353", "354", "400", "416", "654", "655", "657", "754", "770", "771", "779", "787", "798", "862", "863", "920", "1059", "1235", "1242", "1246", "1357", "1391", "1395" ] }, "1425": { "filter": "", "id": "1425", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "787", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1425" }, { "cwe_id": "276", "kind": "Has_Member", "view_id": "1425" } ], "name": "Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses", "objective": "CWE entries in this view are listed in the 2023 CWE Top 25 Most Dangerous Software Weaknesses.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "20", "22", "77", "78", "79", "89", "94", "119", "125", "190", "269", "276", "287", "306", "352", "362", "416", "434", "476", "502", "787", "798", "862", "863", "918" ] }, "1430": { "filter": "", "id": "1430", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "79", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "787", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "269", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "1430" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1430" } ], "name": "Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses", "objective": "CWE entries in this view are listed in the 2024 CWE Top 25 Most Dangerous Software Weaknesses.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "20", "22", "77", "78", "79", "89", "94", "119", "125", "190", "200", "269", "287", "306", "352", "400", "416", "434", "476", "502", "787", "798", "862", "863", "918" ] }, "1432": { "filter": "", "id": "1432", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "226", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1189", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1191", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1234", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1247", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1256", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1260", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1262", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1300", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1421", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1423", "kind": "Has_Member", "view_id": "1432" }, { "cwe_id": "1433", "kind": "Has_Member", "view_id": "1432" } ], "name": "Weaknesses in the 2025 CWE Most Important Hardware Weaknesses List", "objective": "CWE entries in this view are listed in the 2025 CWE Most Important Hardware Weaknesses List, as determined by the Hardware CWE Special Interest Group (HW CWE SIG). The 2025 MIHW aims to drive awareness of critical hardware weaknesses and provide the cybersecurity community with practical guidance to prevent security issues at the source. By combining advanced data analysis with expert consensus, the list helps organizations prioritize mitigations, strengthen design practices, and make informed decisions throughout the hardware lifecycle.", "status": "Stable", "type": "Graph", "weakness_member_ids": [ "226", "1189", "1191", "1231", "1233", "1234", "1244", "1247", "1256", "1260", "1262", "1272", "1300", "1421", "1423", "1431" ] }, "1435": { "filter": "", "id": "1435", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "79", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "787", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "416", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "125", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "121", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "122", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "284", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "918", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "77", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "639", "kind": "Has_Member", "view_id": "1435" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "1435" } ], "name": "Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses", "objective": "CWE entries in this view are listed in the 2025 CWE Top 25 Most Dangerous Software Weaknesses.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "20", "22", "77", "78", "79", "89", "94", "120", "121", "122", "125", "200", "284", "306", "352", "416", "434", "476", "502", "639", "770", "787", "862", "863", "918" ] }, "1448": { "filter": "", "id": "1448", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1446", "kind": "Has_Member", "view_id": "1448" }, { "cwe_id": "1447", "kind": "Has_Member", "view_id": "1448" } ], "name": "Weaknesses Related to AI/ML Products", "objective": "CWE entries in this view (graph) are unique to AI/ML products, or are commonly encountered in products that use or support AI/ML.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "22", "77", "78", "79", "94", "95", "116", "250", "434", "502", "862", "918", "1039", "1336", "1426", "1427", "1434" ] }, "1450": { "filter": "", "id": "1450", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1436", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1437", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1438", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1439", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1440", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1441", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1442", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1443", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1444", "kind": "Has_Member", "view_id": "1450" }, { "cwe_id": "1445", "kind": "Has_Member", "view_id": "1450" } ], "name": "Weaknesses in OWASP Top Ten RC1 (2025)", "objective": "CWE entries in this view (graph) are associated with the first release candidate (RC1) of the OWASP Top Ten, as released in 2025.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "5", "11", "13", "15", "20", "22", "23", "36", "59", "61", "65", "73", "74", "76", "77", "78", "79", "80", "83", "86", "88", "89", "90", "91", "93", "94", "95", "96", "97", "98", "99", "103", "104", "112", "113", "114", "115", "116", "117", "129", "159", "183", "200", "201", "209", "215", "219", "221", "223", "234", "235", "248", "252", "256", "258", "259", "260", "261", "266", "269", "274", "276", "280", "281", "282", "283", "284", "285", "286", "287", "288", "289", "290", "291", "293", "294", "295", "296", "297", "298", "299", "300", "302", "303", "304", "305", "306", "307", "308", "309", "311", "312", "313", "315", "316", "319", "321", "322", "323", "324", "325", "326", "327", "328", "329", "330", "331", "332", "334", "335", "336", "337", "338", "340", "342", "345", "346", "347", "350", "352", "353", "359", "362", "369", "377", "379", "382", "384", "390", "391", "394", "396", "397", "402", "419", "424", "425", "426", "427", "434", "436", "441", "444", "447", "451", "454", "460", "470", "472", "476", "477", "478", "484", "489", "493", "494", "497", "500", "501", "502", "506", "509", "521", "522", "523", "525", "526", "532", "538", "539", "540", "547", "548", "550", "552", "564", "565", "566", "598", "601", "602", "610", "611", "613", "614", "615", "620", "628", "636", "639", "640", "642", "643", "644", "646", "653", "656", "657", "668", "676", "693", "703", "732", "749", "754", "755", "756", "757", "759", "760", "776", "778", "780", "784", "798", "799", "807", "829", "830", "841", "862", "863", "915", "916", "917", "918", "922", "926", "940", "941", "942", "1004", "1021", "1022", "1104", "1125", "1174", "1240", "1241", "1275", "1329", "1390", "1391", "1392", "1393", "1395" ] }, "2000": { "filter": "/Weakness_Catalog/*[not(self::External_References)]/*", "id": "2000", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Comprehensive CWE Dictionary", "objective": "This view (slice) covers all the elements in CWE.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "5", "6", "7", "8", "9", "11", "12", "13", "14", "15", "20", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "61", "62", "64", "65", "66", "67", "69", "71", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "90", "91", "92", "93", "94", "95", "96", "97", "98", "99", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "115", "116", "117", "118", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "132", "134", "135", "138", "140", "141", "142", "143", "144", "145", "146", "147", "148", "149", "150", "151", "152", "153", "154", "155", "156", "157", "158", "159", "160", "161", "162", "163", "164", "165", "166", "167", "168", "170", "172", "173", "174", "175", "176", "177", "178", "179", "180", "181", "182", "183", "184", "185", "186", "187", "188", "190", "191", "192", "193", "194", "195", "196", "197", "198", "200", "201", "202", "203", "204", "205", "206", "207", "208", "209", "210", "211", "212", "213", "214", "215", "216", "217", "218", "219", "220", "221", "222", "223", "224", "225", "226", "228", "229", "230", "231", "232", "233", "234", "235", "236", "237", "238", "239", "240", "241", "242", "243", "244", "245", "246", "247", "248", "249", "250", "252", "253", "256", "257", "258", "259", "260", "261", "262", "263", "266", "267", "268", "269", "270", "271", "272", "273", "274", "276", "277", "278", "279", "280", "281", "282", "283", "284", "285", "286", "287", "288", "289", "290", "291", "292", "293", "294", "295", "296", "297", "298", "299", "300", "301", "302", "303", "304", "305", "306", "307", "308", "309", "311", "312", "313", "314", "315", "316", "317", "318", "319", "321", "322", "323", "324", "325", "326", "327", "328", "329", "330", "331", "332", "333", "334", "335", "336", "337", "338", "339", "340", "341", "342", "343", "344", "345", "346", "347", "348", "349", "350", "351", "352", "353", "354", "356", "357", "358", "359", "360", "362", "363", "364", "365", "366", "367", "368", "369", "370", "372", "373", "374", "375", "377", "378", "379", "382", "383", "384", "385", "386", "390", "391", "392", "393", "394", "395", "396", "397", "400", "401", "402", "403", "404", "405", "406", "407", "408", "409", "410", "412", "413", "414", "415", "416", "419", "420", "421", "422", "423", "424", "425", "426", "427", "428", "430", "431", "432", "433", "434", "435", "436", "437", "439", "440", "441", "443", "444", "446", "447", "448", "449", "450", "451", "453", "454", "455", "456", "457", "458", "459", "460", "462", "463", "464", "466", "467", "468", "469", "470", "471", "472", "473", "474", "475", "476", "477", "478", "479", "480", "481", "482", "483", "484", "486", "487", "488", "489", "491", "492", "493", "494", "495", "496", "497", "498", "499", "500", "501", "502", "506", "507", "508", "509", "510", "511", "512", "514", "515", "516", "520", "521", "522", "523", "524", "525", "526", "527", "528", "529", "530", "531", "532", "533", "534", "535", "536", "537", "538", "539", "540", "541", "542", "543", "544", "545", "546", "547", "548", "549", "550", "551", "552", "553", "554", "555", "556", "558", "560", "561", "562", "563", "564", "565", "566", "567", "568", "570", "571", "572", "573", "574", "575", "576", "577", "578", "579", "580", "581", "582", "583", "584", "585", "586", "587", "588", "589", "590", "591", "592", "593", "594", "595", "596", "597", "598", "599", "600", "601", "602", "603", "605", "606", "607", "608", "609", "610", "611", "612", "613", "614", "615", "616", "617", "618", "619", "620", "621", "622", "623", "624", "625", "626", "627", "628", "636", "637", "638", "639", "640", "641", "642", "643", "644", "645", "646", "647", "648", "649", "650", "651", "652", "653", "654", "655", "656", "657", "662", "663", "664", "665", "666", "667", "668", "669", "670", "671", "672", "673", "674", "675", "676", "680", "681", "682", "683", "684", "685", "686", "687", "688", "689", "690", "691", "692", "693", "694", "695", "696", "697", "698", "703", "704", "705", "706", "707", "708", "710", "732", "733", "749", "754", "755", "756", "757", "758", "759", "760", "761", "762", "763", "764", "765", "766", "767", "768", "769", "770", "771", "772", "773", "774", "775", "776", "777", "778", "779", "780", "781", "782", "783", "784", "785", "786", "787", "788", "789", "790", "791", "792", "793", "794", "795", "796", "797", "798", "799", "804", "805", "806", "807", "820", "821", "822", "823", "824", "825", "826", "827", "828", "829", "830", "831", "832", "833", "834", "835", "836", "837", "838", "839", "841", "842", "843", "862", "863", "908", "909", "910", "911", "912", "913", "914", "915", "916", "917", "918", "920", "921", "922", "923", "924", "925", "926", "927", "939", "940", "941", "942", "943", "1004", "1007", "1021", "1022", "1023", "1024", "1025", "1037", "1038", "1039", "1041", "1042", "1043", "1044", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1053", "1054", "1055", "1056", "1057", "1058", "1059", "1060", "1061", "1062", "1063", "1064", "1065", "1066", "1067", "1068", "1069", "1070", "1071", "1072", "1073", "1074", "1075", "1076", "1077", "1078", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1088", "1089", "1090", "1091", "1092", "1093", "1094", "1095", "1096", "1097", "1098", "1099", "1100", "1101", "1102", "1103", "1104", "1105", "1106", "1107", "1108", "1109", "1110", "1111", "1112", "1113", "1114", "1115", "1116", "1117", "1118", "1119", "1120", "1121", "1122", "1123", "1124", "1125", "1126", "1127", "1164", "1173", "1174", "1176", "1177", "1187", "1188", "1189", "1190", "1191", "1192", "1193", "1204", "1209", "1220", "1221", "1222", "1223", "1224", "1229", "1230", "1231", "1232", "1233", "1234", "1235", "1236", "1239", "1240", "1241", "1242", "1243", "1244", "1245", "1246", "1247", "1248", "1249", "1250", "1251", "1252", "1253", "1254", "1255", "1256", "1257", "1258", "1259", "1260", "1261", "1262", "1263", "1264", "1265", "1266", "1267", "1268", "1269", "1270", "1271", "1272", "1273", "1274", "1275", "1276", "1277", "1278", "1279", "1280", "1281", "1282", "1283", "1284", "1285", "1286", "1287", "1288", "1289", "1290", "1291", "1292", "1293", "1294", "1295", "1296", "1297", "1298", "1299", "1300", "1301", "1302", "1303", "1304", "1310", "1311", "1312", "1313", "1314", "1315", "1316", "1317", "1318", "1319", "1320", "1321", "1322", "1323", "1324", "1325", "1326", "1327", "1328", "1329", "1330", "1331", "1332", "1333", "1334", "1335", "1336", "1338", "1339", "1341", "1342", "1351", "1357", "1384", "1385", "1386", "1389", "1390", "1391", "1392", "1393", "1394", "1395", "1419", "1420", "1421", "1422", "1423", "1426", "1427", "1428", "1429", "1431", "1434" ] }, "604": { "filter": "/Weakness_Catalog/*/*[@Status='Deprecated']", "id": "604", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Deprecated Entries", "objective": "CWE nodes in this view (slice) have been deprecated. There should be a reference pointing to the replacement in each deprecated weakness.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "71", "92", "132", "216", "217", "218", "225", "247", "249", "292", "365", "373", "423", "443", "458", "516", "533", "534", "542", "545", "592", "596", "769", "1187", "1324" ] }, "629": { "filter": "", "id": "629", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "712", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "713", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "714", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "715", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "716", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "717", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "718", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "719", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "720", "kind": "Has_Member", "view_id": "629" }, { "cwe_id": "721", "kind": "Has_Member", "view_id": "629" } ], "name": "Weaknesses in OWASP Top Ten (2007)", "objective": "CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2007. This view is considered obsolete as a newer version of the OWASP Top Ten is available.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "22", "77", "78", "79", "89", "90", "91", "93", "95", "98", "200", "203", "209", "215", "285", "287", "288", "301", "311", "321", "325", "326", "352", "425", "434", "472", "522", "639" ] }, "630": { "filter": "", "id": "630", "mapping": { "comments": "N/A", "rationale": "This CWE has been deprecated. It is also a View.", "reasons": [ "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "DEPRECATED: Weaknesses Examined by SAMATE", "objective": "This view has been deprecated. It was only used for an early year of the NIST SAMATE project, and it did not represent any official or commonly-utilized list.", "status": "Deprecated", "type": "Explicit", "weakness_member_ids": [] }, "631": { "filter": "", "id": "631", "mapping": { "comments": "N/A", "rationale": "This CWE has been deprecated. It is also a View.", "reasons": [ "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "DEPRECATED: Resource-specific Weaknesses", "objective": "This view has been deprecated because it is not actively maintained and does not provide utility to stakeholders. It was originally created before CWE 1.0 as a simple example of how views could be structured within CWE.", "status": "Deprecated", "type": "Graph", "weakness_member_ids": [] }, "635": { "filter": "", "id": "635", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "16", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "189", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "255", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "264", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "310", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "399", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "119", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "20", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "200", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "287", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "362", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "635" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "635" } ], "name": "Weaknesses Originally Used by NVD from 2008 to 2016", "objective": "CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.", "status": "Obsolete", "type": "Explicit", "weakness_member_ids": [ "20", "22", "59", "78", "79", "89", "94", "119", "134", "200", "287", "352", "362" ] }, "658": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='C']", "id": "658", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses in Software Written in C", "objective": "This view (slice) covers issues that are found in C programs that are not common to all languages.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "14", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "134", "135", "158", "170", "188", "190", "191", "192", "193", "194", "195", "196", "197", "242", "243", "244", "362", "364", "366", "374", "375", "401", "403", "415", "416", "457", "460", "462", "463", "464", "466", "467", "468", "469", "474", "476", "478", "479", "480", "481", "482", "483", "484", "495", "496", "558", "560", "562", "587", "588", "590", "617", "663", "676", "680", "681", "685", "688", "689", "690", "704", "733", "761", "762", "763", "768", "781", "782", "783", "785", "786", "787", "788", "789", "805", "806", "822", "823", "824", "825", "828", "839", "843", "910", "911", "1325", "1335", "1341", "1429" ] }, "659": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='C++']", "id": "659", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses in Software Written in C++", "objective": "This view (slice) covers issues that are found in C++ programs that are not common to all languages.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "14", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "134", "135", "158", "170", "188", "191", "192", "194", "195", "196", "197", "242", "243", "244", "248", "362", "364", "366", "374", "375", "396", "397", "401", "415", "416", "457", "460", "462", "463", "464", "466", "467", "468", "469", "476", "478", "479", "480", "481", "482", "483", "484", "493", "495", "496", "498", "500", "543", "558", "562", "587", "588", "676", "680", "690", "704", "733", "762", "763", "766", "767", "781", "782", "783", "785", "786", "787", "788", "789", "805", "806", "822", "823", "824", "825", "839", "843", "910", "911", "1325", "1335", "1341", "1429" ] }, "660": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='Java']", "id": "660", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses in Software Written in Java", "objective": "This view (slice) covers issues that are found in Java programs that are not common to all languages.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "5", "6", "7", "8", "9", "95", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "191", "192", "197", "209", "245", "246", "248", "362", "366", "374", "375", "382", "383", "395", "396", "397", "460", "462", "470", "476", "478", "481", "484", "486", "487", "491", "492", "493", "495", "496", "498", "499", "500", "502", "536", "537", "543", "555", "567", "568", "572", "574", "575", "576", "577", "578", "579", "580", "581", "582", "583", "585", "586", "594", "595", "597", "600", "607", "608", "609", "617", "766", "767", "917", "1235", "1335", "1336", "1341" ] }, "661": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='PHP']", "id": "661", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses in Software Written in PHP", "objective": "This view (slice) covers issues that are found in PHP programs that are not common to all languages.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "88", "95", "96", "98", "209", "211", "434", "453", "454", "457", "470", "473", "474", "484", "502", "595", "597", "616", "621", "624", "625", "626", "627", "915", "1024", "1336" ] }, "677": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[@Abstraction='Base'][not(@Status='Deprecated')]", "id": "677", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weakness Base Elements", "objective": "This view (slice) displays only weakness base elements.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "15", "22", "23", "36", "41", "59", "66", "73", "76", "78", "79", "88", "89", "90", "91", "93", "94", "96", "112", "115", "117", "120", "123", "124", "125", "128", "130", "131", "134", "135", "140", "166", "167", "168", "170", "178", "179", "182", "183", "184", "186", "188", "190", "191", "193", "197", "201", "202", "203", "204", "205", "208", "209", "210", "211", "212", "213", "214", "215", "222", "223", "224", "226", "229", "233", "237", "240", "241", "242", "248", "250", "252", "253", "256", "257", "260", "261", "262", "263", "266", "267", "268", "270", "272", "273", "274", "276", "280", "281", "283", "288", "289", "290", "294", "295", "296", "299", "301", "302", "303", "304", "305", "306", "307", "308", "309", "312", "319", "322", "323", "324", "325", "328", "331", "334", "335", "338", "341", "342", "343", "344", "347", "348", "349", "351", "353", "354", "356", "357", "358", "359", "360", "363", "364", "366", "367", "368", "369", "372", "374", "375", "378", "379", "385", "386", "390", "391", "392", "393", "394", "395", "396", "397", "403", "408", "409", "412", "413", "414", "419", "420", "421", "425", "426", "427", "428", "430", "431", "432", "434", "437", "439", "440", "444", "447", "448", "449", "450", "454", "455", "459", "460", "463", "464", "466", "468", "469", "470", "471", "472", "474", "475", "476", "477", "478", "480", "483", "484", "487", "488", "489", "494", "497", "501", "502", "507", "508", "509", "510", "511", "512", "515", "521", "523", "524", "532", "538", "540", "544", "547", "549", "551", "552", "561", "562", "563", "565", "567", "570", "571", "584", "586", "601", "603", "606", "609", "611", "612", "613", "617", "619", "620", "624", "625", "628", "639", "640", "641", "643", "645", "648", "649", "652", "654", "663", "676", "681", "694", "695", "698", "708", "733", "749", "756", "757", "763", "764", "765", "766", "767", "770", "771", "772", "776", "778", "779", "783", "786", "787", "788", "791", "795", "798", "804", "805", "807", "820", "821", "822", "823", "824", "825", "826", "829", "832", "833", "835", "836", "837", "838", "839", "842", "843", "908", "910", "911", "914", "915", "916", "917", "918", "920", "921", "924", "939", "940", "941", "1007", "1021", "1024", "1025", "1037", "1041", "1043", "1044", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1053", "1054", "1055", "1056", "1057", "1058", "1060", "1062", "1063", "1064", "1065", "1066", "1067", "1068", "1070", "1071", "1072", "1073", "1074", "1075", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1088", "1089", "1090", "1091", "1092", "1094", "1095", "1097", "1098", "1099", "1100", "1101", "1102", "1103", "1104", "1105", "1106", "1107", "1108", "1109", "1110", "1111", "1112", "1113", "1114", "1115", "1116", "1117", "1118", "1119", "1121", "1122", "1123", "1124", "1125", "1126", "1127", "1173", "1188", "1189", "1190", "1191", "1192", "1193", "1204", "1209", "1220", "1221", "1223", "1224", "1230", "1231", "1232", "1233", "1234", "1235", "1236", "1240", "1241", "1242", "1243", "1244", "1245", "1246", "1247", "1248", "1249", "1250", "1251", "1252", "1253", "1254", "1256", "1257", "1258", "1259", "1260", "1261", "1262", "1264", "1265", "1266", "1267", "1268", "1269", "1270", "1271", "1272", "1273", "1274", "1276", "1277", "1278", "1279", "1280", "1281", "1282", "1283", "1284", "1285", "1286", "1287", "1288", "1289", "1290", "1291", "1292", "1293", "1295", "1296", "1297", "1298", "1299", "1300", "1301", "1302", "1303", "1304", "1310", "1311", "1312", "1313", "1314", "1315", "1316", "1317", "1318", "1319", "1320", "1322", "1323", "1325", "1326", "1327", "1328", "1329", "1331", "1332", "1333", "1334", "1335", "1336", "1338", "1339", "1341", "1342", "1351", "1386", "1389", "1392", "1393", "1394", "1420", "1421", "1422", "1423", "1426", "1427", "1428", "1429", "1431", "1434" ] }, "678": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[@Structure='Composite'][not(@Status='Deprecated')]", "id": "678", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Composites", "objective": "This view displays only composite weaknesses.", "status": "Draft", "type": "Implicit", "weakness_member_ids": [ "61", "352", "384", "689" ] }, "679": { "filter": "/Weakness_Catalog[false()]", "id": "679", "mapping": { "comments": "N/A", "rationale": "This CWE has been deprecated. It is also a View.", "reasons": [ "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "DEPRECATED: Chain Elements", "objective": "This view has been deprecated. It has limited utility for stakeholders, since all weaknesses can be links in a chain.", "status": "Deprecated", "type": "Implicit", "weakness_member_ids": [] }, "699": { "filter": "", "id": "699", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "1228", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1210", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1211", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1212", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1006", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "438", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "840", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "417", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1226", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "557", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "255", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "310", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "320", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1214", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "19", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "137", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1225", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1219", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1227", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "389", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "569", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "429", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "199", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "452", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1215", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1216", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1218", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "189", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "275", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "465", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "265", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1213", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "411", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "399", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "387", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "371", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "133", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "136", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "355", "kind": "Has_Member", "view_id": "699" }, { "cwe_id": "1217", "kind": "Has_Member", "view_id": "699" } ], "name": "Software Development", "objective": "This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.", "status": "Draft", "type": "Graph", "weakness_member_ids": [ "15", "22", "41", "59", "66", "73", "76", "78", "79", "88", "89", "90", "91", "93", "94", "112", "115", "117", "120", "124", "125", "128", "130", "131", "134", "135", "140", "166", "167", "168", "170", "178", "179", "182", "183", "184", "186", "190", "191", "193", "201", "204", "205", "208", "209", "212", "213", "214", "215", "222", "223", "224", "229", "233", "237", "241", "242", "243", "248", "250", "252", "253", "256", "257", "260", "261", "262", "263", "266", "267", "268", "270", "272", "273", "274", "276", "277", "278", "279", "280", "281", "283", "289", "290", "294", "295", "301", "303", "305", "306", "307", "308", "309", "312", "319", "322", "323", "324", "325", "328", "331", "334", "335", "338", "341", "342", "343", "344", "346", "347", "348", "349", "351", "353", "354", "356", "357", "358", "359", "360", "364", "366", "367", "368", "369", "372", "374", "375", "378", "379", "385", "386", "390", "391", "392", "393", "394", "395", "396", "397", "403", "408", "409", "410", "412", "413", "414", "419", "420", "421", "425", "426", "427", "428", "430", "431", "434", "437", "439", "440", "444", "447", "448", "449", "454", "455", "459", "463", "464", "466", "468", "469", "470", "472", "474", "475", "476", "477", "478", "480", "483", "484", "487", "488", "489", "494", "497", "501", "502", "515", "521", "523", "524", "538", "544", "547", "549", "551", "552", "561", "562", "563", "565", "570", "571", "580", "581", "584", "586", "587", "601", "603", "605", "606", "609", "611", "613", "617", "618", "619", "620", "624", "625", "628", "639", "640", "641", "645", "648", "649", "653", "654", "656", "663", "676", "681", "694", "695", "698", "708", "733", "749", "756", "763", "764", "765", "766", "767", "770", "771", "772", "776", "778", "779", "783", "786", "787", "788", "791", "798", "804", "805", "807", "820", "821", "822", "823", "824", "825", "826", "829", "832", "833", "835", "836", "837", "838", "839", "841", "842", "843", "908", "909", "910", "911", "914", "915", "916", "917", "918", "920", "921", "924", "939", "940", "941", "1007", "1021", "1024", "1025", "1037", "1041", "1043", "1044", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1053", "1054", "1055", "1056", "1057", "1058", "1060", "1062", "1063", "1064", "1065", "1066", "1067", "1068", "1070", "1071", "1072", "1073", "1074", "1075", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1089", "1090", "1092", "1094", "1095", "1097", "1098", "1099", "1100", "1101", "1102", "1103", "1104", "1105", "1106", "1107", "1108", "1109", "1110", "1111", "1112", "1113", "1114", "1115", "1116", "1117", "1118", "1119", "1121", "1122", "1123", "1124", "1125", "1126", "1127", "1173", "1188", "1204", "1220", "1230", "1235", "1236", "1240", "1241", "1265", "1284", "1285", "1286", "1287", "1288", "1289", "1322", "1327", "1333", "1335", "1339", "1341", "1389", "1392" ] }, "700": { "filter": "", "id": "700", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "254", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "361", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "388", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "1005", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "227", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "398", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "485", "kind": "Has_Member", "view_id": "700" }, { "cwe_id": "2", "kind": "Has_Member", "view_id": "700" } ], "name": "Seven Pernicious Kingdoms", "objective": "This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "5", "6", "7", "8", "9", "11", "12", "13", "14", "15", "20", "73", "77", "79", "89", "99", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "117", "119", "120", "134", "170", "190", "242", "243", "244", "245", "246", "248", "250", "252", "256", "258", "259", "260", "261", "272", "284", "285", "330", "359", "364", "367", "377", "382", "383", "384", "391", "395", "396", "397", "401", "404", "412", "415", "416", "457", "466", "470", "474", "475", "476", "477", "486", "488", "489", "491", "492", "493", "495", "496", "497", "501", "558", "785", "798" ] }, "701": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[(@Abstraction='Base') or (@Abstraction='Class')][./Modes_Of_Introduction/Introduction/Phase='Architecture and Design']", "id": "701", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses Introduced During Design", "objective": "This view (slice) lists weaknesses that can be introduced during design.", "status": "Incomplete", "type": "Implicit", "weakness_member_ids": [ "20", "73", "99", "115", "184", "200", "201", "202", "203", "204", "205", "208", "209", "210", "211", "212", "213", "214", "221", "223", "250", "256", "257", "260", "261", "262", "263", "267", "268", "269", "270", "271", "276", "282", "283", "285", "286", "287", "288", "289", "290", "294", "295", "300", "301", "302", "306", "307", "308", "309", "311", "312", "319", "322", "323", "324", "326", "327", "328", "330", "331", "334", "338", "340", "341", "342", "343", "344", "345", "346", "347", "348", "353", "354", "356", "357", "358", "359", "360", "362", "363", "368", "385", "386", "400", "402", "405", "406", "407", "408", "409", "410", "412", "413", "414", "419", "420", "421", "424", "434", "436", "437", "439", "440", "441", "446", "451", "454", "470", "471", "475", "494", "501", "502", "510", "511", "512", "521", "522", "523", "532", "544", "552", "565", "601", "602", "603", "610", "612", "613", "620", "636", "637", "639", "640", "641", "642", "645", "648", "649", "653", "654", "655", "656", "657", "662", "667", "668", "669", "671", "673", "694", "696", "706", "708", "732", "749", "757", "770", "798", "799", "804", "807", "862", "863", "912", "913", "915", "916", "917", "918", "920", "921", "922", "923", "924", "940", "941", "1007", "1037", "1038", "1039", "1044", "1047", "1048", "1053", "1059", "1060", "1067", "1072", "1073", "1076", "1088", "1092", "1093", "1101", "1103", "1104", "1110", "1125", "1173", "1176", "1189", "1190", "1191", "1192", "1193", "1209", "1220", "1223", "1224", "1229", "1230", "1231", "1232", "1233", "1234", "1240", "1241", "1242", "1243", "1244", "1245", "1246", "1249", "1250", "1251", "1252", "1253", "1254", "1256", "1257", "1258", "1259", "1260", "1261", "1262", "1263", "1264", "1266", "1267", "1268", "1270", "1272", "1274", "1277", "1278", "1279", "1281", "1283", "1290", "1292", "1293", "1294", "1298", "1299", "1302", "1303", "1304", "1310", "1311", "1312", "1313", "1314", "1315", "1316", "1317", "1318", "1319", "1320", "1323", "1326", "1328", "1329", "1331", "1332", "1334", "1336", "1338", "1342", "1351", "1357", "1384", "1390", "1391", "1392", "1393", "1394", "1395", "1420", "1421", "1422", "1423", "1426", "1427", "1428", "1429" ] }, "702": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[./Modes_Of_Introduction/Introduction/Phase='Implementation']", "id": "702", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses Introduced During Implementation", "objective": "This view (slice) lists weaknesses that can be introduced during implementation.", "status": "Incomplete", "type": "Implicit", "weakness_member_ids": [ "5", "6", "7", "8", "9", "11", "12", "13", "14", "15", "20", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "61", "62", "65", "66", "67", "69", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "90", "91", "93", "94", "95", "96", "97", "98", "99", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "115", "116", "117", "118", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "134", "135", "138", "140", "141", "142", "143", "144", "145", "146", "147", "148", "149", "150", "151", "152", "153", "154", "155", "156", "157", "158", "159", "160", "161", "162", "163", "164", "165", "166", "167", "168", "170", "172", "173", "174", "175", "176", "177", "178", "179", "180", "181", "182", "183", "184", "185", "186", "187", "188", "190", "191", "192", "193", "194", "195", "196", "197", "198", "200", "201", "202", "203", "204", "205", "206", "207", "208", "209", "210", "211", "212", "213", "214", "215", "219", "221", "222", "223", "224", "226", "228", "229", "230", "231", "232", "233", "234", "235", "236", "237", "238", "239", "240", "241", "242", "243", "244", "245", "246", "248", "250", "252", "253", "258", "259", "260", "266", "267", "268", "269", "270", "271", "272", "273", "274", "276", "277", "279", "280", "281", "284", "285", "286", "287", "289", "290", "295", "296", "297", "298", "299", "302", "303", "304", "305", "318", "325", "327", "329", "330", "331", "332", "333", "334", "335", "336", "337", "338", "339", "340", "341", "342", "343", "344", "345", "346", "347", "348", "349", "351", "353", "354", "356", "357", "358", "359", "360", "362", "363", "364", "366", "367", "368", "369", "370", "372", "374", "375", "377", "378", "379", "382", "383", "384", "385", "386", "390", "391", "392", "393", "394", "395", "396", "397", "400", "401", "402", "403", "404", "405", "406", "407", "408", "409", "410", "412", "413", "414", "415", "416", "419", "420", "425", "426", "427", "428", "430", "431", "432", "433", "434", "435", "436", "437", "439", "440", "444", "446", "447", "448", "449", "450", "451", "453", "454", "455", "456", "457", "459", "460", "462", "463", "464", "466", "467", "468", "469", "470", "471", "472", "473", "474", "475", "476", "477", "478", "479", "480", "481", "482", "483", "484", "486", "487", "488", "489", "491", "492", "493", "494", "495", "496", "497", "498", "499", "500", "502", "506", "507", "508", "509", "510", "511", "512", "514", "515", "520", "521", "522", "524", "525", "526", "532", "535", "536", "537", "538", "539", "540", "541", "543", "546", "547", "548", "549", "550", "551", "552", "553", "554", "555", "556", "558", "560", "561", "562", "563", "564", "565", "566", "567", "568", "570", "571", "572", "573", "574", "575", "576", "577", "578", "579", "580", "581", "582", "583", "584", "585", "586", "587", "588", "589", "590", "591", "593", "594", "595", "597", "598", "599", "600", "601", "603", "605", "606", "607", "608", "609", "611", "612", "613", "614", "615", "616", "617", "618", "619", "620", "621", "622", "623", "624", "625", "626", "627", "628", "636", "637", "638", "640", "641", "642", "643", "644", "646", "647", "648", "649", "650", "651", "652", "653", "654", "656", "662", "663", "664", "665", "666", "667", "668", "669", "670", "671", "672", "673", "674", "675", "676", "680", "681", "682", "683", "684", "685", "686", "687", "688", "689", "690", "691", "692", "693", "694", "695", "696", "697", "698", "703", "704", "705", "706", "707", "708", "710", "732", "749", "754", "755", "758", "759", "760", "761", "762", "763", "764", "765", "766", "767", "768", "770", "771", "772", "773", "774", "775", "776", "777", "780", "781", "782", "783", "784", "785", "786", "787", "788", "789", "790", "791", "792", "793", "794", "795", "796", "797", "799", "804", "805", "806", "807", "820", "821", "822", "823", "824", "825", "826", "827", "828", "829", "830", "831", "832", "833", "834", "835", "836", "837", "838", "839", "841", "842", "843", "862", "863", "908", "909", "910", "911", "912", "913", "914", "915", "917", "918", "922", "939", "940", "941", "942", "943", "1004", "1007", "1021", "1022", "1023", "1024", "1025", "1039", "1041", "1042", "1043", "1045", "1046", "1047", "1048", "1049", "1050", "1051", "1052", "1054", "1055", "1056", "1057", "1058", "1060", "1061", "1062", "1063", "1064", "1065", "1066", "1067", "1068", "1069", "1070", "1071", "1072", "1074", "1075", "1076", "1077", "1078", "1079", "1080", "1082", "1083", "1084", "1085", "1086", "1087", "1089", "1090", "1091", "1093", "1094", "1095", "1096", "1097", "1098", "1099", "1100", "1102", "1105", "1106", "1107", "1108", "1109", "1113", "1114", "1115", "1116", "1117", "1119", "1120", "1121", "1122", "1123", "1124", "1125", "1126", "1164", "1173", "1174", "1176", "1177", "1188", "1189", "1191", "1192", "1204", "1209", "1220", "1221", "1224", "1229", "1231", "1232", "1233", "1234", "1235", "1236", "1239", "1240", "1241", "1242", "1243", "1244", "1245", "1246", "1249", "1250", "1253", "1254", "1255", "1256", "1257", "1258", "1259", "1260", "1261", "1262", "1264", "1265", "1266", "1267", "1268", "1269", "1270", "1271", "1275", "1276", "1277", "1279", "1280", "1281", "1282", "1283", "1284", "1285", "1286", "1287", "1288", "1289", "1290", "1291", "1292", "1293", "1294", "1295", "1296", "1297", "1298", "1299", "1300", "1301", "1302", "1303", "1310", "1311", "1312", "1313", "1314", "1315", "1316", "1317", "1318", "1319", "1320", "1321", "1322", "1323", "1325", "1326", "1328", "1329", "1330", "1331", "1332", "1333", "1334", "1335", "1336", "1338", "1339", "1341", "1351", "1385", "1386", "1389", "1390", "1395", "1419", "1420", "1421", "1423", "1426", "1427", "1428", "1429", "1431" ] }, "709": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[@Structure='Chain']", "id": "709", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Named Chains", "objective": "This view displays Named Chains and their components.", "status": "Incomplete", "type": "Implicit", "weakness_member_ids": [ "184", "190", "252", "680", "690", "692" ] }, "711": { "filter": "", "id": "711", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "722", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "723", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "724", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "725", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "726", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "727", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "728", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "729", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "730", "kind": "Has_Member", "view_id": "711" }, { "cwe_id": "731", "kind": "Has_Member", "view_id": "711" } ], "name": "Weaknesses in OWASP Top Ten (2004)", "objective": "CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top Ten is available.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "5", "6", "7", "8", "9", "11", "12", "13", "14", "20", "22", "41", "73", "74", "77", "78", "79", "89", "91", "95", "98", "102", "103", "104", "106", "109", "117", "119", "120", "134", "166", "167", "170", "179", "180", "181", "182", "183", "203", "209", "215", "219", "226", "228", "248", "252", "259", "261", "266", "268", "283", "284", "285", "287", "295", "296", "298", "302", "304", "307", "309", "311", "321", "326", "327", "330", "345", "369", "382", "384", "390", "391", "394", "400", "401", "404", "405", "410", "412", "425", "459", "472", "476", "489", "520", "521", "522", "525", "526", "527", "528", "529", "530", "531", "532", "539", "540", "541", "548", "551", "552", "554", "555", "556", "591", "598", "601", "602", "613", "620", "636", "639", "640", "644", "674", "708", "798" ] }, "734": { "filter": "", "id": "734", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "735", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "736", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "737", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "738", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "739", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "740", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "741", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "742", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "743", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "744", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "745", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "746", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "747", "kind": "Has_Member", "view_id": "734" }, { "cwe_id": "748", "kind": "Has_Member", "view_id": "734" } ], "name": "Weaknesses Addressed by the CERT C Secure Coding Standard (2008)", "objective": "CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book \"The CERT C Secure Coding Standard\" published in 2008. This view is considered obsolete, as a newer version of the coding standard is available. This view statically represents the coding rules as they were in 2008.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "14", "20", "22", "37", "38", "39", "41", "59", "62", "64", "65", "67", "78", "88", "119", "120", "128", "129", "131", "134", "135", "170", "176", "190", "192", "193", "197", "226", "241", "242", "244", "252", "272", "273", "276", "279", "330", "362", "363", "366", "367", "369", "379", "391", "403", "404", "415", "416", "426", "462", "464", "466", "467", "468", "469", "476", "479", "480", "482", "528", "544", "547", "552", "561", "562", "563", "570", "571", "587", "590", "591", "606", "628", "662", "665", "667", "675", "676", "681", "682", "684", "686", "687", "696", "697", "704", "705", "732", "754", "783", "805" ] }, "750": { "filter": "", "id": "750", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "751", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "752", "kind": "Has_Member", "view_id": "750" }, { "cwe_id": "753", "kind": "Has_Member", "view_id": "750" } ], "name": "Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors", "objective": "CWE entries in this view (graph) are listed in the 2009 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "20", "73", "78", "79", "89", "94", "116", "119", "209", "250", "259", "285", "319", "327", "330", "352", "362", "404", "426", "494", "602", "642", "665", "682", "732", "798" ] }, "800": { "filter": "", "id": "800", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "808", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "803", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "802", "kind": "Has_Member", "view_id": "800" }, { "cwe_id": "801", "kind": "Has_Member", "view_id": "800" } ], "name": "Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors", "objective": "CWE entries in this view (graph) are listed in the 2010 CWE/SANS Top 25 Programming Errors. This view is considered obsolete as a newer version of the Top 25 is available.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "22", "59", "78", "79", "89", "98", "120", "129", "131", "134", "190", "209", "212", "285", "306", "307", "311", "327", "330", "352", "362", "416", "426", "434", "454", "456", "476", "494", "601", "672", "681", "732", "749", "754", "770", "772", "798", "799", "804", "805", "807" ] }, "809": { "filter": "", "id": "809", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "810", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "811", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "812", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "813", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "814", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "815", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "816", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "817", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "818", "kind": "Has_Member", "view_id": "809" }, { "cwe_id": "819", "kind": "Has_Member", "view_id": "809" } ], "name": "Weaknesses in OWASP Top Ten (2010)", "objective": "CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2010. This view is considered obsolete as a newer version of the OWASP Top Ten is available.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "22", "78", "79", "88", "89", "90", "91", "99", "209", "219", "250", "285", "287", "306", "307", "311", "312", "319", "326", "327", "352", "434", "538", "552", "601", "639", "732", "759", "798", "829", "862", "863" ] }, "844": { "filter": "", "id": "844", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "845", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "846", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "847", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "848", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "849", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "850", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "851", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "852", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "853", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "854", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "855", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "856", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "857", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "858", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "859", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "860", "kind": "Has_Member", "view_id": "844" }, { "cwe_id": "861", "kind": "Has_Member", "view_id": "844" } ], "name": "Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011)", "objective": "CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book \"The CERT Oracle Secure Coding Standard for Java\" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "67", "78", "111", "116", "134", "135", "144", "150", "180", "182", "197", "198", "209", "230", "232", "248", "250", "252", "259", "266", "272", "276", "279", "289", "300", "302", "311", "319", "330", "332", "333", "336", "337", "347", "349", "359", "362", "366", "369", "374", "375", "377", "382", "390", "392", "395", "397", "400", "401", "404", "405", "409", "410", "412", "413", "459", "460", "470", "479", "486", "487", "491", "492", "493", "494", "497", "498", "499", "500", "502", "532", "543", "567", "568", "572", "573", "581", "582", "583", "584", "586", "589", "595", "597", "600", "609", "617", "625", "647", "662", "665", "667", "681", "690", "703", "705", "732", "766", "770", "798", "807", "820", "833", "838" ] }, "868": { "filter": "", "id": "868", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "869", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "870", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "871", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "872", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "873", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "874", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "875", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "876", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "877", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "878", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "879", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "880", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "881", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "882", "kind": "Has_Member", "view_id": "868" }, { "cwe_id": "883", "kind": "Has_Member", "view_id": "868" } ], "name": "Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)", "objective": "CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "14", "20", "22", "37", "38", "39", "41", "59", "62", "64", "65", "67", "73", "78", "88", "116", "119", "120", "128", "129", "131", "134", "170", "176", "190", "192", "193", "197", "209", "226", "241", "244", "252", "276", "279", "327", "330", "362", "366", "367", "369", "379", "390", "391", "403", "404", "415", "416", "426", "460", "462", "464", "466", "467", "469", "476", "479", "480", "482", "488", "497", "528", "544", "552", "561", "563", "570", "571", "587", "590", "591", "606", "662", "665", "675", "676", "681", "682", "686", "687", "690", "697", "703", "704", "705", "732", "754", "755", "762", "768", "770", "772", "805", "807", "822" ] }, "884": { "filter": "", "id": "884", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "14", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "22", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "23", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "36", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "41", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "59", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "78", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "79", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "88", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "89", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "90", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "94", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "95", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "96", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "99", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "113", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "117", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "120", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "129", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "131", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "134", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "135", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "170", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "173", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "174", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "175", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "179", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "185", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "190", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "191", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "193", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "203", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "209", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "212", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "222", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "223", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "228", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "244", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "248", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "250", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "252", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "253", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "262", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "263", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "266", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "267", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "268", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "270", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "271", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "273", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "283", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "290", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "294", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "296", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "299", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "300", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "301", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "304", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "306", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "307", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "308", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "312", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "319", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "322", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "323", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "325", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "327", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "331", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "334", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "335", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "338", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "341", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "347", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "348", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "349", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "352", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "353", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "354", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "364", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "367", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "369", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "390", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "392", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "393", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "400", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "406", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "407", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "408", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "409", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "434", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "444", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "451", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "453", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "454", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "455", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "456", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "467", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "468", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "469", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "470", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "476", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "478", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "480", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "483", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "484", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "486", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "494", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "495", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "496", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "498", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "499", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "502", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "521", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "522", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "546", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "547", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "561", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "563", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "567", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "587", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "595", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "601", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "602", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "605", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "617", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "621", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "627", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "628", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "642", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "648", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "667", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "672", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "674", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "676", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "681", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "698", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "708", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "732", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "756", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "763", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "770", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "772", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "783", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "786", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "788", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "798", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "805", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "807", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "822", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "825", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "829", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "835", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "838", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "839", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "841", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "862", "kind": "Has_Member", "view_id": "884" }, { "cwe_id": "863", "kind": "Has_Member", "view_id": "884" } ], "name": "CWE Cross-section", "objective": "This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.", "status": "Incomplete", "type": "Explicit", "weakness_member_ids": [ "14", "22", "23", "36", "41", "59", "78", "79", "88", "89", "90", "94", "95", "96", "99", "113", "117", "120", "129", "131", "134", "135", "170", "173", "174", "175", "179", "185", "190", "191", "193", "203", "209", "212", "222", "223", "228", "244", "248", "250", "252", "253", "262", "263", "266", "267", "268", "270", "271", "273", "283", "290", "294", "296", "299", "300", "301", "304", "306", "307", "308", "312", "319", "322", "323", "325", "327", "331", "334", "335", "338", "341", "347", "348", "349", "352", "353", "354", "364", "367", "369", "390", "392", "393", "400", "406", "407", "408", "409", "434", "444", "451", "453", "454", "455", "456", "467", "468", "469", "470", "476", "478", "480", "483", "484", "486", "494", "495", "496", "498", "499", "502", "521", "522", "546", "547", "561", "563", "567", "587", "595", "601", "602", "605", "617", "621", "627", "628", "642", "648", "667", "672", "674", "676", "681", "698", "708", "732", "756", "763", "770", "772", "783", "786", "788", "798", "805", "807", "822", "825", "829", "835", "838", "839", "841", "862", "863" ] }, "888": { "filter": "", "id": "888", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "885", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "886", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "887", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "889", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "890", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "891", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "892", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "893", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "894", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "895", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "896", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "897", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "898", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "899", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "901", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "902", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "903", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "904", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "905", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "906", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "907", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "1237", "kind": "Has_Member", "view_id": "888" }, { "cwe_id": "1238", "kind": "Has_Member", "view_id": "888" } ], "name": "Software Fault Pattern (SFP) Clusters", "objective": "CWE identifiers in this view are associated with clusters of Software Fault Patterns (SFPs).", "status": "Incomplete", "type": "Graph", "weakness_member_ids": [ "5", "6", "7", "8", "9", "11", "12", "13", "14", "15", "20", "22", "23", "24", "25", "26", "27", "28", "29", "30", "31", "32", "33", "34", "35", "36", "37", "38", "39", "40", "41", "42", "43", "44", "45", "46", "47", "48", "49", "50", "51", "52", "53", "54", "55", "56", "57", "58", "59", "62", "64", "65", "66", "67", "69", "72", "73", "74", "75", "76", "77", "78", "79", "80", "81", "82", "83", "84", "85", "86", "87", "88", "89", "90", "91", "93", "94", "95", "96", "97", "99", "102", "103", "104", "105", "106", "107", "108", "109", "110", "111", "112", "113", "114", "115", "116", "117", "118", "119", "120", "121", "122", "123", "124", "125", "126", "127", "128", "129", "130", "131", "134", "135", "138", "140", "141", "142", "143", "144", "145", "146", "147", "148", "149", "150", "151", "152", "153", "154", "155", "156", "157", "158", "159", "160", "161", "162", "163", "164", "165", "166", "167", "168", "170", "172", "173", "174", "175", "176", "177", "178", "179", "180", "181", "182", "183", "184", "185", "186", "187", "188", "190", "191", "193", "194", "195", "196", "197", "198", "200", "201", "202", "203", "204", "205", "206", "207", "208", "209", "210", "211", "212", "213", "214", "215", "219", "220", "221", "222", "223", "224", "226", "228", "229", "230", "231", "232", "233", "234", "235", "236", "237", "238", "239", "240", "241", "242", "243", "244", "245", "246", "248", "250", "252", "253", "256", "257", "258", "259", "260", "261", "262", "263", "266", "267", "268", "269", "270", "271", "272", "273", "274", "276", "277", "278", "279", "280", "281", "282", "283", "284", "285", "286", "287", "288", "289", "290", "293", "294", "296", "297", "298", "299", "300", "301", "302", "303", "304", "305", "306", "307", "308", "309", "311", "312", "313", "314", "315", "316", "317", "318", "319", "321", "322", "323", "324", "325", "326", "327", "328", "329", "330", "331", "332", "333", "334", "335", "336", "337", "338", "339", "340", "341", "342", "343", "344", "345", "346", "347", "348", "349", "350", "351", "353", "354", "356", "357", "358", "359", "360", "362", "363", "364", "366", "367", "368", "369", "370", "372", "374", "375", "377", "378", "379", "382", "383", "385", "386", "390", "391", "392", "393", "394", "395", "396", "397", "400", "401", "402", "403", "404", "405", "406", "407", "408", "409", "410", "412", "413", "414", "415", "416", "419", "420", "421", "422", "424", "425", "427", "428", "430", "431", "432", "433", "435", "436", "437", "439", "440", "441", "444", "446", "447", "448", "449", "450", "451", "453", "454", "455", "456", "457", "459", "460", "462", "463", "464", "466", "467", "468", "469", "470", "471", "472", "473", "474", "475", "476", "477", "478", "479", "480", "481", "482", "483", "484", "486", "487", "488", "489", "491", "492", "493", "494", "495", "496", "497", "498", "499", "500", "501", "502", "506", "507", "508", "509", "510", "511", "512", "514", "515", "520", "521", "522", "523", "524", "525", "526", "527", "528", "529", "530", "531", "532", "535", "536", "537", "538", "539", "540", "541", "543", "544", "546", "547", "548", "549", "550", "551", "552", "553", "554", "555", "556", "558", "560", "561", "562", "563", "564", "565", "566", "567", "568", "570", "571", "572", "573", "574", "575", "576", "577", "578", "579", "580", "581", "582", "583", "584", "585", "586", "587", "588", "589", "590", "591", "593", "594", "595", "597", "598", "599", "600", "601", "602", "603", "605", "606", "607", "608", "609", "610", "611", "612", "613", "614", "615", "616", "617", "618", "619", "620", "621", "622", "623", "624", "625", "626", "627", "628", "636", "637", "638", "639", "640", "641", "642", "643", "644", "645", "646", "647", "648", "649", "650", "651", "652", "653", "654", "655", "656", "657", "662", "663", "664", "665", "666", "667", "668", "669", "670", "671", "672", "673", "674", "675", "676", "681", "682", "683", "684", "685", "686", "687", "688", "691", "693", "694", "695", "696", "697", "698", "703", "704", "705", "706", "707", "708", "710", "732", "733", "749", "754", "755", "756", "757", "758", "759", "760", "761", "762", "763", "764", "765", "766", "767", "768", "770", "771", "772", "773", "774", "775", "785" ] }, "900": { "filter": "", "id": "900", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "867", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "866", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "865", "kind": "Has_Member", "view_id": "900" }, { "cwe_id": "864", "kind": "Has_Member", "view_id": "900" } ], "name": "Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors", "objective": "CWE entries in this view (graph) are listed in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "22", "78", "79", "89", "120", "129", "131", "134", "190", "209", "212", "250", "306", "307", "311", "327", "330", "352", "362", "434", "456", "476", "494", "601", "676", "681", "732", "754", "759", "770", "772", "798", "805", "807", "822", "825", "829", "838", "841", "862", "863" ] }, "919": { "filter": "/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Technology/@Class='Mobile']", "id": "919", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "Weaknesses in Mobile Applications", "objective": "CWE entries in this view (slice) are often seen in mobile applications.", "status": "Incomplete", "type": "Implicit", "weakness_member_ids": [ "200", "250", "295", "297", "312", "319", "359", "362", "511", "602", "672", "772", "798", "920", "921", "925", "926", "927", "939", "940", "941" ] }, "928": { "filter": "", "id": "928", "mapping": { "comments": "Use this View or other Views to search and navigate for the appropriate weakness.", "rationale": "This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.", "reasons": [ "View" ], "suggestions": [], "usage": "Prohibited" }, "members": [ { "cwe_id": "929", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "930", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "931", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "932", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "933", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "934", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "935", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "936", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "937", "kind": "Has_Member", "view_id": "928" }, { "cwe_id": "938", "kind": "Has_Member", "view_id": "928" } ], "name": "Weaknesses in OWASP Top Ten (2013)", "objective": "CWE nodes in this view (graph) are associated with the OWASP Top Ten, as released in 2013. This view is considered obsolete as a newer version of the OWASP Top Ten is available.", "status": "Obsolete", "type": "Graph", "weakness_member_ids": [ "22", "74", "77", "78", "79", "88", "89", "90", "91", "99", "209", "215", "256", "285", "287", "311", "312", "319", "325", "326", "327", "328", "352", "384", "522", "523", "548", "564", "601", "613", "620", "639", "640", "643", "652", "706" ] }, "999": { "filter": "/Weakness_Catalog[false()]", "id": "999", "mapping": { "comments": "N/A", "rationale": "This CWE has been deprecated. It is also a View.", "reasons": [ "Deprecated" ], "suggestions": [], "usage": "Prohibited" }, "members": [], "name": "DEPRECATED: Weaknesses without Software Fault Patterns", "objective": "This view has been deprecated. It was based on gaps in another view (CWE-888) related to research that is no longer updated, but was complete with respect to CWE at the time it was conducted.", "status": "Deprecated", "type": "Implicit", "weakness_member_ids": [] } } } ``` ## references/cwe-catalog-summary.md # CWE Catalog Summary Generated by `scripts/build_cwe_references.py` from the local CWE catalog and XSD supplied to the skill. ## Source - Catalog: CWE 4.20 dated 2026-04-30 - Catalog namespace: `http://cwe.mitre.org/cwe-7` - Schema: Core Definition 7.3 dated December 11, 2025 - Counts: 969 weaknesses, 422 categories, 59 views ## How To Use This Corpus - Start with code evidence and a trust-boundary failure, then use the corpus to refine the root-cause weakness. - Prefer weaknesses with mapping usage `Allowed` or `Allowed-with-Review`; treat `Discouraged` and `Prohibited` entries as navigation aids unless the mapping notes justify an exception. - Prefer the most precise supported weakness over a broad Pillar, Class, Category, or View. Categories and Views organize the corpus and are not root-cause mappings. - Use view membership as coverage or prioritization context, not as a severity rating. - Use `scripts/cwe_lookup.py` for detail retrieval. Use `references/cwe-weakness-index.md` for fast grep-based browsing. ## Catalog Shape | Dimension | Values | | --- | --- | | Abstraction | Base: 539, Class: 114, Compound: 7, Pillar: 10, Variant: 299 | | Structure | Chain: 3, Composite: 4, Simple: 962 | | Status | Deprecated: 25, Draft: 432, Incomplete: 486, Stable: 26 | | Mapping usage | Allowed: 749, Allowed-with-Review: 93, Discouraged: 44, Prohibited: 83 | ## Review-Oriented Views | View | Type | Status | Weakness Members | Use | | --- | --- | --- | ---: | --- | | CWE-699 Software Development | Graph | Draft | 399 | Primary software-development browsing view. Use it to scope common review surfaces by development concept. | | CWE-1000 Research Concepts | Graph | Draft | 944 | Research graph. Use it to move between broad parents and precise child weaknesses while tracing root cause. | | CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities | Graph | Incomplete | 130 | Simplified vulnerability-mapping graph. Use it when a finding needs a practical mapping candidate before refining it. | | CWE-1435 Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses | Graph | Draft | 25 | 2025 CWE Top 25 view from this catalog release. Use it as prioritization context, never as proof of severity. | | CWE-1344 Weaknesses in OWASP Top Ten (2021) | Graph | Incomplete | 182 | OWASP Top Ten 2021 view. Use it when a review or report must align findings with the OWASP 2021 grouping. | | CWE-1450 Weaknesses in OWASP Top Ten RC1 (2025) | Graph | Incomplete | 246 | OWASP Top Ten 2025 RC1 view. Use it only when the RC1 taxonomy is specifically relevant. | | CWE-1448 Weaknesses Related to AI/ML Products | Graph | Incomplete | 17 | AI/ML product view. Use it when model inputs, training, inference, or agentic behavior are in scope. | | CWE-658 Weaknesses in Software Written in C | Implicit | Draft | 103 | Implicit C-language view. | | CWE-659 Weaknesses in Software Written in C++ | Implicit | Draft | 97 | Implicit C++-language view. | | CWE-660 Weaknesses in Software Written in Java | Implicit | Draft | 84 | Implicit Java-language view. | | CWE-661 Weaknesses in Software Written in PHP | Implicit | Draft | 26 | Implicit PHP-language view. | | CWE-701 Weaknesses Introduced During Design | Implicit | Incomplete | 297 | Implicit design-introduction view. | | CWE-702 Weaknesses Introduced During Implementation | Implicit | Incomplete | 835 | Implicit implementation-introduction view. | | CWE-919 Weaknesses in Mobile Applications | Implicit | Incomplete | 21 | Implicit mobile-application view. | ## Generated Files - `cwe-weakness-index.md`: compact, line-oriented index of every weakness for grep and quick scanning. - `cwe-review-views.md`: review-oriented view descriptions, filters, and member lists. - `cwe-schema-guide.md`: XSD-derived field semantics and enumeration vocabulary. - `cwe-records.jsonl`: machine-readable record per weakness with mapping notes, relationships, detection methods, mitigations, and examples. - `cwe-catalog-metadata.json`: machine-readable catalog, schema, category, and view metadata. ## references/cwe-records.jsonl ``` ``` ## references/cwe-review-views.md # CWE Review Views Use these views to scope coverage and navigate the catalog. A view is not itself a finding or a root-cause mapping. ## Contents - [CWE-699 Software Development](#cwe-699) - [CWE-1000 Research Concepts](#cwe-1000) - [CWE-1003 Weaknesses for Simplified Mapping of Published Vulnerabilities](#cwe-1003) - [CWE-1435 Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses](#cwe-1435) - [CWE-1344 Weaknesses in OWASP Top Ten (2021)](#cwe-1344) - [CWE-1450 Weaknesses in OWASP Top Ten RC1 (2025)](#cwe-1450) - [CWE-1448 Weaknesses Related to AI/ML Products](#cwe-1448) - [CWE-658 Weaknesses in Software Written in C](#cwe-658) - [CWE-659 Weaknesses in Software Written in C++](#cwe-659) - [CWE-660 Weaknesses in Software Written in Java](#cwe-660) - [CWE-661 Weaknesses in Software Written in PHP](#cwe-661) - [CWE-701 Weaknesses Introduced During Design](#cwe-701) - [CWE-702 Weaknesses Introduced During Implementation](#cwe-702) - [CWE-919 Weaknesses in Mobile Applications](#cwe-919) ## CWE-699 **Software Development** - Type: Graph - Status: Draft - Weakness members: 399 - Review use: Primary software-development browsing view. Use it to scope common review surfaces by development concept. This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping. Direct members: - CWE-1228 API / Function Errors [Category] - CWE-1210 Audit / Logging Errors [Category] - CWE-1211 Authentication Errors [Category] - CWE-1212 Authorization Errors [Category] - CWE-1006 Bad Coding Practices [Category] - CWE-438 Behavioral Problems [Category] - CWE-840 Business Logic Errors [Category] - CWE-417 Communication Channel Errors [Category] - CWE-1226 Complexity Issues [Category] - CWE-557 Concurrency Issues [Category] - CWE-255 Credentials Management Errors [Category] - CWE-310 Cryptographic Issues [Category] - CWE-320 Key Management Errors [Category] - CWE-1214 Data Integrity Issues [Category] - CWE-19 Data Processing Errors [Category] - CWE-137 Data Neutralization Issues [Category] - CWE-1225 Documentation Issues [Category] - CWE-1219 File Handling Issues [Category] - CWE-1227 Encapsulation Issues [Category] - CWE-389 Error Conditions, Return Values, Status Codes [Category] - CWE-569 Expression Issues [Category] - CWE-429 Handler Errors [Category] - CWE-199 Information Management Errors [Category] - CWE-452 Initialization and Cleanup Errors [Category] - CWE-1215 Data Validation Issues [Category] - CWE-1216 Lockout Mechanism Errors [Category] - CWE-1218 Memory Buffer Errors [Category] - CWE-189 Numeric Errors [Category] - CWE-275 Permission Issues [Category] - CWE-465 Pointer Issues [Category] - CWE-265 Privilege Issues [Category] - CWE-1213 Random Number Issues [Category] - CWE-411 Resource Locking Problems [Category] - CWE-399 Resource Management Errors [Category] - CWE-387 Signal Errors [Category] - CWE-371 State Issues [Category] - CWE-133 String Errors [Category] - CWE-136 Type Errors [Category] - CWE-355 User Interface Security Issues [Category] - CWE-1217 User Session Errors [Category] Sample weakness members (20 of 399): - CWE-15 External Control of System or Configuration Setting - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CWE-41 Improper Resolution of Path Equivalence - CWE-59 Improper Link Resolution Before File Access ('Link Following') - CWE-66 Improper Handling of File Names that Identify Virtual Resources - CWE-73 External Control of File Name or Path - CWE-76 Improper Neutralization of Equivalent Special Elements - CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') - CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') - CWE-91 XML Injection (aka Blind XPath Injection) - CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection') - CWE-94 Improper Control of Generation of Code ('Code Injection') - CWE-112 Missing XML Validation - CWE-115 Misinterpretation of Input - CWE-117 Improper Output Neutralization for Logs - CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') - CWE-124 Buffer Underwrite ('Buffer Underflow') ## CWE-1000 **Research Concepts** - Type: Graph - Status: Draft - Weakness members: 944 - Review use: Research graph. Use it to move between broad parents and precise child weaknesses while tracing root cause. This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It is mainly organized according to abstractions of behaviors instead of how they can be detected, where they appear in code, or when they are introduced in the development life cycle. By design, this view is expected to include every weakness within CWE. Direct members: - CWE-284 Improper Access Control [Weakness] - CWE-435 Improper Interaction Between Multiple Correctly-Behaving Entities [Weakness] - CWE-664 Improper Control of a Resource Through its Lifetime [Weakness] - CWE-682 Incorrect Calculation [Weakness] - CWE-691 Insufficient Control Flow Management [Weakness] - CWE-693 Protection Mechanism Failure [Weakness] - CWE-697 Incorrect Comparison [Weakness] - CWE-703 Improper Check or Handling of Exceptional Conditions [Weakness] - CWE-707 Improper Neutralization [Weakness] - CWE-710 Improper Adherence to Coding Standards [Weakness] Sample weakness members (20 of 944): - CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption - CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length - CWE-7 J2EE Misconfiguration: Missing Custom Error Page - CWE-8 J2EE Misconfiguration: Entity Bean Declared Remote - CWE-9 J2EE Misconfiguration: Weak Access Permissions for EJB Methods - CWE-11 ASP.NET Misconfiguration: Creating Debug Binary - CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page - CWE-13 ASP.NET Misconfiguration: Password in Configuration File - CWE-14 Compiler Removal of Code to Clear Buffers - CWE-15 External Control of System or Configuration Setting - CWE-20 Improper Input Validation - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CWE-23 Relative Path Traversal - CWE-24 Path Traversal: '../filedir' - CWE-25 Path Traversal: '/../filedir' - CWE-26 Path Traversal: '/dir/../filename' - CWE-27 Path Traversal: 'dir/../../filename' - CWE-28 Path Traversal: '..\filedir' - CWE-29 Path Traversal: '\..\filename' - CWE-30 Path Traversal: '\dir\..\filename' ## CWE-1003 **Weaknesses for Simplified Mapping of Published Vulnerabilities** - Type: Graph - Status: Incomplete - Weakness members: 130 - Review use: Simplified vulnerability-mapping graph. Use it when a finding needs a practical mapping candidate before refining it. CWE entries in this view (graph) may be used to categorize potential weaknesses within sources that handle public, third-party vulnerability information, such as the National Vulnerability Database (NVD). By design, this view is incomplete. It is limited to a small number of the most commonly-seen weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two levels in order to simplify the complex navigation of the entire CWE corpus. Direct members: - CWE-20 Improper Input Validation [Weakness] - CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') [Weakness] - CWE-116 Improper Encoding or Escaping of Output [Weakness] - CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer [Weakness] - CWE-200 Exposure of Sensitive Information to an Unauthorized Actor [Weakness] - CWE-269 Improper Privilege Management [Weakness] - CWE-287 Improper Authentication [Weakness] - CWE-311 Missing Encryption of Sensitive Data [Weakness] - CWE-326 Inadequate Encryption Strength [Weakness] - CWE-327 Use of a Broken or Risky Cryptographic Algorithm [Weakness] - CWE-330 Use of Insufficiently Random Values [Weakness] - CWE-345 Insufficient Verification of Data Authenticity [Weakness] - CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') [Weakness] - CWE-400 Uncontrolled Resource Consumption [Weakness] - CWE-404 Improper Resource Shutdown or Release [Weakness] - CWE-407 Inefficient Algorithmic Complexity [Weakness] - CWE-436 Interpretation Conflict [Weakness] - CWE-610 Externally Controlled Reference to a Resource in Another Sphere [Weakness] - CWE-662 Improper Synchronization [Weakness] - CWE-665 Improper Initialization [Weakness] - CWE-668 Exposure of Resource to Wrong Sphere [Weakness] - CWE-669 Incorrect Resource Transfer Between Spheres [Weakness] - CWE-670 Always-Incorrect Control Flow Implementation [Weakness] - CWE-672 Operation on a Resource after Expiration or Release [Weakness] - CWE-674 Uncontrolled Recursion [Weakness] - CWE-682 Incorrect Calculation [Weakness] - CWE-697 Incorrect Comparison [Weakness] - CWE-704 Incorrect Type Conversion or Cast [Weakness] - CWE-706 Use of Incorrectly-Resolved Name or Reference [Weakness] - CWE-732 Incorrect Permission Assignment for Critical Resource [Weakness] - CWE-754 Improper Check for Unusual or Exceptional Conditions [Weakness] - CWE-755 Improper Handling of Exceptional Conditions [Weakness] - CWE-834 Excessive Iteration [Weakness] - CWE-862 Missing Authorization [Weakness] - CWE-863 Incorrect Authorization [Weakness] - CWE-913 Improper Control of Dynamically-Managed Code Resources [Weakness] - CWE-922 Insecure Storage of Sensitive Information [Weakness] Weakness members: - CWE-20 Improper Input Validation (Class; mapping Discouraged) - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (Base; mapping Allowed-with-Review) - CWE-59 Improper Link Resolution Before File Access ('Link Following') (Base; mapping Allowed) - CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') (Class; mapping Discouraged) - CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') (Class; mapping Allowed-with-Review) - CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (Base; mapping Allowed) - CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (Base; mapping Allowed) - CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (Base; mapping Allowed) - CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (Base; mapping Allowed) - CWE-91 XML Injection (aka Blind XPath Injection) (Base; mapping Allowed-with-Review) - CWE-94 Improper Control of Generation of Code ('Code Injection') (Base; mapping Allowed-with-Review) - CWE-116 Improper Encoding or Escaping of Output (Class; mapping Allowed-with-Review) - CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer (Class; mapping Discouraged) - CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') (Base; mapping Allowed-with-Review) - CWE-125 Out-of-bounds Read (Base; mapping Allowed) - CWE-129 Improper Validation of Array Index (Variant; mapping Allowed) - CWE-131 Incorrect Calculation of Buffer Size (Base; mapping Allowed) - CWE-134 Use of Externally-Controlled Format String (Base; mapping Allowed) - CWE-178 Improper Handling of Case Sensitivity (Base; mapping Allowed) - CWE-190 Integer Overflow or Wraparound (Base; mapping Allowed) - CWE-191 Integer Underflow (Wrap or Wraparound) (Base; mapping Allowed) - CWE-193 Off-by-one Error (Base; mapping Allowed) - CWE-200 Exposure of Sensitive Information to an Unauthorized Actor (Class; mapping Discouraged) - CWE-203 Observable Discrepancy (Base; mapping Allowed) - CWE-209 Generation of Error Message Containing Sensitive Information (Base; mapping Allowed) - CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer (Base; mapping Allowed) - CWE-252 Unchecked Return Value (Base; mapping Allowed) - CWE-269 Improper Privilege Management (Class; mapping Discouraged) - CWE-273 Improper Check for Dropped Privileges (Base; mapping Allowed) - CWE-276 Incorrect Default Permissions (Base; mapping Allowed) - CWE-281 Improper Preservation of Permissions (Base; mapping Allowed) - CWE-287 Improper Authentication (Class; mapping Discouraged) - CWE-290 Authentication Bypass by Spoofing (Base; mapping Allowed) - CWE-294 Authentication Bypass by Capture-replay (Base; mapping Allowed) - CWE-295 Improper Certificate Validation (Base; mapping Allowed) - CWE-306 Missing Authentication for Critical Function (Base; mapping Allowed) - CWE-307 Improper Restriction of Excessive Authentication Attempts (Base; mapping Allowed) - CWE-311 Missing Encryption of Sensitive Data (Class; mapping Discouraged) - CWE-312 Cleartext Storage of Sensitive Information (Base; mapping Allowed) - CWE-319 Cleartext Transmission of Sensitive Information (Base; mapping Allowed) - CWE-326 Inadequate Encryption Strength (Class; mapping Allowed-with-Review) - CWE-327 Use of a Broken or Risky Cryptographic Algorithm (Class; mapping Allowed-with-Review) - CWE-330 Use of Insufficiently Random Values (Class; mapping Discouraged) - CWE-331 Insufficient Entropy (Base; mapping Allowed) - CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) (Base; mapping Allowed) - CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (Base; mapping Allowed) - CWE-345 Insufficient Verification of Data Authenticity (Class; mapping Discouraged) - CWE-346 Origin Validation Error (Class; mapping Allowed-with-Review) - CWE-347 Improper Verification of Cryptographic Signature (Base; mapping Allowed) - CWE-352 Cross-Site Request Forgery (CSRF) (Compound; mapping Allowed) - CWE-354 Improper Validation of Integrity Check Value (Base; mapping Allowed) - CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') (Class; mapping Allowed-with-Review) - CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition (Base; mapping Allowed) - CWE-369 Divide By Zero (Base; mapping Allowed) - CWE-384 Session Fixation (Compound; mapping Allowed) - CWE-400 Uncontrolled Resource Consumption (Class; mapping Discouraged) - CWE-401 Missing Release of Memory after Effective Lifetime (Variant; mapping Allowed) - CWE-404 Improper Resource Shutdown or Release (Class; mapping Allowed-with-Review) - CWE-407 Inefficient Algorithmic Complexity (Class; mapping Allowed-with-Review) - CWE-415 Double Free (Variant; mapping Allowed) - CWE-416 Use After Free (Variant; mapping Allowed) - CWE-425 Direct Request ('Forced Browsing') (Base; mapping Allowed) - CWE-426 Untrusted Search Path (Base; mapping Allowed-with-Review) - CWE-427 Uncontrolled Search Path Element (Base; mapping Allowed-with-Review) - CWE-428 Unquoted Search Path or Element (Base; mapping Allowed) - CWE-434 Unrestricted Upload of File with Dangerous Type (Base; mapping Allowed) - CWE-436 Interpretation Conflict (Class; mapping Allowed-with-Review) - CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') (Base; mapping Allowed) - CWE-459 Incomplete Cleanup (Base; mapping Allowed) - CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') (Base; mapping Allowed) - CWE-476 NULL Pointer Dereference (Base; mapping Allowed) - CWE-494 Download of Code Without Integrity Check (Base; mapping Allowed) - CWE-502 Deserialization of Untrusted Data (Base; mapping Allowed) - CWE-521 Weak Password Requirements (Base; mapping Allowed) - CWE-522 Insufficiently Protected Credentials (Class; mapping Allowed-with-Review) - CWE-532 Insertion of Sensitive Information into Log File (Base; mapping Allowed) - CWE-552 Files or Directories Accessible to External Parties (Base; mapping Allowed) - CWE-565 Reliance on Cookies without Validation and Integrity Checking (Base; mapping Allowed) - CWE-601 URL Redirection to Untrusted Site ('Open Redirect') (Base; mapping Allowed) - CWE-610 Externally Controlled Reference to a Resource in Another Sphere (Class; mapping Discouraged) - CWE-611 Improper Restriction of XML External Entity Reference (Base; mapping Allowed) - CWE-613 Insufficient Session Expiration (Base; mapping Allowed-with-Review) - CWE-617 Reachable Assertion (Base; mapping Allowed) - CWE-639 Authorization Bypass Through User-Controlled Key (Base; mapping Allowed) - CWE-640 Weak Password Recovery Mechanism for Forgotten Password (Base; mapping Allowed-with-Review) - CWE-662 Improper Synchronization (Class; mapping Discouraged) - CWE-665 Improper Initialization (Class; mapping Discouraged) - CWE-667 Improper Locking (Class; mapping Allowed-with-Review) - CWE-668 Exposure of Resource to Wrong Sphere (Class; mapping Discouraged) - CWE-669 Incorrect Resource Transfer Between Spheres (Class; mapping Allowed-with-Review) - CWE-670 Always-Incorrect Control Flow Implementation (Class; mapping Allowed-with-Review) - CWE-672 Operation on a Resource after Expiration or Release (Class; mapping Allowed-with-Review) - CWE-674 Uncontrolled Recursion (Class; mapping Allowed-with-Review) - CWE-681 Incorrect Conversion between Numeric Types (Base; mapping Allowed) - CWE-682 Incorrect Calculation (Pillar; mapping Discouraged) - CWE-697 Incorrect Comparison (Pillar; mapping Discouraged) - CWE-704 Incorrect Type Conversion or Cast (Class; mapping Allowed-with-Review) - CWE-706 Use of Incorrectly-Resolved Name or Reference (Class; mapping Allowed-with-Review) - CWE-732 Incorrect Permission Assignment for Critical Resource (Class; mapping Allowed-with-Review) - CWE-754 Improper Check for Unusual or Exceptional Conditions (Class; mapping Allowed-with-Review) - CWE-755 Improper Handling of Exceptional Conditions (Class; mapping Discouraged) - CWE-763 Release of Invalid Pointer or Reference (Base; mapping Allowed) - CWE-770 Allocation of Resources Without Limits or Throttling (Base; mapping Allowed) - CWE-772 Missing Release of Resource after Effective Lifetime (Base; mapping Allowed) - CWE-776 Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') (Base; mapping Allowed) - CWE-787 Out-of-bounds Write (Base; mapping Allowed-with-Review) - CWE-798 Use of Hard-coded Credentials (Base; mapping Allowed-with-Review) - CWE-824 Access of Uninitialized Pointer (Base; mapping Allowed) - CWE-829 Inclusion of Functionality from Untrusted Control Sphere (Base; mapping Allowed) - CWE-834 Excessive Iteration (Class; mapping Discouraged) - CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop') (Base; mapping Allowed) - CWE-838 Inappropriate Encoding for Output Context (Base; mapping Allowed) - CWE-843 Access of Resource Using Incompatible Type ('Type Confusion') (Base; mapping Allowed) - CWE-862 Missing Authorization (Class; mapping Allowed-with-Review) - CWE-863 Incorrect Authorization (Class; mapping Allowed-with-Review) - CWE-908 Use of Uninitialized Resource (Base; mapping Allowed) - CWE-909 Missing Initialization of Resource (Class; mapping Allowed-with-Review) - CWE-913 Improper Control of Dynamically-Managed Code Resources (Class; mapping Allowed-with-Review) - CWE-916 Use of Password Hash With Insufficient Computational Effort (Base; mapping Allowed) - CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') (Base; mapping Allowed) - CWE-918 Server-Side Request Forgery (SSRF) (Base; mapping Allowed) - CWE-920 Improper Restriction of Power Consumption (Base; mapping Allowed) - CWE-922 Insecure Storage of Sensitive Information (Class; mapping Allowed-with-Review) - CWE-924 Improper Enforcement of Message Integrity During Transmission in a Communication Channel (Base; mapping Allowed) - CWE-1021 Improper Restriction of Rendered UI Layers or Frames (Base; mapping Allowed) - CWE-1188 Initialization of a Resource with an Insecure Default (Base; mapping Allowed) - CWE-1236 Improper Neutralization of Formula Elements in a CSV File (Base; mapping Allowed) - CWE-1284 Improper Validation of Specified Quantity in Input (Base; mapping Allowed) - CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') (Variant; mapping Allowed) - CWE-1333 Inefficient Regular Expression Complexity (Base; mapping Allowed) ## CWE-1435 **Weaknesses in the 2025 CWE Top 25 Most Dangerous Software Weaknesses** - Type: Graph - Status: Draft - Weakness members: 25 - Review use: 2025 CWE Top 25 view from this catalog release. Use it as prioritization context, never as proof of severity. CWE entries in this view are listed in the 2025 CWE Top 25 Most Dangerous Software Weaknesses. Ordered direct members: 1. CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') [Weakness] 2. CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') [Weakness] 3. CWE-352 Cross-Site Request Forgery (CSRF) [Weakness] 4. CWE-862 Missing Authorization [Weakness] 5. CWE-787 Out-of-bounds Write [Weakness] 6. CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') [Weakness] 7. CWE-416 Use After Free [Weakness] 8. CWE-125 Out-of-bounds Read [Weakness] 9. CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') [Weakness] 10. CWE-94 Improper Control of Generation of Code ('Code Injection') [Weakness] 11. CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') [Weakness] 12. CWE-434 Unrestricted Upload of File with Dangerous Type [Weakness] 13. CWE-476 NULL Pointer Dereference [Weakness] 14. CWE-121 Stack-based Buffer Overflow [Weakness] 15. CWE-502 Deserialization of Untrusted Data [Weakness] 16. CWE-122 Heap-based Buffer Overflow [Weakness] 17. CWE-863 Incorrect Authorization [Weakness] 18. CWE-20 Improper Input Validation [Weakness] 19. CWE-284 Improper Access Control [Weakness] 20. CWE-200 Exposure of Sensitive Information to an Unauthorized Actor [Weakness] 21. CWE-306 Missing Authentication for Critical Function [Weakness] 22. CWE-918 Server-Side Request Forgery (SSRF) [Weakness] 23. CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') [Weakness] 24. CWE-639 Authorization Bypass Through User-Controlled Key [Weakness] 25. CWE-770 Allocation of Resources Without Limits or Throttling [Weakness] Sample weakness members (20 of 25): - CWE-20 Improper Input Validation - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') - CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - CWE-94 Improper Control of Generation of Code ('Code Injection') - CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') - CWE-121 Stack-based Buffer Overflow - CWE-122 Heap-based Buffer Overflow - CWE-125 Out-of-bounds Read - CWE-200 Exposure of Sensitive Information to an Unauthorized Actor - CWE-284 Improper Access Control - CWE-306 Missing Authentication for Critical Function - CWE-352 Cross-Site Request Forgery (CSRF) - CWE-416 Use After Free - CWE-434 Unrestricted Upload of File with Dangerous Type - CWE-476 NULL Pointer Dereference - CWE-502 Deserialization of Untrusted Data - CWE-639 Authorization Bypass Through User-Controlled Key ## CWE-1344 **Weaknesses in OWASP Top Ten (2021)** - Type: Graph - Status: Incomplete - Weakness members: 182 - Review use: OWASP Top Ten 2021 view. Use it when a review or report must align findings with the OWASP 2021 grouping. CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021. Direct members: - CWE-1345 OWASP Top Ten 2021 Category A01:2021 - Broken Access Control [Category] - CWE-1346 OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures [Category] - CWE-1347 OWASP Top Ten 2021 Category A03:2021 - Injection [Category] - CWE-1348 OWASP Top Ten 2021 Category A04:2021 - Insecure Design [Category] - CWE-1349 OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration [Category] - CWE-1352 OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components [Category] - CWE-1353 OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures [Category] - CWE-1354 OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures [Category] - CWE-1355 OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures [Category] - CWE-1356 OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF) [Category] Sample weakness members (20 of 182): - CWE-11 ASP.NET Misconfiguration: Creating Debug Binary - CWE-13 ASP.NET Misconfiguration: Password in Configuration File - CWE-15 External Control of System or Configuration Setting - CWE-20 Improper Input Validation - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CWE-23 Relative Path Traversal - CWE-35 Path Traversal: '.../...//' - CWE-59 Improper Link Resolution Before File Access ('Link Following') - CWE-73 External Control of File Name or Path - CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) - CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') - CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - CWE-83 Improper Neutralization of Script in Attributes in a Web Page - CWE-87 Improper Neutralization of Alternate XSS Syntax - CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') - CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') - CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') ## CWE-1450 **Weaknesses in OWASP Top Ten RC1 (2025)** - Type: Graph - Status: Incomplete - Weakness members: 246 - Review use: OWASP Top Ten 2025 RC1 view. Use it only when the RC1 taxonomy is specifically relevant. CWE entries in this view (graph) are associated with the first release candidate (RC1) of the OWASP Top Ten, as released in 2025. Direct members: - CWE-1436 OWASP Top Ten 2025 Category A01:2025 - Broken Access Control [Category] - CWE-1437 OWASP Top Ten 2025 Category A02:2025 - Security Misconfiguration [Category] - CWE-1438 OWASP Top Ten 2025 Category A03:2025 - Software Supply Chain Failures [Category] - CWE-1439 OWASP Top Ten 2025 Category A04:2025 - Cryptographic Failures [Category] - CWE-1440 OWASP Top Ten 2025 Category A05:2025 - Injection [Category] - CWE-1441 OWASP Top Ten 2025 Category A06:2025 - Insecure Design [Category] - CWE-1442 OWASP Top Ten 2025 Category A07:2025 - Authentication Failures [Category] - CWE-1443 OWASP Top Ten 2025 Category A08:2025 - Software or Data Integrity Failures [Category] - CWE-1444 OWASP Top Ten 2025 Category A09:2025 - Logging & Alerting Failures [Category] - CWE-1445 OWASP Top Ten 2025 Category A10:2025 - Mishandling of Exceptional Conditions [Category] Sample weakness members (20 of 246): - CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption - CWE-11 ASP.NET Misconfiguration: Creating Debug Binary - CWE-13 ASP.NET Misconfiguration: Password in Configuration File - CWE-15 External Control of System or Configuration Setting - CWE-20 Improper Input Validation - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CWE-23 Relative Path Traversal - CWE-36 Absolute Path Traversal - CWE-59 Improper Link Resolution Before File Access ('Link Following') - CWE-61 UNIX Symbolic Link (Symlink) Following - CWE-65 Windows Hard Link - CWE-73 External Control of File Name or Path - CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') - CWE-76 Improper Neutralization of Equivalent Special Elements - CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') - CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') - CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') - CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) - CWE-83 Improper Neutralization of Script in Attributes in a Web Page - CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages ## CWE-1448 **Weaknesses Related to AI/ML Products** - Type: Graph - Status: Incomplete - Weakness members: 17 - Review use: AI/ML product view. Use it when model inputs, training, inference, or agentic behavior are in scope. CWE entries in this view (graph) are unique to AI/ML products, or are commonly encountered in products that use or support AI/ML. Direct members: - CWE-1446 Weaknesses That are Specific to AI/ML Technology [Category] - CWE-1447 General Software Weaknesses that Appear in Products that Use or Support AI/ML Technology [Category] Weakness members: - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (Base; mapping Allowed-with-Review) - CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection') (Class; mapping Allowed-with-Review) - CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (Base; mapping Allowed) - CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (Base; mapping Allowed) - CWE-94 Improper Control of Generation of Code ('Code Injection') (Base; mapping Allowed-with-Review) - CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (Variant; mapping Allowed) - CWE-116 Improper Encoding or Escaping of Output (Class; mapping Allowed-with-Review) - CWE-250 Execution with Unnecessary Privileges (Base; mapping Allowed) - CWE-434 Unrestricted Upload of File with Dangerous Type (Base; mapping Allowed) - CWE-502 Deserialization of Untrusted Data (Base; mapping Allowed) - CWE-862 Missing Authorization (Class; mapping Allowed-with-Review) - CWE-918 Server-Side Request Forgery (SSRF) (Base; mapping Allowed) - CWE-1039 Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism (Class; mapping Allowed-with-Review) - CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine (Base; mapping Allowed) - CWE-1426 Improper Validation of Generative AI Output (Base; mapping Discouraged) - CWE-1427 Improper Neutralization of Input Used for LLM Prompting (Base; mapping Allowed) - CWE-1434 Insecure Setting of Generative AI/ML Model Inference Parameters (Base; mapping Allowed) ## CWE-658 **Weaknesses in Software Written in C** - Type: Implicit - Status: Draft - Weakness members: 103 - Review use: Implicit C-language view. This view (slice) covers issues that are found in C programs that are not common to all languages. Filter: `/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='C']` Sample weakness members (20 of 103): - CWE-14 Compiler Removal of Code to Clear Buffers - CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer - CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') - CWE-121 Stack-based Buffer Overflow - CWE-122 Heap-based Buffer Overflow - CWE-123 Write-what-where Condition - CWE-124 Buffer Underwrite ('Buffer Underflow') - CWE-125 Out-of-bounds Read - CWE-126 Buffer Over-read - CWE-127 Buffer Under-read - CWE-128 Wrap-around Error - CWE-129 Improper Validation of Array Index - CWE-130 Improper Handling of Length Parameter Inconsistency - CWE-131 Incorrect Calculation of Buffer Size - CWE-134 Use of Externally-Controlled Format String - CWE-135 Incorrect Calculation of Multi-Byte String Length - CWE-158 Improper Neutralization of Null Byte or NUL Character - CWE-170 Improper Null Termination - CWE-188 Reliance on Data/Memory Layout - CWE-190 Integer Overflow or Wraparound ## CWE-659 **Weaknesses in Software Written in C++** - Type: Implicit - Status: Draft - Weakness members: 97 - Review use: Implicit C++-language view. This view (slice) covers issues that are found in C++ programs that are not common to all languages. Filter: `/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='C++']` Sample weakness members (20 of 97): - CWE-14 Compiler Removal of Code to Clear Buffers - CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer - CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') - CWE-121 Stack-based Buffer Overflow - CWE-122 Heap-based Buffer Overflow - CWE-123 Write-what-where Condition - CWE-124 Buffer Underwrite ('Buffer Underflow') - CWE-125 Out-of-bounds Read - CWE-126 Buffer Over-read - CWE-127 Buffer Under-read - CWE-128 Wrap-around Error - CWE-129 Improper Validation of Array Index - CWE-130 Improper Handling of Length Parameter Inconsistency - CWE-131 Incorrect Calculation of Buffer Size - CWE-134 Use of Externally-Controlled Format String - CWE-135 Incorrect Calculation of Multi-Byte String Length - CWE-158 Improper Neutralization of Null Byte or NUL Character - CWE-170 Improper Null Termination - CWE-188 Reliance on Data/Memory Layout - CWE-191 Integer Underflow (Wrap or Wraparound) ## CWE-660 **Weaknesses in Software Written in Java** - Type: Implicit - Status: Draft - Weakness members: 84 - Review use: Implicit Java-language view. This view (slice) covers issues that are found in Java programs that are not common to all languages. Filter: `/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='Java']` Sample weakness members (20 of 84): - CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption - CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length - CWE-7 J2EE Misconfiguration: Missing Custom Error Page - CWE-8 J2EE Misconfiguration: Entity Bean Declared Remote - CWE-9 J2EE Misconfiguration: Weak Access Permissions for EJB Methods - CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - CWE-102 Struts: Duplicate Validation Forms - CWE-103 Struts: Incomplete validate() Method Definition - CWE-104 Struts: Form Bean Does Not Extend Validation Class - CWE-105 Struts: Form Field Without Validator - CWE-106 Struts: Plug-in Framework not in Use - CWE-107 Struts: Unused Validation Form - CWE-108 Struts: Unvalidated Action Form - CWE-109 Struts: Validator Turned Off - CWE-110 Struts: Validator Without Form Field - CWE-111 Direct Use of Unsafe JNI - CWE-191 Integer Underflow (Wrap or Wraparound) - CWE-192 Integer Coercion Error - CWE-197 Numeric Truncation Error - CWE-209 Generation of Error Message Containing Sensitive Information ## CWE-661 **Weaknesses in Software Written in PHP** - Type: Implicit - Status: Draft - Weakness members: 26 - Review use: Implicit PHP-language view. This view (slice) covers issues that are found in PHP programs that are not common to all languages. Filter: `/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Language/@Name='PHP']` Sample weakness members (20 of 26): - CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') - CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') - CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') - CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') - CWE-209 Generation of Error Message Containing Sensitive Information - CWE-211 Externally-Generated Error Message Containing Sensitive Information - CWE-434 Unrestricted Upload of File with Dangerous Type - CWE-453 Insecure Default Variable Initialization - CWE-454 External Initialization of Trusted Variables or Data Stores - CWE-457 Use of Uninitialized Variable - CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') - CWE-473 PHP External Variable Modification - CWE-474 Use of Function with Inconsistent Implementations - CWE-484 Omitted Break Statement in Switch - CWE-502 Deserialization of Untrusted Data - CWE-595 Comparison of Object References Instead of Object Contents - CWE-597 Use of Wrong Operator in String Comparison - CWE-616 Incomplete Identification of Uploaded File Variables (PHP) - CWE-621 Variable Extraction Error - CWE-624 Executable Regular Expression Error ## CWE-701 **Weaknesses Introduced During Design** - Type: Implicit - Status: Incomplete - Weakness members: 297 - Review use: Implicit design-introduction view. This view (slice) lists weaknesses that can be introduced during design. Filter: `/Weakness_Catalog/Weaknesses/Weakness[(@Abstraction='Base') or (@Abstraction='Class')][./Modes_Of_Introduction/Introduction/Phase='Architecture and Design']` Sample weakness members (20 of 297): - CWE-20 Improper Input Validation - CWE-73 External Control of File Name or Path - CWE-99 Improper Control of Resource Identifiers ('Resource Injection') - CWE-115 Misinterpretation of Input - CWE-184 Incomplete List of Disallowed Inputs - CWE-200 Exposure of Sensitive Information to an Unauthorized Actor - CWE-201 Insertion of Sensitive Information Into Sent Data - CWE-202 Exposure of Sensitive Information Through Data Queries - CWE-203 Observable Discrepancy - CWE-204 Observable Response Discrepancy - CWE-205 Observable Behavioral Discrepancy - CWE-208 Observable Timing Discrepancy - CWE-209 Generation of Error Message Containing Sensitive Information - CWE-210 Self-generated Error Message Containing Sensitive Information - CWE-211 Externally-Generated Error Message Containing Sensitive Information - CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer - CWE-213 Exposure of Sensitive Information Due to Incompatible Policies - CWE-214 Invocation of Process Using Visible Sensitive Information - CWE-221 Information Loss or Omission - CWE-223 Omission of Security-relevant Information ## CWE-702 **Weaknesses Introduced During Implementation** - Type: Implicit - Status: Incomplete - Weakness members: 835 - Review use: Implicit implementation-introduction view. This view (slice) lists weaknesses that can be introduced during implementation. Filter: `/Weakness_Catalog/Weaknesses/Weakness[./Modes_Of_Introduction/Introduction/Phase='Implementation']` Sample weakness members (20 of 835): - CWE-5 J2EE Misconfiguration: Data Transmission Without Encryption - CWE-6 J2EE Misconfiguration: Insufficient Session-ID Length - CWE-7 J2EE Misconfiguration: Missing Custom Error Page - CWE-8 J2EE Misconfiguration: Entity Bean Declared Remote - CWE-9 J2EE Misconfiguration: Weak Access Permissions for EJB Methods - CWE-11 ASP.NET Misconfiguration: Creating Debug Binary - CWE-12 ASP.NET Misconfiguration: Missing Custom Error Page - CWE-13 ASP.NET Misconfiguration: Password in Configuration File - CWE-14 Compiler Removal of Code to Clear Buffers - CWE-15 External Control of System or Configuration Setting - CWE-20 Improper Input Validation - CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') - CWE-23 Relative Path Traversal - CWE-24 Path Traversal: '../filedir' - CWE-25 Path Traversal: '/../filedir' - CWE-26 Path Traversal: '/dir/../filename' - CWE-27 Path Traversal: 'dir/../../filename' - CWE-28 Path Traversal: '..\filedir' - CWE-29 Path Traversal: '\..\filename' - CWE-30 Path Traversal: '\dir\..\filename' ## CWE-919 **Weaknesses in Mobile Applications** - Type: Implicit - Status: Incomplete - Weakness members: 21 - Review use: Implicit mobile-application view. CWE entries in this view (slice) are often seen in mobile applications. Filter: `/Weakness_Catalog/Weaknesses/Weakness[./Applicable_Platforms/Technology/@Class='Mobile']` Sample weakness members (20 of 21): - CWE-200 Exposure of Sensitive Information to an Unauthorized Actor - CWE-250 Execution with Unnecessary Privileges - CWE-295 Improper Certificate Validation - CWE-297 Improper Validation of Certificate with Host Mismatch - CWE-312 Cleartext Storage of Sensitive Information - CWE-319 Cleartext Transmission of Sensitive Information - CWE-359 Exposure of Private Personal Information to an Unauthorized Actor - CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') - CWE-511 Logic/Time Bomb - CWE-602 Client-Side Enforcement of Server-Side Security - CWE-672 Operation on a Resource after Expiration or Release - CWE-772 Missing Release of Resource after Effective Lifetime - CWE-798 Use of Hard-coded Credentials - CWE-920 Improper Restriction of Power Consumption - CWE-921 Storage of Sensitive Data in a Mechanism without Access Control - CWE-925 Improper Verification of Intent by Broadcast Receiver - CWE-926 Improper Export of Android Application Components - CWE-927 Use of Implicit Intent for Sensitive Communication - CWE-939 Improper Authorization in Handler for Custom URL Scheme - CWE-940 Improper Verification of Source of a Communication Channel ## references/cwe-schema-guide.md # CWE Schema Guide Generated from the local CWE XSD. Use this file when interpreting field meaning, relationship semantics, or allowed vocabulary. ## Contents - [Schema Metadata](#schema-metadata) - [Core Complex Types](#core-complex-types) - [Enumerations](#enumerations) ## Schema Metadata - Name: Core Definition - Version: 7.3 - Date: December 11, 2025 ## Core Complex Types ### WeaknessType A weakness is a mistake or condition that, if left unaddressed, could under the proper conditions contribute to a cyber-enabled capability being vulnerable to attack, allowing an adversary to make items function in unintended ways. This complexType is used to describe a specific type of weakness and provide a variety of information related to it. The required Description should be short and limited to the key points that define this weakness. The optional Extended_Description element provides a place for additional details important to this weakness, but that are not necessary to convey the fundamental concept behind the weakness. A number of other optional elements are available, each of which is described in more detail within the corresponding complexType that it references. The required ID attribute provides a unique identifier for the entry. It is considered static for the lifeti... | Element | Type | Cardinality | | --- | --- | --- | | Description | xs:string | 1..1 | | Extended_Description | cwe:StructuredTextType | 0..1 | | Related_Weaknesses | cwe:RelatedWeaknessesType | 0..1 | | Weakness_Ordinalities | cwe:WeaknessOrdinalitiesType | 0..1 | | Applicable_Platforms | cwe:ApplicablePlatformsType | 0..1 | | Background_Details | cwe:BackgroundDetailsType | 0..1 | | Alternate_Terms | cwe:AlternateTermsType | 0..1 | | Modes_Of_Introduction | cwe:ModesOfIntroductionType | 0..1 | | Exploitation_Factors | cwe:ExploitationFactorsType | 0..1 | | Likelihood_Of_Exploit | cwe:LikelihoodEnumeration | 0..1 | | Common_Consequences | cwe:CommonConsequencesType | 0..1 | | Detection_Methods | cwe:DetectionMethodsType | 0..1 | | Potential_Mitigations | cwe:PotentialMitigationsType | 0..1 | | Demonstrative_Examples | cwe:DemonstrativeExamplesType | 0..1 | | Observed_Examples | cwe:ObservedExampleType | 0..1 | | Functional_Areas | cwe:FunctionalAreasType | 0..1 | | Affected_Resources | cwe:AffectedResourcesType | 0..1 | | Taxonomy_Mappings | cwe:TaxonomyMappingsType | 0..1 | | Related_Attack_Patterns | cwe:RelatedAttackPatternsType | 0..1 | | References | cwe:ReferencesType | 0..1 | | Mapping_Notes | cwe:MappingNotesType | 1..1 | | Notes | cwe:NotesType | 0..1 | | Content_History | cwe:ContentHistoryType | 1..1 | | Attribute | Type | Use | | --- | --- | --- | | ID | xs:integer | required | | Name | xs:string | required | | Abstraction | cwe:AbstractionEnumeration | required | | Structure | cwe:StructureEnumeration | required | | Status | cwe:StatusEnumeration | required | | Diagram | xs:string | optional | ### MappingNotesType The MappingNotesType complex type provides guidance for when (and whether) to map an issue to this CWE entry or to suggest alternatives. The Usage element describes whether the CWE should be used for mapping vulnerabilities to their underlying weaknesses as part of root cause analysis. The Rationale element provides context for the Usage. The Comments element provides further clarification to the reader. The Reasons element uses a limited vocabulary to summarize the Usage. The Suggestions element includes suggestions for additional CWEs that might be more appropriate for the mapping task. | Element | Type | Cardinality | | --- | --- | --- | | Usage | cwe:UsageEnumeration | 1..1 | | Rationale | cwe:StructuredTextType | 1..1 | | Comments | cwe:StructuredTextType | 1..1 | | Reasons | cwe:ReasonsType | 1..1 | | Suggestions | cwe:SuggestionsType | 0..1 | ### RelatedWeaknessesType The RelatedWeaknessesType complex type is used to refer to other weaknesses that differ only in their level of abstraction. It contains one or more Related_Weakness elements, each of which is used to link to the CWE identifier of the other Weakness. The nature of the relation is captured by the Nature attribute. Please see the RelatedNatureEnumeration simple type definition for details about the valid value and meanings. The optional Chain_ID attribute specifies the unique ID of a named chain that a CanFollow or CanPrecede relationship pertains to. The optional Ordinal attribute is used to determine if this relationship is the primary ChildOf relationship for this weakness for a given View_ID. This attribute can only have the value "Primary" and should only be included for the primary parent/child relationship. For each unique triple of , there should be only... | Element | Type | Cardinality | | --- | --- | --- | | Related_Weakness | inline type | 1..unbounded | ### RelationshipsType The RelationshipsType complex type provides elements to show the associated relationships with a given view or category. The Member_Of element is used to denote the individual categories that are included as part of the target view. The Has_Member element is used to define the weaknesses or other categories that are grouped together by a category. In both cases, the required MemberType's CWE_ID attribute specifies the unique CWE ID that is the target entry of the relationship, while the View_ID specifies which view the given relationship is relevant to. ### ModesOfIntroductionType The ModeOfIntroductionType complex type is used to provide information about how and when a given weakness may be introduced. If there are multiple possible introduction points, then a separate Introduction element should be included for each. The required Phase element identifies the point in the product life cycle at which the weakness may be introduced. The optional Note element identifies the typical scenarios under which the weakness may be introduced during the given phase. | Element | Type | Cardinality | | --- | --- | --- | | Introduction | inline type | 1..unbounded | ### ApplicablePlatformsType The ApplicablePlatformsType complex type specifies the languages, operating systems, architectures, and technologies in which a given weakness could appear. A technology represents a generally accepted feature of a system and often refers to a high-level functional component within a system. The required Prevalence attribute identifies the regularity with which the weakness is applicable to that platform. When providing an operating system name, an optional Common Platform Enumeration (CPE) identifier can be used to a identify a specific OS. | Element | Type | Cardinality | | --- | --- | --- | | Language | inline type | 0..unbounded | | Operating_System | inline type | 0..unbounded | | Architecture | inline type | 0..unbounded | | Technology | inline type | 0..unbounded | ### FunctionalAreasType The FunctionalAreasType complex type contains one or more functional_area elements, each of which identifies the functional area in which the weakness is most likely to occur. For example, CWE-23: Relative Path Traversal may occur in functional areas of software related to file processing. Each applicable functional area should have a new Functional_Area element, and standard title capitalization should be applied to each area. | Element | Type | Cardinality | | --- | --- | --- | | Functional_Area | cwe:FunctionalAreaEnumeration | 1..unbounded | ### CommonConsequencesType The CommonConsequencesType complex type is used to specify individual consequences associated with a weakness. The required Scope element identifies the security property that is violated. The optional Impact element describes the technical impact that arises if an adversary succeeds in exploiting this weakness. The optional Likelihood element identifies how likely the specific consequence is expected to be seen relative to the other consequences. For example, there may be high likelihood that a weakness will be exploited to achieve a certain impact, but a low likelihood that it will be exploited to achieve a different impact. The optional Note element provides additional commentary about a consequence. The optional Consequence_ID attribute is used by the internal CWE team to uniquely identify examples that are repeated across any number of individual weaknesses. To help make sure tha... | Element | Type | Cardinality | | --- | --- | --- | | Consequence | inline type | 1..unbounded | ### DetectionMethodsType The DetectionMethodsType complex type is used to identify methods that may be employed to detect this weakness, including their strengths and limitations. The required Method element identifies the particular detection method being described. The required Description element is intended to provide some context of how this method can be applied to a specific weakness. The optional Effectiveness element says how effective the detection method may be in detecting the associated weakness. This assumes the use of best-of-breed tools, analysts, and methods. There is limited consideration for financial costs, labor, or time. The optional Effectiveness_Notes element provides additional discussion of the strengths and shortcomings of this detection method. The optional Detection_Method_ID attribute is used by the internal CWE team to uniquely identify methods that are repeated across any numbe... | Element | Type | Cardinality | | --- | --- | --- | | Detection_Method | inline type | 1..unbounded | ### PotentialMitigationsType The PotentialMitigationsType complex type is used to describe potential mitigations associated with a weakness. It contains one or more Mitigation elements, which each represent individual mitigations for the weakness. The Phase element indicates the development life cycle phase during which this particular mitigation may be applied. The Strategy element describes a general strategy for protecting a system to which this mitigation contributes. The Effectiveness element summarizes how effective the mitigation may be in preventing the weakness. The Description element contains a description of this individual mitigation including any strengths and shortcomings of this mitigation for the weakness. The optional Mitigation_ID attribute is used by the internal CWE team to uniquely identify mitigations that are repeated across any number of individual weaknesses. To help make sure that the d... | Element | Type | Cardinality | | --- | --- | --- | | Mitigation | inline type | 1..unbounded | ### ObservedExampleType The ObservedExampleType complex type specifies references to a specific observed instance of a weakness in real-world products. Typically this will be a CVE reference. Each Observed_Example element represents a single example. The required Reference element should contain the identifier for the example being cited. For example, if a CVE is being cited, it should be of the standard CVE identifier format, such as CVE-2005-1951 or CVE-1999-0046. The required Description element should contain a brief description of the weakness being cited, without including irrelevant details such as the product name or attack vectors. The description should present an unambiguous correlation between the example being described and the weakness(es) that it is meant to exemplify. It should also be short and easy to understand. The Link element should provide a valid URL where more information regarding t... | Element | Type | Cardinality | | --- | --- | --- | | Observed_Example | inline type | 1..unbounded | ## Enumerations ### AbstractionEnumeration The AbstractionEnumeration simple type defines the different abstraction levels that apply to a weakness. A "Pillar" is the most abstract type of weakness and represents a theme for all class/base/variant weaknesses related to it. A Pillar is different from a Category as a Pillar is still technically a type of weakness that describes a mistake, while a Category represents a common characteristic used to group related things. A "Class" is a weakness also described in a very abstract fashion, t... | Value | Notes | | --- | --- | | Pillar | | | Class | | | Base | | | Variant | | | Compound | | ### ArchitectureClassEnumeration The ArchitectureClassEnumeration simple type contains a list of values corresponding to known classes of architectures. The value "Not Architecture-Specific" is used to indicate that the entry is not limited to a small set of architectures, i.e., it can appear in many different architectures. | Value | Notes | | --- | --- | | Embedded | | | Microcomputer | | | Workstation | | | Not Architecture-Specific | Used to indicate that the entry is not limited to a small set of architectures, i.e., it can appear in many different architectures | ### ArchitectureNameEnumeration The ArchitectureNameEnumeration simple type contains a list of values corresponding to known architectures. | Value | Notes | | --- | --- | | Alpha | | | ARM | | | Itanium | | | Power Architecture | | | SPARC | | | x86 | | | Other | | ### DetectionEffectivenessEnumeration The DetectionEffectivenessEnumeration simple type defines the different levels of effectiveness that a detection method may have in detecting an associated weakness. The value "High" is used to describe a method that succeeds frequently and does not result in many false reports. The value "Moderate" is used to describe a method that is applicable to multiple circumstances, but it may not have complete coverage of the weakness, or it may result in a number of incorrect reports. The "SOAR Parti... | Value | Notes | | --- | --- | | High | | | Moderate | | | SOAR Partial | Used to indicate that according to the IATAC State Of the Art Report (SOAR), the detection method is partially effective. | | Opportunistic | | | Limited | | | None | | ### DetectionMethodEnumeration The DetectionMethodEnumeration simple type defines the different methods used to detect a weakness. | Value | Notes | | --- | --- | | Automated Analysis | | | Automated Dynamic Analysis | | | Automated Static Analysis | | | Automated Static Analysis - Source Code | | | Automated Static Analysis - Binary or Bytecode | | | Fuzzing | | | Manual Analysis | | | Manual Dynamic Analysis | | | Manual Static Analysis | | | Manual Static Analysis - Source Code | | | Manual Static Analysis - Binary or Bytecode | | | White Box | | | Black Box | | | Architecture or Design Review | | | Dynamic Analysis with Manual Results Interpretation | | | Dynamic Analysis with Automated Results Interpretation | | | Formal Verification | | | Simulation / Emulation | | | Other | | ### EffectivenessEnumeration The EffectivenessEnumeration simple type defines the different values related to how effective a mitigation may be in preventing the weakness. A value of "High" means the mitigation is frequently successful in eliminating the weakness entirely. A value of "Moderate" means the mitigation will prevent the weakness in multiple forms, but it does not have complete coverage of the weakness. A value of "Limited" means the mitigation may be useful in limited circumstances, or it is only applicable t... | Value | Notes | | --- | --- | | High | | | Moderate | | | Limited | | | Incidental | | | Discouraged Common Practice | | | Defense in Depth | | | None | | ### FunctionalAreaEnumeration The FunctionalAreaEnumeration simple type defines the different functional areas in which the weakness may appear. The value "Functional-Area-Independent" is used to indicate that the entry is not limited to a small set of functional areas, i.e., it can appear in many different functional areas | Value | Notes | | --- | --- | | Authentication | | | Authorization | | | Code Libraries | | | Counters | | | Cryptography | | | Error Handling | | | Interprocess Communication | | | File Processing | | | Logging | | | Memory Management | | | Networking | | | Number Processing | | | Program Invocation | | | Protection Mechanism | | | Session Management | | | Signals | | | String Processing | | | Not Functional-Area-Specific | Used to indicate that the entry is not limited to a small set of functional areas, i.e., it can appear in many different functional areas | | Power | | | Clock | | ### ImportanceEnumeration The ImportanceEnumeration simple type lists different values for importance. | Value | Notes | | --- | --- | | Normal | | | Critical | | ### LanguageClassEnumeration The LanguageClassEnumeration simple type contains a list of values corresponding to different classes of source code languages. The same language could belong to multiple language classes, such as 'Object-Oriented' and 'Memory-Unsafe'. The value "Not Language-Specific" is used to indicate that the entry is not limited to a small set of languages. | Value | Notes | | --- | --- | | Assembly | | | Compiled | | | Hardware Description Language | | | Interpreted | | | Object-Oriented | | | Memory-Unsafe | | | Not Language-Specific | Used to indicate that the entry is not limited to a small set of language classes, i.e., it can appear in many different language classes. | ### LanguageNameEnumeration The LanguageNameEnumeration simple type contains a list of values corresponding to different source code languages or data formats. | Value | Notes | | --- | --- | | Ada | | | ARM Assembly | | | ASP | | | ASP.NET | | | Basic | | | C | | | C++ | | | C# | | | COBOL | | | Fortran | | | F# | | | Go | | | HTML | | | Java | | | JavaScript | | | JSON | | | JSP | | | Objective-C | | | Pascal | | | Perl | | | PHP | | | Pseudocode | | | Python | | | Ruby | | | Rust | | | Shell | | | SQL | | | Swift | | | VB.NET | | | Verilog | | | VHDL | | | XML | | | x86 Assembly | | | Other | | ### LikelihoodEnumeration The LikelihoodEnumeration simple type contains a list of values corresponding to different likelihoods. The value "Unknown" should be used when the actual likelihood of something occurring is not known. | Value | Notes | | --- | --- | | High | | | Medium | | | Low | | | Unknown | | ### MitigationStrategyEnumeration The MitigationStrategyEnumeration simple type lists general strategies for protecting a system to which a mitigation contributes. | Value | Notes | | --- | --- | | Attack Surface Reduction | | | Compilation or Build Hardening | | | Enforcement by Conversion | | | Environment Hardening | | | Firewall | | | Input Validation | | | Language Selection | | | Libraries or Frameworks | | | Resource Limitation | | | Output Encoding | | | Parameterization | | | Refactoring | | | Sandbox or Jail | | | Separation of Privilege | | ### NoteTypeEnumeration The NoteTypeEnumeration simple type defines the different types of notes that can be associated with a weakness. An "Applicable Platform" note provides additional information about the list of applicable platforms for a given weakness. A "Maintenance" note contains significant maintenance tasks within this entry that still need to be addressed, such as clarifying the concepts involved or improving relationships. A "Relationship" note provides clarifying details regarding the relationships bet... | Value | Notes | | --- | --- | | Applicable Platform | | | Maintenance | | | Relationship | | | Research Gap | | | Terminology | | | Theoretical | | | Other | | ### OperatingSystemClassEnumeration The OperatingSystemClassEnumeration simple type contains a list of values corresponding to different classes of operating systems. The value "Not OS-Specific" is used to indicate that the entry is not limited to a small set of operating system classes, i.e., it can appear in many different operating system classes. | Value | Notes | | --- | --- | | Linux | | | macOS | | | Unix | | | Windows | | | Not OS-Specific | Used to indicate that the entry is not limited to a small set of operating system classes, i.e., it can appear in many different operating system classes. | ### OperatingSystemNameEnumeration The OperatingSystemNameEnumeration simple type contains a list of values corresponding to different operating systems. | Value | Notes | | --- | --- | | AIX | | | Android | | | BlackBerry OS | | | Chrome OS | | | Darwin | | | FreeBSD | | | iOS | | | macOS | | | NetBSD | | | OpenBSD | | | Red Hat | | | Solaris | | | SUSE | | | tvOS | | | Ubuntu | | | watchOS | | | Windows 9x | | | Windows Embedded | | | Windows NT | | ### OrdinalEnumeration The OrdinalEnumeration simple type contains a list of values used to determine if a relationship is the primary relationship for a given weakness entry within a given view. Currently, this attribute can only have the value "Primary". | Value | Notes | | --- | --- | | Primary | | ### OrdinalityEnumeration The OrdinalityEnumeration simple type contains a list of values used to indicates potential ordering relationships with other weaknesses. A primary relationship means the weakness exists independent of other weaknesses, while a resultant relationship is when a weakness exists only in the presence of some other weaknesses. An indirect relationship means the weakness does not directly lead to security-relevant weaknesses but is a quality issue that might indirectly make it easier to introduce s... | Value | Notes | | --- | --- | | Indirect | | | Primary | | | Resultant | | ### PhaseEnumeration The PhaseEnumeration simple type lists different phases in the product life cycle. | Value | Notes | | --- | --- | | Policy | | | Requirements | | | Architecture and Design | | | Implementation | | | Build and Compilation | | | Testing | | | Documentation | | | Bundling | | | Distribution | | | Installation | | | System Configuration | | | Operation | | | Patching and Maintenance | | | Porting | | | Integration | | | Manufacturing | | | Decommissioning and End-of-Life | | ### PrevalenceEnumeration The PrevalenceEnumeration simple type defines the different regularities that guide the applicability of platforms. | Value | Notes | | --- | --- | | Often | | | Sometimes | | | Rarely | | | Undetermined | | ### ReasonEnumeration The ReasonEnumeration simple type holds all the different types of reasons to why a CWE might not be considered for mapping. | Value | Notes | | --- | --- | | Abstraction | | | Category | | | View | | | Deprecated | | | Potential Deprecation | | | Frequent Misuse | | | Frequent Misinterpretation | | | Multiple Use | | | CWE Overlap | | | Acceptable-Use | | | Potential Major Changes | | | Other | | ### RelatedNatureEnumeration The RelatedNatureEnumeration simple type defines the different values that can be used to define the nature of a related weakness. A ChildOf nature denotes a related weakness at a higher level of abstraction. A ParentOf nature denotes a related weakness at a lower level of abstraction. The StartsWith, CanPrecede, and CanFollow relationships are used to denote weaknesses that are part of a chaining structure. The RequiredBy and Requires relationships are used to denote a weakness that is part... | Value | Notes | | --- | --- | | ChildOf | | | ParentOf | | | StartsWith | | | CanFollow | | | CanPrecede | | | RequiredBy | | | Requires | | | CanAlsoBe | | | PeerOf | | ### ResourceEnumeration The ResourceEnumeration simple type defines different resources of a system. | Value | Notes | | --- | --- | | CPU | | | File or Directory | | | Memory | | | System Process | | | Other | | ### ScopeEnumeration The ScopeEnumeration simple type defines the different areas of security that can be affected by exploiting a weakness. | Value | Notes | | --- | --- | | Confidentiality | | | Integrity | | | Availability | | | Access Control | | | Accountability | | | Authentication | | | Authorization | | | Non-Repudiation | | | Other | | ### StakeholderEnumeration The StakeholderEnumeration simple type defines the different types of users within the CWE community. | Value | Notes | | --- | --- | | Academic Researchers | | | Applied Researchers | | | Assessment Teams | | | Assessment Tool Vendors | | | CWE Team | | | Educators | | | Hardware Designers | | | Information Providers | | | Product Customers | | | Product Vendors | | | Software Developers | | | Vulnerability Analysts | | | Other | | ### StatusEnumeration The StatusEnumeration simple type defines the different status values that an entity (view, category, weakness) can have. A value of Deprecated refers to an entity that has been removed from CWE, likely because it was a duplicate or was created in error. A value of Obsolete is used when an entity is still valid but no longer is relevant, likely because it has been superseded by a more recent entity. A value of Incomplete means that the entity does not have all important elements filled, and t... | Value | Notes | | --- | --- | | Deprecated | | | Draft | | | Incomplete | | | Obsolete | | | Stable | | | Usable | | ### StructureEnumeration The StructureEnumeration simple type lists the different structural natures of a weakness. A Simple structure represents a single weakness whose exploitation is not dependent on the presence of another weakness. A Composite is a set of weaknesses that must all be present simultaneously in order to produce an exploitable vulnerability, while a Chain is a set of weaknesses that must be reachable consecutively in order to produce an exploitable vulnerability. | Value | Notes | | --- | --- | | Chain | | | Composite | | | Simple | | ### StructuredCodeNatureEnumeration The StructuredCodeNatureEnumeration sinple type defines the different values that state what type of code is being shown in an eample. | Value | Notes | | --- | --- | | Attack | | | Bad | | | Good | | | Informative | | | Mitigation | | | Result | | ### TaxonomyMappingFitEnumeration The TaxonomyMappingFitEnumeration simple type defines the different values used to describe how close a certain mapping to CWE is. | Value | Notes | | --- | --- | | Exact | | | CWE More Abstract | | | CWE More Specific | | | Imprecise | | | Perspective | | ### TaxonomyNameEnumeration The TaxonomyNameEnumeration simple type lists the different known taxomomies that can be mapped to CWE. | Value | Notes | | --- | --- | | 7 Pernicious Kingdoms | | | 19 Deadly Sins | | | Aslam | | | Bishop | | | CERT C Secure Coding | | | CERT C++ Secure Coding | | | The CERT Oracle Secure Coding Standard for Java (2011) | | | CLASP | | | ISA/IEC 62443 | | | Landwehr | | | OMG ASCSM | | | OMG ASCRM | | | OMG ASCMM | | | OMG ASCPEM | | | OWASP Top Ten 2004 | | | OWASP Top Ten 2007 | | | OWASP Top Ten | | | PLOVER | | | Protection Analysis | | | RISOS | | | SEI CERT C Coding Standard | | | SEI CERT C++ Coding Standard | | | SEI CERT Oracle Coding Standard for Java | | | SEI CERT Perl Coding Standard | | | Software Fault Patterns | | | Weber, Karger, Paradkar | | | WASC | | ### TechnicalImpactEnumeration The TechnicalImpactEnumeration simple type describes the technical impacts that can arise if an adversary successfully exploits a weakness. | Value | Notes | | --- | --- | | Modify Memory | | | Read Memory | | | Modify Files or Directories | | | Read Files or Directories | | | Modify Application Data | | | Read Application Data | | | DoS: Crash, Exit, or Restart | | | DoS: Amplification | | | DoS: Instability | | | DoS: Resource Consumption (CPU) | | | DoS: Resource Consumption (Memory) | | | DoS: Resource Consumption (Other) | | | Execute Unauthorized Code or Commands | | | Gain Privileges or Assume Identity | | | Bypass Protection Mechanism | | | Hide Activities | | | Alter Execution Logic | | | Quality Degradation | | | Unexpected State | | | Varies by Context | | | Increase Analytical Complexity | It is more difficult for humans or tools to analyze the product's code, documentation, and other artifacts understand how the product works or is intended to work, which can make it more difficult to find and fix vulnerabilities. | | Reduce Maintainability | | | Reduce Performance | | | Reduce Reliability | | | Other | | ### TechnologyClassEnumeration The TechnologyClassEnumeration simple type contains a list of values corresponding to different classes of technologies. The value "Not Technology-Specific" is used to indicate that the entry is not limited to a small set of technologies, i.e., it can appear in many different technologies. | Value | Notes | | --- | --- | | Client Server | Represents technology involving a distributed application but for the purposes of CWE does not leverage a web browser. | | Cloud Computing | Represents technology that involves data storage and computing power being made available to multiple users via the internet instead of using local systems, without the need for users to perform all system management themselves. | | ICS/OT | Represents technology related to Industrial Control Systems (ICS) and Operational Techology (OT), which are often considered to be distinct from Information Technology (IT) systems. | | Mainframe | | | Mobile | | | N-Tier | | | SOA | Represents technology related to Service-oriented architecture (SOA). | | System on Chip | Represents technology that integrates all components of a computer within a single integrated circuit, to include FPGA and ASIC. | | Web Based | Represents technology that involves applications or single-page sites that leverage a web browser to support client interactions. | | Not Technology-Specific | Used to indicate that the entry is not limited to a small set of technologies, i.e., it can appear in many different technologies. | ### TechnologyNameEnumeration The TechnologyNameEnumeration simple type contains a list of values corresponding to different technologies. A technology represents a generally accepted feature of a system and often refers to a high-level functional component within a system. Within this context, "IP" stands for "Intellectual Property" and is the term used to distinguish unique blocks within a System on Chip, with each block potentially coming from a different source. | Value | Notes | | --- | --- | | AI/ML | Represents technology related to Artificial Intelligence (AI) and Machine Learning (ML) systems. Note: terminology in this space is inconsistently used, but the AI WG agreed on this usage for CWE 4.15. | | Web Server | | | Database Server | | | Accelerator Hardware | hardware Intellectual Property (IP) dedicated to offload a specific workload to enhance performance: DSP, packet processing, mathematical, compression, etc. | | Analog and Mixed Signal Hardware | hardware Intellectual Property (IP) that controls/senses the electricals for communication which receives/transmits signals conditioned outside of a system’s digital domain. | | Audio/Video Hardware | hardware Intellectual Property (IP) designed to manipulate audio/video data: coders/decoders, speech recognition, format converters, etc. | | Bus/Interface Hardware | hardware Intellectual Property (IP) implementing an interconnect among elements in a computing system: I2C, PCIe, DDR, MMC, USB, GPIO, NoC, etc. | | Clock/Counter Hardware | hardware Intellectual Property (IP) reflecting the passage of time in oscillations or human units: Real Time Clock, Watchdog, Monotonic Counter, etc. | | Communication Hardware | hardware Intellectual Property (IP) designed to transmit/receive information: Modulator/Demodulator, GPS, 802.11, Bluetooth, CDMA/DSM, etc. | | Controller Hardware | hardware Intellectual Property (IP) circuit hard-wired (e.g., an FSM) to react in a closed-loop control system or other limited context, to control another entity: Arbiter, APIC, USB, Peripheral, Memory, Storage, etc. | | Memory Hardware | hardware Intellectual Property (IP) implementing volatile (transient) data storage: DRAM, SRAM, etc. | | Microcontroller Hardware | hardware Intellectual Property (IP) implementing a specialized processor acting as a programmable controller. | | Network on Chip Hardware | | | Power Management Hardware | hardware Intellectual Property (IP) that controls and/or monitors the power state of a system: voltage regulators, power controllers, power monitors, etc. | | Processor Hardware | hardware Intellectual Property (IP) implementing a general-purpose computing engine: CPU, GPU, RISC, CISC, etc. | | Security Hardware | hardware Intellectual Property (IP), including hardware security modules (HSM), designed to protect assets: cryptography, auth, tamper detection, etc. | | Sensor Hardware | | | Storage Hardware | | | Test/Debug Hardware | hardware Intellectual Property (IP) designed to verify functionality and identify root cause of defects: JTAG, BIST, boundary scan, pattern generator, etc. | | Other | | ### UsageEnumeration The UsageEnumeration simple type is used for whether this CWE entry is supported for mapping. | Value | Notes | | --- | --- | | Discouraged | this CWE ID should not be used to map to real-world vulnerabilities | | Prohibited | this CWE ID must not be used to map to real-world vulnerabilities | | Allowed | this CWE ID may be used to map to real-world vulnerabilities | | Allowed-with-Review | this CWE ID could be used to map to real-world vulnerabilities in limited situations requiring careful review | ### ViewTypeEnumeration The ViewTypeEnumeration simple type defines the different types of views that can be found within CWE. A graph is a hierarchical representation of weaknesses based on a specific vantage point that a user may take. The hierarchy often starts with a category, followed by a class/base weakness, and ends with a variant weakness. In addition to graphs, a view can be a slice, which is a flat list of entries that does not specify any relationships between those entries. An explicit slice is a subset... | Value | Notes | | --- | --- | | Implicit | | | Explicit | | | Graph | | ## references/cwe-weakness-index.md # CWE Weakness Index Generated from the local CWE catalog. Search this file first, then use `scripts/cwe_lookup.py --id ` for complete detail. | CWE | Name | Abstraction | Status | Mapping | Phases | Functional Areas | Parent IDs | View IDs | | --- | --- | --- | --- | --- | --- | --- | --- | --- | | CWE-5 | J2EE Misconfiguration: Data Transmission Without Encryption | Variant | Draft | Allowed | Implementation, Operation | | CWE-319 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-6 | J2EE Misconfiguration: Insufficient Session-ID Length | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-334 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-7 | J2EE Misconfiguration: Missing Custom Error Page | Variant | Incomplete | Allowed | Implementation | | CWE-756 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-8 | J2EE Misconfiguration: Entity Bean Declared Remote | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-668 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-9 | J2EE Misconfiguration: Weak Access Permissions for EJB Methods | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-266 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-11 | ASP.NET Misconfiguration: Creating Debug Binary | Variant | Draft | Allowed | Build and Compilation, Implementation | | CWE-489 | CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-12 | ASP.NET Misconfiguration: Missing Custom Error Page | Variant | Draft | Allowed | Implementation, Operation | | CWE-756 | CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-13 | ASP.NET Misconfiguration: Password in Configuration File | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-260 | CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-14 | Compiler Removal of Code to Clear Buffers | Variant | Draft | Allowed | Build and Compilation, Implementation | | CWE-733 | CWE-658, CWE-659, CWE-700, CWE-702, CWE-711, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-15 | External Control of System or Configuration Setting | Base | Incomplete | Allowed | Implementation | | CWE-642, CWE-610, CWE-20 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-20 | Improper Input Validation | Class | Stable | Discouraged | Architecture and Design, Implementation | | CWE-707 | CWE-635, CWE-700, CWE-701, CWE-702, CWE-711, CWE-734, CWE-750, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1154, CWE-1200, CWE-1337, CWE-1344, CWE-1350, CWE-1358, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1450, CWE-2000 | | CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Base | Stable | Allowed-with-Review | Implementation | File Processing | CWE-706, CWE-706 | CWE-629, CWE-635, CWE-677, CWE-699, CWE-702, CWE-711, CWE-734, CWE-800, CWE-809, CWE-868, CWE-884, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1026, CWE-1128, CWE-1178, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-23 | Relative Path Traversal | Base | Draft | Allowed | Implementation | File Processing | CWE-22, CWE-22, CWE-22 | CWE-677, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-24 | Path Traversal: '../filedir' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-25 | Path Traversal: '/../filedir' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-26 | Path Traversal: '/dir/../filename' | Variant | Draft | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-27 | Path Traversal: 'dir/../../filename' | Variant | Draft | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-28 | Path Traversal: '..\filedir' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-29 | Path Traversal: '\..\filename' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-30 | Path Traversal: '\dir\..\filename' | Variant | Draft | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-31 | Path Traversal: 'dir\..\..\filename' | Variant | Draft | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-32 | Path Traversal: '...' (Triple Dot) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-33 | Path Traversal: '....' (Multiple Dot) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-34 | Path Traversal: '....//' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-35 | Path Traversal: '.../...//' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-23 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-36 | Absolute Path Traversal | Base | Draft | Allowed | Implementation | File Processing | CWE-22, CWE-22, CWE-22 | CWE-677, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1305, CWE-1340, CWE-1400, CWE-1450, CWE-2000 | | CWE-37 | Path Traversal: '/absolute/pathname/here' | Variant | Draft | Allowed | Implementation | File Processing | CWE-36, CWE-160 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-38 | Path Traversal: '\absolute\pathname\here' | Variant | Draft | Allowed | Implementation | File Processing | CWE-36 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-39 | Path Traversal: 'C:dirname' | Variant | Draft | Allowed | Implementation | File Processing | CWE-36 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-40 | Path Traversal: '\\UNC\share\name\' (Windows UNC Share) | Variant | Draft | Allowed | Implementation | File Processing | CWE-36 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-41 | Improper Resolution of Path Equivalence | Base | Incomplete | Allowed | Implementation | File Processing | CWE-706, CWE-863, CWE-1390 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-42 | Path Equivalence: 'filename.' (Trailing Dot) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41, CWE-162 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-43 | Path Equivalence: 'filename....' (Multiple Trailing Dot) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-42, CWE-163 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-44 | Path Equivalence: 'file.name' (Internal Dot) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-45 | Path Equivalence: 'file...name' (Multiple Internal Dot) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-44, CWE-165 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-46 | Path Equivalence: 'filename ' (Trailing Space) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41, CWE-162 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-47 | Path Equivalence: ' filename' (Leading Space) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-48 | Path Equivalence: 'file name' (Internal Whitespace) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-49 | Path Equivalence: 'filename/' (Trailing Slash) | Variant | Incomplete | Allowed | Implementation, Operation | File Processing | CWE-41, CWE-162 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-50 | Path Equivalence: '//multiple/leading/slash' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41, CWE-161 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-51 | Path Equivalence: '/multiple//internal/slash' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-52 | Path Equivalence: '/multiple/trailing/slash//' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41, CWE-163 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-53 | Path Equivalence: '\multiple\\internal\backslash' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41, CWE-165 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-54 | Path Equivalence: 'filedir\' (Trailing Backslash) | Variant | Incomplete | Allowed | Implementation, Porting | File Processing | CWE-41, CWE-162 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-55 | Path Equivalence: '/./' (Single Dot Directory) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-56 | Path Equivalence: 'filedir*' (Wildcard) | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41, CWE-155 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-57 | Path Equivalence: 'fakedir/../realdir/filename' | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-58 | Path Equivalence: Windows 8.3 Filename | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-41 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-59 | Improper Link Resolution Before File Access ('Link Following') | Base | Draft | Allowed | Implementation | File Processing | CWE-706, CWE-706 | CWE-635, CWE-677, CWE-699, CWE-702, CWE-734, CWE-800, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1178, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-61 | UNIX Symbolic Link (Symlink) Following | Compound | Incomplete | Allowed | Implementation | File Processing | CWE-59 | CWE-678, CWE-702, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-62 | UNIX Hard Link | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-59 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-64 | Windows Shortcut Following (.LNK) | Variant | Incomplete | Allowed | Operation | File Processing | CWE-59 | CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-65 | Windows Hard Link | Variant | Incomplete | Allowed | Implementation, Operation | File Processing | CWE-59 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-66 | Improper Handling of File Names that Identify Virtual Resources | Base | Draft | Allowed | Implementation, Operation | File Processing | CWE-706 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-67 | Improper Handling of Windows Device Names | Variant | Incomplete | Allowed | Implementation, Operation | File Processing | CWE-66 | CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1133, CWE-1154, CWE-1400, CWE-2000 | | CWE-69 | Improper Handling of Windows ::DATA Alternate Data Stream | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-66 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-71 | DEPRECATED: Apple '.DS_Store' | Variant | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-72 | Improper Handling of Apple HFS+ Alternate Data Stream Path | Variant | Incomplete | Allowed | Implementation | File Processing | CWE-66 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-73 | External Control of File Name or Path | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-642, CWE-610, CWE-20 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-702, CWE-711, CWE-750, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Class | Incomplete | Discouraged | Implementation | | CWE-707 | CWE-702, CWE-711, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-75 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) | Class | Draft | Discouraged | Implementation | | CWE-74 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-2000 | | CWE-76 | Improper Neutralization of Equivalent Special Elements | Base | Draft | Allowed | Implementation | | CWE-75 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | Class | Draft | Allowed-with-Review | Implementation | | CWE-74, CWE-74 | CWE-629, CWE-700, CWE-702, CWE-711, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1178, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Base | Stable | Allowed | Implementation | Program Invocation | CWE-77, CWE-74, CWE-77, CWE-77 | CWE-629, CWE-635, CWE-677, CWE-699, CWE-702, CWE-711, CWE-734, CWE-750, CWE-800, CWE-809, CWE-844, CWE-868, CWE-884, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1128, CWE-1133, CWE-1154, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Base | Stable | Allowed | Implementation | | CWE-74, CWE-74 | CWE-629, CWE-635, CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-750, CWE-800, CWE-809, CWE-884, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1128, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Variant | Incomplete | Allowed | Implementation | | CWE-79 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-81 | Improper Neutralization of Script in an Error Message Web Page | Variant | Incomplete | Allowed | Implementation, Operation | | CWE-79 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page | Variant | Incomplete | Allowed | Implementation | | CWE-83 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | Variant | Draft | Allowed | Implementation | | CWE-79 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-84 | Improper Neutralization of Encoded URI Schemes in a Web Page | Variant | Draft | Allowed | Implementation | | CWE-79 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-85 | Doubled Character XSS Manipulations | Variant | Draft | Allowed | Implementation | | CWE-79 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | Variant | Draft | Allowed | Implementation | | CWE-79, CWE-436 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-87 | Improper Neutralization of Alternate XSS Syntax | Variant | Draft | Allowed | Implementation | | CWE-79 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | Base | Draft | Allowed | Implementation | Program Invocation | CWE-77, CWE-74, CWE-77, CWE-77 | CWE-661, CWE-677, CWE-699, CWE-702, CWE-734, CWE-809, CWE-868, CWE-884, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1154, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Base | Stable | Allowed | Implementation | | CWE-943, CWE-74 | CWE-629, CWE-635, CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-750, CWE-800, CWE-809, CWE-884, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1128, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1450, CWE-2000 | | CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | Base | Draft | Allowed | Implementation | | CWE-943 | CWE-629, CWE-677, CWE-699, CWE-702, CWE-809, CWE-884, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1026, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-91 | XML Injection (aka Blind XPath Injection) | Base | Draft | Allowed-with-Review | Implementation | | CWE-74, CWE-74 | CWE-629, CWE-677, CWE-699, CWE-702, CWE-711, CWE-809, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1081, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-92 | DEPRECATED: Improper Sanitization of Custom Special Characters | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | Base | Draft | Allowed | Implementation | | CWE-74 | CWE-629, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-94 | Improper Control of Generation of Code ('Code Injection') | Base | Draft | Allowed-with-Review | Implementation | | CWE-74, CWE-74, CWE-913 | CWE-635, CWE-677, CWE-699, CWE-702, CWE-750, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1200, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | Variant | Incomplete | Allowed | Implementation | | CWE-94 | CWE-629, CWE-660, CWE-661, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1178, CWE-1344, CWE-1400, CWE-1448, CWE-1450, CWE-2000 | | CWE-96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') | Base | Draft | Allowed | Implementation | | CWE-94 | CWE-661, CWE-677, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page | Variant | Draft | Allowed | Implementation | | CWE-96 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | Variant | Draft | Allowed | Implementation | | CWE-706, CWE-829 | CWE-629, CWE-661, CWE-702, CWE-711, CWE-800, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-99 | Improper Control of Resource Identifiers ('Resource Injection') | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-74 | CWE-700, CWE-701, CWE-702, CWE-809, CWE-884, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1081, CWE-1128, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-102 | Struts: Duplicate Validation Forms | Variant | Incomplete | Allowed | Implementation | | CWE-694, CWE-1173, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-103 | Struts: Incomplete validate() Method Definition | Variant | Draft | Allowed | Implementation | | CWE-573, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-104 | Struts: Form Bean Does Not Extend Validation Class | Variant | Draft | Allowed | Implementation | | CWE-573, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-105 | Struts: Form Field Without Validator | Variant | Draft | Allowed | Implementation | | CWE-1173, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-106 | Struts: Plug-in Framework not in Use | Variant | Draft | Allowed | Implementation | | CWE-1173, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-107 | Struts: Unused Validation Form | Variant | Draft | Allowed | Implementation, Operation | | CWE-1164, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-108 | Struts: Unvalidated Action Form | Variant | Incomplete | Allowed | Implementation | | CWE-1173, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-109 | Struts: Validator Turned Off | Variant | Draft | Allowed | Implementation | | CWE-1173, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-110 | Struts: Validator Without Form Field | Variant | Draft | Allowed | Implementation, Operation | | CWE-1164, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-111 | Direct Use of Unsafe JNI | Variant | Draft | Allowed | Implementation | | CWE-695, CWE-20 | CWE-660, CWE-700, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-112 | Missing XML Validation | Base | Draft | Allowed | Implementation | | CWE-1286, CWE-20 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | Variant | Incomplete | Allowed | Implementation | | CWE-93, CWE-20, CWE-436 | CWE-700, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-114 | Process Control | Class | Incomplete | Discouraged | Implementation | Program Invocation | CWE-73, CWE-20 | CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-115 | Misinterpretation of Input | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-436 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-116 | Improper Encoding or Escaping of Output | Class | Draft | Allowed-with-Review | Implementation, Operation | | CWE-707 | CWE-702, CWE-750, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1178, CWE-1344, CWE-1400, CWE-1448, CWE-1450, CWE-2000 | | CWE-117 | Improper Output Neutralization for Logs | Base | Draft | Allowed | Implementation | | CWE-116, CWE-20 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-118 | Incorrect Access of Indexable Resource ('Range Error') | Class | Incomplete | Discouraged | Implementation | | CWE-664 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | Class | Stable | Discouraged | Implementation | Memory Management | CWE-118, CWE-20 | CWE-635, CWE-658, CWE-659, CWE-700, CWE-702, CWE-711, CWE-734, CWE-750, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1154, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-2000 | | CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | Base | Incomplete | Allowed-with-Review | Implementation | Memory Management | CWE-787, CWE-119, CWE-787, CWE-787, CWE-20 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-734, CWE-800, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1128, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-1435, CWE-2000 | | CWE-121 | Stack-based Buffer Overflow | Variant | Draft | Allowed | Implementation | Memory Management | CWE-788, CWE-787 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1358, CWE-1400, CWE-1435, CWE-2000 | | CWE-122 | Heap-based Buffer Overflow | Variant | Draft | Allowed | Implementation | Memory Management | CWE-788, CWE-787 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-1424, CWE-1435, CWE-2000 | | CWE-123 | Write-what-where Condition | Base | Draft | Allowed | Implementation | Memory Management | CWE-787, CWE-787, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-124 | Buffer Underwrite ('Buffer Underflow') | Base | Incomplete | Allowed | Implementation | Memory Management | CWE-786, CWE-787 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-125 | Out-of-bounds Read | Base | Draft | Allowed | Implementation | Memory Management | CWE-119, CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1154, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1350, CWE-1358, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-2000 | | CWE-126 | Buffer Over-read | Variant | Draft | Allowed | Implementation | Memory Management | CWE-125, CWE-788 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-127 | Buffer Under-read | Variant | Draft | Allowed | Implementation | Memory Management | CWE-125, CWE-786 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-128 | Wrap-around Error | Base | Incomplete | Allowed | Implementation | | CWE-682 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-129 | Improper Validation of Array Index | Variant | Draft | Allowed | Implementation | Memory Management | CWE-1285, CWE-20 | CWE-658, CWE-659, CWE-702, CWE-734, CWE-800, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1128, CWE-1154, CWE-1178, CWE-1305, CWE-1340, CWE-1400, CWE-1450, CWE-2000 | | CWE-130 | Improper Handling of Length Parameter Inconsistency | Base | Incomplete | Allowed | Implementation | | CWE-240, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-131 | Incorrect Calculation of Buffer Size | Base | Draft | Allowed | Implementation | Memory Management | CWE-682, CWE-682, CWE-682, CWE-682 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-800, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1081, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-132 | DEPRECATED: Miscalculated Null Termination | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-134 | Use of Externally-Controlled Format String | Base | Draft | Allowed | Implementation | Logging, Error Handling, String Processing, Memory Management | CWE-668, CWE-668, CWE-20 | CWE-635, CWE-658, CWE-659, CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-734, CWE-800, CWE-844, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1128, CWE-1133, CWE-1154, CWE-1178, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-135 | Incorrect Calculation of Multi-Byte String Length | Base | Draft | Allowed | Implementation | | CWE-682 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-138 | Improper Neutralization of Special Elements | Class | Draft | Discouraged | Implementation | | CWE-707 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-2000 | | CWE-140 | Improper Neutralization of Delimiters | Base | Draft | Allowed | Implementation | | CWE-138 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-141 | Improper Neutralization of Parameter/Argument Delimiters | Variant | Draft | Allowed | Implementation | | CWE-140 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-142 | Improper Neutralization of Value Delimiters | Variant | Draft | Allowed | Implementation | | CWE-140 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-143 | Improper Neutralization of Record Delimiters | Variant | Draft | Allowed | Implementation | | CWE-140 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-144 | Improper Neutralization of Line Delimiters | Variant | Draft | Allowed | Implementation | | CWE-140 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-145 | Improper Neutralization of Section Delimiters | Variant | Incomplete | Allowed | Implementation | | CWE-140 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-146 | Improper Neutralization of Expression/Command Delimiters | Variant | Incomplete | Allowed | Implementation | | CWE-140 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-147 | Improper Neutralization of Input Terminators | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-148 | Improper Neutralization of Input Leaders | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-149 | Improper Neutralization of Quoting Syntax | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-150 | Improper Neutralization of Escape, Meta, or Control Sequences | Variant | Incomplete | Allowed | Build and Compilation, Implementation | | CWE-138 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1400, CWE-2000 | | CWE-151 | Improper Neutralization of Comment Delimiters | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-152 | Improper Neutralization of Macro Symbols | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-153 | Improper Neutralization of Substitution Characters | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-154 | Improper Neutralization of Variable Name Delimiters | Variant | Incomplete | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-155 | Improper Neutralization of Wildcards or Matching Symbols | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-156 | Improper Neutralization of Whitespace | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-157 | Failure to Sanitize Paired Delimiters | Variant | Draft | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-158 | Improper Neutralization of Null Byte or NUL Character | Variant | Incomplete | Allowed | Implementation | | CWE-138 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-159 | Improper Handling of Invalid Use of Special Elements | Class | Draft | Allowed-with-Review | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-160 | Improper Neutralization of Leading Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-161 | Improper Neutralization of Multiple Leading Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-160 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-162 | Improper Neutralization of Trailing Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-163 | Improper Neutralization of Multiple Trailing Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-162 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-164 | Improper Neutralization of Internal Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-138 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-165 | Improper Neutralization of Multiple Internal Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-164 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-166 | Improper Handling of Missing Special Element | Base | Draft | Allowed | Implementation | | CWE-159, CWE-228 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-167 | Improper Handling of Additional Special Element | Base | Draft | Allowed | Implementation | | CWE-159, CWE-228 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-168 | Improper Handling of Inconsistent Special Elements | Base | Draft | Allowed | Implementation | | CWE-159, CWE-228 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-170 | Improper Null Termination | Base | Incomplete | Allowed | Implementation | | CWE-707, CWE-20 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1081, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-172 | Encoding Error | Class | Draft | Allowed-with-Review | Implementation | | CWE-707 | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-173 | Improper Handling of Alternate Encoding | Variant | Draft | Allowed | Implementation | | CWE-172 | CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-174 | Double Decoding of the Same Data | Variant | Draft | Allowed | Implementation | | CWE-172, CWE-675 | CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-175 | Improper Handling of Mixed Encoding | Variant | Draft | Allowed | Implementation | | CWE-172 | CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-176 | Improper Handling of Unicode Encoding | Variant | Draft | Allowed | Implementation | | CWE-172 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-177 | Improper Handling of URL Encoding (Hex Encoding) | Variant | Draft | Allowed | Implementation | | CWE-172 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-178 | Improper Handling of Case Sensitivity | Base | Incomplete | Allowed | Implementation | File Processing | CWE-706, CWE-706 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-179 | Incorrect Behavior Order: Early Validation | Base | Incomplete | Allowed | Implementation | | CWE-20, CWE-696 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | Variant | Draft | Allowed | Implementation | | CWE-179 | CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-181 | Incorrect Behavior Order: Validate Before Filter | Variant | Draft | Allowed | Implementation | Protection Mechanism | CWE-179 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-182 | Collapse of Data into Unsafe Value | Base | Draft | Allowed | Implementation | | CWE-707 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-183 | Permissive List of Allowed Inputs | Base | Draft | Allowed | Implementation | | CWE-697 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-184 | Incomplete List of Disallowed Inputs | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-693, CWE-1023 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-709, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-185 | Incorrect Regular Expression | Class | Draft | Allowed-with-Review | Implementation | | CWE-697 | CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-186 | Overly Restrictive Regular Expression | Base | Draft | Allowed | Implementation | | CWE-185 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-187 | Partial String Comparison | Variant | Incomplete | Allowed | Implementation | | CWE-1023 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-188 | Reliance on Data/Memory Layout | Base | Draft | Allowed | Implementation | Memory Management | CWE-1105, CWE-435 | CWE-658, CWE-659, CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-190 | Integer Overflow or Wraparound | Base | Stable | Allowed | Implementation | Number Processing, Memory Management, Counters | CWE-682, CWE-682, CWE-20 | CWE-658, CWE-677, CWE-699, CWE-700, CWE-702, CWE-709, CWE-734, CWE-800, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1200, CWE-1337, CWE-1350, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-2000 | | CWE-191 | Integer Underflow (Wrap or Wraparound) | Base | Draft | Allowed | Implementation | | CWE-682, CWE-682 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1400, CWE-2000 | | CWE-192 | Integer Coercion Error | Variant | Incomplete | Allowed | Implementation | | CWE-681 | CWE-658, CWE-659, CWE-660, CWE-702, CWE-734, CWE-868, CWE-1000, CWE-1081, CWE-1154, CWE-1400, CWE-2000 | | CWE-193 | Off-by-one Error | Base | Draft | Allowed | Implementation | | CWE-682, CWE-682 | CWE-658, CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-194 | Unexpected Sign Extension | Variant | Incomplete | Allowed | Implementation | | CWE-681, CWE-681, CWE-681 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-195 | Signed to Unsigned Conversion Error | Variant | Draft | Allowed | Implementation | | CWE-681, CWE-681, CWE-681 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-196 | Unsigned to Signed Conversion Error | Variant | Draft | Allowed | Implementation | | CWE-681, CWE-681, CWE-681 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-197 | Numeric Truncation Error | Base | Incomplete | Allowed | Implementation | | CWE-681, CWE-681, CWE-681 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-198 | Use of Incorrect Byte Ordering | Variant | Draft | Allowed | Implementation | Memory Management | CWE-188 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Class | Draft | Discouraged | Architecture and Design, Implementation | | CWE-668 | CWE-629, CWE-635, CWE-701, CWE-702, CWE-888, CWE-919, CWE-1000, CWE-1003, CWE-1200, CWE-1337, CWE-1344, CWE-1350, CWE-1400, CWE-1430, CWE-1435, CWE-1450, CWE-2000 | | CWE-201 | Insertion of Sensitive Information Into Sent Data | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-200 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-202 | Exposure of Sensitive Information Through Data Queries | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1230 | CWE-677, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-203 | Observable Discrepancy | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-200, CWE-200 | CWE-629, CWE-677, CWE-701, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1194, CWE-1400, CWE-2000 | | CWE-204 | Observable Response Discrepancy | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-203 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-205 | Observable Behavioral Discrepancy | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-203 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-206 | Observable Internal Behavioral Discrepancy | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-205 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-207 | Observable Behavioral Discrepancy With Equivalent Products | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-205 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-208 | Observable Timing Discrepancy | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | Cryptography, Authentication | CWE-203 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-209 | Generation of Error Message Containing Sensitive Information | Base | Draft | Allowed | Architecture and Design, Implementation, Operation, System Configuration | | CWE-200, CWE-200, CWE-755 | CWE-629, CWE-660, CWE-661, CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-750, CWE-800, CWE-809, CWE-844, CWE-868, CWE-884, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-210 | Self-generated Error Message Containing Sensitive Information | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-209 | CWE-677, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-211 | Externally-Generated Error Message Containing Sensitive Information | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | Error Handling | CWE-209 | CWE-661, CWE-677, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-212 | Improper Removal of Sensitive Information Before Storage or Transfer | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-669, CWE-669 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-800, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1358, CWE-1400, CWE-2000 | | CWE-213 | Exposure of Sensitive Information Due to Incompatible Policies | Base | Draft | Allowed | Architecture and Design, Implementation, Policy, Requirements | | CWE-200 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1340, CWE-1344, CWE-1400, CWE-2000 | | CWE-214 | Invocation of Process Using Visible Sensitive Information | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | Program Invocation | CWE-497 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-215 | Insertion of Sensitive Information Into Debugging Code | Base | Draft | Allowed | Implementation | | CWE-200 | CWE-629, CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-928, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-216 | DEPRECATED: Containment Errors (Container Errors) | Class | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-217 | DEPRECATED: Failure to Protect Stored Data from Modification | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-218 | DEPRECATED: Failure to provide confidentiality for stored data | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-219 | Storage of File with Sensitive Data Under Web Root | Variant | Draft | Allowed | Implementation, Operation | | CWE-552 | CWE-702, CWE-711, CWE-809, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-220 | Storage of File With Sensitive Data Under FTP Root | Variant | Draft | Allowed | Architecture and Design, Operation | | CWE-552 | CWE-888, CWE-1000, CWE-1008, CWE-1026, CWE-1400, CWE-2000 | | CWE-221 | Information Loss or Omission | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-664 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-222 | Truncation of Security-relevant Information | Base | Draft | Allowed | Implementation, Operation | | CWE-221 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-223 | Omission of Security-relevant Information | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-221 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-224 | Obscured Security-relevant Information by Alternate Name | Base | Incomplete | Allowed | Implementation, Operation | | CWE-221 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-225 | DEPRECATED: General Information Management Problems | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-226 | Sensitive Information in Resource Not Removed Before Reuse | Base | Draft | Allowed | Implementation | Memory Management, Networking | CWE-459, CWE-212 | CWE-677, CWE-702, CWE-711, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-1432, CWE-2000 | | CWE-228 | Improper Handling of Syntactically Invalid Structure | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-703, CWE-707 | CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-229 | Improper Handling of Values | Base | Incomplete | Allowed | Implementation | | CWE-228 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-230 | Improper Handling of Missing Values | Variant | Draft | Allowed | Implementation | | CWE-229 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-231 | Improper Handling of Extra Values | Variant | Draft | Allowed | Implementation | | CWE-229 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-232 | Improper Handling of Undefined Values | Variant | Draft | Allowed | Implementation | | CWE-229 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-233 | Improper Handling of Parameters | Base | Incomplete | Allowed | Implementation | | CWE-228 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-234 | Failure to Handle Missing Parameter | Variant | Incomplete | Discouraged | Implementation | | CWE-233 | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-235 | Improper Handling of Extra Parameters | Variant | Draft | Allowed | Implementation | | CWE-233 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-236 | Improper Handling of Undefined Parameters | Variant | Draft | Allowed | Implementation | | CWE-233 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-237 | Improper Handling of Structural Elements | Base | Incomplete | Allowed | Implementation | | CWE-228 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-238 | Improper Handling of Incomplete Structural Elements | Variant | Draft | Allowed | Implementation | | CWE-237 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-239 | Failure to Handle Incomplete Element | Variant | Draft | Allowed | Implementation | | CWE-237 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-240 | Improper Handling of Inconsistent Structural Elements | Base | Draft | Allowed | Implementation | | CWE-237, CWE-707 | CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-241 | Improper Handling of Unexpected Data Type | Base | Draft | Allowed | Implementation | | CWE-228 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-242 | Use of Inherently Dangerous Function | Base | Draft | Allowed | Implementation | | CWE-1177 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-700, CWE-702, CWE-734, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-243 | Creation of chroot Jail Without Changing Working Directory | Variant | Draft | Allowed | Implementation | | CWE-573, CWE-669 | CWE-658, CWE-659, CWE-699, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-244 | Improper Clearing of Heap Memory Before Release ('Heap Inspection') | Variant | Draft | Allowed | Implementation | Memory Management | CWE-226 | CWE-658, CWE-659, CWE-700, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-245 | J2EE Bad Practices: Direct Management of Connections | Variant | Draft | Allowed | Implementation | | CWE-695 | CWE-660, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-246 | J2EE Bad Practices: Direct Use of Sockets | Variant | Draft | Allowed | Implementation | | CWE-695 | CWE-660, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-247 | DEPRECATED: Reliance on DNS Lookups in a Security Decision | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-248 | Uncaught Exception | Base | Draft | Allowed | Implementation | | CWE-705, CWE-755, CWE-703, CWE-703 | CWE-659, CWE-660, CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1133, CWE-1178, CWE-1305, CWE-1340, CWE-1400, CWE-1450, CWE-2000 | | CWE-249 | DEPRECATED: Often Misused: Path Manipulation | Variant | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-250 | Execution with Unnecessary Privileges | Base | Draft | Allowed | Architecture and Design, Implementation, Installation, Operation | | CWE-269, CWE-657 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-702, CWE-750, CWE-809, CWE-844, CWE-884, CWE-888, CWE-900, CWE-919, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-1424, CWE-1448, CWE-2000 | | CWE-252 | Unchecked Return Value | Base | Draft | Allowed | Implementation | | CWE-754, CWE-754 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-709, CWE-711, CWE-734, CWE-844, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1128, CWE-1133, CWE-1154, CWE-1178, CWE-1305, CWE-1400, CWE-1450, CWE-2000 | | CWE-253 | Incorrect Check of Function Return Value | Base | Incomplete | Allowed | Implementation | | CWE-573, CWE-754 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-256 | Plaintext Storage of a Password | Base | Incomplete | Allowed | Architecture and Design | | CWE-522 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1026, CWE-1344, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-257 | Storing Passwords in a Recoverable Format | Base | Incomplete | Allowed | Architecture and Design | | CWE-522 | CWE-677, CWE-699, CWE-701, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-2000 | | CWE-258 | Empty Password in Configuration File | Variant | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-260, CWE-521 | CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-259 | Use of Hard-coded Password | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-798, CWE-798, CWE-798 | CWE-700, CWE-702, CWE-711, CWE-750, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1133, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-260 | Password in Configuration File | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-522 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-261 | Weak Encoding for Password | Base | Incomplete | Allowed | Architecture and Design | | CWE-522 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-262 | Not Using Password Aging | Base | Draft | Allowed | Architecture and Design | | CWE-1390 | CWE-677, CWE-699, CWE-701, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-263 | Password Aging with Long Expiration | Base | Draft | Discouraged | Architecture and Design | | CWE-1390 | CWE-677, CWE-699, CWE-701, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-266 | Incorrect Privilege Assignment | Base | Draft | Allowed | Implementation | | CWE-269 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-267 | Privilege Defined With Unsafe Actions | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-269 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-268 | Privilege Chaining | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-269 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1358, CWE-1400, CWE-2000 | | CWE-269 | Improper Privilege Management | Class | Draft | Discouraged | Architecture and Design, Implementation, Operation | | CWE-284 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1200, CWE-1344, CWE-1350, CWE-1358, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1450, CWE-2000 | | CWE-270 | Privilege Context Switching Error | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-269 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-271 | Privilege Dropping / Lowering Errors | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-269 | CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-272 | Least Privilege Violation | Base | Incomplete | Allowed | Implementation, Operation | | CWE-271 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-734, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1133, CWE-1400, CWE-2000 | | CWE-273 | Improper Check for Dropped Privileges | Base | Incomplete | Allowed | Implementation | | CWE-754, CWE-754, CWE-271 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1154, CWE-1400, CWE-2000 | | CWE-274 | Improper Handling of Insufficient Privileges | Base | Draft | Discouraged | Implementation, Operation | | CWE-755, CWE-269 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-276 | Incorrect Default Permissions | Base | Draft | Allowed | Architecture and Design, Implementation, Installation, Operation | | CWE-732, CWE-732 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1133, CWE-1194, CWE-1337, CWE-1344, CWE-1358, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1450, CWE-2000 | | CWE-277 | Insecure Inherited Permissions | Variant | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-732 | CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-278 | Insecure Preserved Inherited Permissions | Variant | Incomplete | Allowed | Architecture and Design, Operation | | CWE-732 | CWE-699, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-279 | Incorrect Execution-Assigned Permissions | Variant | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-732 | CWE-699, CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1400, CWE-2000 | | CWE-280 | Improper Handling of Insufficient Permissions or Privileges | Base | Draft | Allowed | Implementation | | CWE-755 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-281 | Improper Preservation of Permissions | Base | Draft | Allowed | Implementation, Operation | | CWE-732, CWE-732 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-282 | Improper Ownership Management | Class | Draft | Allowed-with-Review | Architecture and Design | | CWE-284 | CWE-701, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-283 | Unverified Ownership | Base | Draft | Allowed | Architecture and Design | | CWE-282 | CWE-677, CWE-699, CWE-701, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-284 | Improper Access Control | Pillar | Incomplete | Discouraged | Architecture and Design, Implementation, Operation | | | CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1026, CWE-1081, CWE-1340, CWE-1344, CWE-1358, CWE-1400, CWE-1435, CWE-1450, CWE-2000 | | CWE-285 | Improper Authorization | Class | Draft | Discouraged | Architecture and Design, Implementation, Operation | | CWE-284, CWE-284 | CWE-629, CWE-700, CWE-701, CWE-702, CWE-711, CWE-750, CWE-800, CWE-809, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1026, CWE-1340, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-286 | Incorrect User Management | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-284 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-287 | Improper Authentication | Class | Draft | Discouraged | Architecture and Design, Implementation | Authentication | CWE-284, CWE-284 | CWE-629, CWE-635, CWE-701, CWE-702, CWE-711, CWE-809, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1200, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1358, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1450, CWE-2000 | | CWE-288 | Authentication Bypass Using an Alternate Path or Channel | Base | Incomplete | Allowed | Architecture and Design | | CWE-306, CWE-284 | CWE-629, CWE-677, CWE-701, CWE-888, CWE-1000, CWE-1008, CWE-1340, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-289 | Authentication Bypass by Alternate Name | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1390 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1400, CWE-1450, CWE-2000 | | CWE-290 | Authentication Bypass by Spoofing | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1390, CWE-287 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-291 | Reliance on IP Address for Authentication | Variant | Incomplete | Allowed | Architecture and Design | | CWE-290, CWE-923 | CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-292 | DEPRECATED: Trusting Self-reported DNS Name | Variant | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-293 | Using Referer Field for Authentication | Variant | Draft | Allowed | Architecture and Design | | CWE-290 | CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-294 | Authentication Bypass by Capture-replay | Base | Incomplete | Allowed | Architecture and Design | | CWE-1390, CWE-287 | CWE-677, CWE-699, CWE-701, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-295 | Improper Certificate Validation | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-287, CWE-287 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-919, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1200, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-296 | Improper Following of a Certificate's Chain of Trust | Base | Draft | Allowed | Implementation | | CWE-295, CWE-573 | CWE-677, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-297 | Improper Validation of Certificate with Host Mismatch | Variant | Incomplete | Allowed | Implementation | | CWE-923, CWE-295 | CWE-702, CWE-888, CWE-919, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-298 | Improper Validation of Certificate Expiration | Variant | Draft | Allowed | Implementation | | CWE-295, CWE-672 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-299 | Improper Check for Certificate Revocation | Base | Draft | Allowed | Implementation | | CWE-295, CWE-404 | CWE-677, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-300 | Channel Accessible by Non-Endpoint | Class | Draft | Discouraged | Architecture and Design | | CWE-923 | CWE-701, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-301 | Reflection Attack in an Authentication Protocol | Base | Draft | Allowed | Architecture and Design | | CWE-1390 | CWE-629, CWE-677, CWE-699, CWE-701, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-302 | Authentication Bypass by Assumed-Immutable Data | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1390, CWE-807 | CWE-677, CWE-701, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-303 | Incorrect Implementation of Authentication Algorithm | Base | Draft | Allowed | Implementation | | CWE-1390 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-304 | Missing Critical Step in Authentication | Base | Draft | Allowed | Implementation | | CWE-303, CWE-573 | CWE-677, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-305 | Authentication Bypass by Primary Weakness | Base | Draft | Allowed | Implementation | | CWE-1390 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-306 | Missing Authentication for Critical Function | Base | Draft | Allowed | Architecture and Design, Operation | | CWE-287, CWE-287 | CWE-677, CWE-699, CWE-701, CWE-800, CWE-809, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1337, CWE-1344, CWE-1350, CWE-1358, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1435, CWE-1450, CWE-2000 | | CWE-307 | Improper Restriction of Excessive Authentication Attempts | Base | Draft | Allowed | Architecture and Design | | CWE-1390, CWE-287, CWE-799 | CWE-677, CWE-699, CWE-701, CWE-711, CWE-800, CWE-809, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-308 | Use of Single-factor Authentication | Base | Draft | Allowed | Architecture and Design | | CWE-1390, CWE-654 | CWE-677, CWE-699, CWE-701, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1026, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-309 | Use of Password System for Primary Authentication | Base | Draft | Allowed | Architecture and Design | | CWE-1390, CWE-654 | CWE-677, CWE-699, CWE-701, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-311 | Missing Encryption of Sensitive Data | Class | Draft | Discouraged | Architecture and Design, Operation | | CWE-693 | CWE-629, CWE-701, CWE-711, CWE-800, CWE-809, CWE-844, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1133, CWE-1340, CWE-1344, CWE-1358, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-312 | Cleartext Storage of Sensitive Information | Base | Draft | Allowed | Architecture and Design | | CWE-311, CWE-311, CWE-922 | CWE-677, CWE-699, CWE-701, CWE-809, CWE-884, CWE-888, CWE-919, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1344, CWE-1358, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-313 | Cleartext Storage in a File or on Disk | Variant | Draft | Allowed | Architecture and Design | | CWE-312 | CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-314 | Cleartext Storage in the Registry | Variant | Draft | Allowed | Architecture and Design | | CWE-312 | CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-315 | Cleartext Storage of Sensitive Information in a Cookie | Variant | Draft | Allowed | Architecture and Design | | CWE-312 | CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-316 | Cleartext Storage of Sensitive Information in Memory | Variant | Draft | Allowed | Architecture and Design | | CWE-312 | CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-317 | Cleartext Storage of Sensitive Information in GUI | Variant | Draft | Allowed | Architecture and Design | | CWE-312 | CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-318 | Cleartext Storage of Sensitive Information in Executable | Variant | Draft | Allowed | Implementation | | CWE-312 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-319 | Cleartext Transmission of Sensitive Information | Base | Draft | Allowed | Architecture and Design, Operation, System Configuration | | CWE-311, CWE-311 | CWE-677, CWE-699, CWE-701, CWE-750, CWE-809, CWE-844, CWE-884, CWE-888, CWE-919, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1133, CWE-1194, CWE-1344, CWE-1358, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-321 | Use of Hard-coded Cryptographic Key | Variant | Draft | Allowed | Architecture and Design | | CWE-798, CWE-798, CWE-798 | CWE-629, CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-322 | Key Exchange without Entity Authentication | Base | Draft | Allowed | Architecture and Design | | CWE-306 | CWE-677, CWE-699, CWE-701, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-323 | Reusing a Nonce, Key Pair in Encryption | Base | Incomplete | Allowed | Architecture and Design | | CWE-344 | CWE-677, CWE-699, CWE-701, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-324 | Use of a Key Past its Expiration Date | Base | Draft | Allowed | Architecture and Design | | CWE-672 | CWE-677, CWE-699, CWE-701, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-325 | Missing Cryptographic Step | Base | Draft | Allowed | Implementation, Requirements | Cryptography | CWE-1240, CWE-573 | CWE-629, CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1026, CWE-1194, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-326 | Inadequate Encryption Strength | Class | Draft | Allowed-with-Review | Architecture and Design | | CWE-693 | CWE-629, CWE-701, CWE-711, CWE-809, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-693 | CWE-701, CWE-702, CWE-711, CWE-750, CWE-800, CWE-809, CWE-868, CWE-884, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1081, CWE-1128, CWE-1133, CWE-1154, CWE-1344, CWE-1358, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-328 | Use of Weak Hash | Base | Draft | Allowed | Architecture and Design | | CWE-326, CWE-327 | CWE-677, CWE-699, CWE-701, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1026, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-329 | Generation of Predictable IV with CBC Mode | Variant | Draft | Allowed | Implementation | Cryptography | CWE-1204, CWE-573 | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-330 | Use of Insufficiently Random Values | Class | Stable | Discouraged | Architecture and Design, Implementation | Cryptography, Authentication, Session Management | CWE-693 | CWE-700, CWE-701, CWE-702, CWE-711, CWE-734, CWE-750, CWE-800, CWE-844, CWE-868, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1133, CWE-1154, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-331 | Insufficient Entropy | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-330, CWE-330 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1154, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-332 | Insufficient Entropy in PRNG | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-331 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1133, CWE-1400, CWE-1450, CWE-2000 | | CWE-333 | Improper Handling of Insufficient Entropy in TRNG | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-331, CWE-755 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-334 | Small Space of Random Values | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-330 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-335 | Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) | Base | Draft | Allowed | Implementation | | CWE-330, CWE-330 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-336 | Same Seed in Pseudo-Random Number Generator (PRNG) | Variant | Draft | Allowed | Implementation | | CWE-335 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1133, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-337 | Predictable Seed in Pseudo-Random Number Generator (PRNG) | Variant | Draft | Allowed | Implementation | | CWE-335 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1133, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-330, CWE-330 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1154, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-339 | Small Seed Space in PRNG | Variant | Draft | Allowed | Implementation | | CWE-335 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-340 | Generation of Predictable Numbers or Identifiers | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-330 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-341 | Predictable from Observable State | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-340 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1358, CWE-1400, CWE-2000 | | CWE-342 | Predictable Exact Value from Previous Values | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-340 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-343 | Predictable Value Range from Previous Values | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-340 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-344 | Use of Invariant Value in Dynamically Changing Context | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-330 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-345 | Insufficient Verification of Data Authenticity | Class | Draft | Discouraged | Architecture and Design, Implementation | | CWE-693 | CWE-701, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-346 | Origin Validation Error | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-345, CWE-345, CWE-284 | CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1344, CWE-1358, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-347 | Improper Verification of Cryptographic Signature | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-345, CWE-345 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-348 | Use of Less Trusted Source | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-345 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-349 | Acceptance of Extraneous Untrusted Data With Trusted Data | Base | Draft | Allowed | Implementation | | CWE-345 | CWE-677, CWE-699, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1358, CWE-1400, CWE-2000 | | CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | Variant | Draft | Allowed | Architecture and Design | | CWE-290, CWE-807 | CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-1450, CWE-2000 | | CWE-351 | Insufficient Type Distinction | Base | Draft | Allowed | Implementation | | CWE-345 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-352 | Cross-Site Request Forgery (CSRF) | Compound | Stable | Allowed | Architecture and Design | | CWE-345, CWE-345 | CWE-629, CWE-635, CWE-678, CWE-750, CWE-800, CWE-809, CWE-884, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1200, CWE-1337, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1450, CWE-2000 | | CWE-353 | Missing Support for Integrity Check | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-345 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-354 | Improper Validation of Integrity Check Value | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-345, CWE-345, CWE-754 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1400, CWE-1424, CWE-2000 | | CWE-356 | Product UI does not Warn User of Unsafe Actions | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-221 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-357 | Insufficient UI Warning of Dangerous Operations | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-693 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-358 | Improperly Implemented Security Check for Standard | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-573, CWE-693 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1358, CWE-1400, CWE-2000 | | CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-200 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-702, CWE-844, CWE-888, CWE-919, CWE-1000, CWE-1008, CWE-1026, CWE-1081, CWE-1133, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-360 | Trust of System Event Data | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-345 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-662 | CWE-635, CWE-658, CWE-659, CWE-660, CWE-701, CWE-702, CWE-734, CWE-750, CWE-800, CWE-844, CWE-868, CWE-888, CWE-900, CWE-919, CWE-1000, CWE-1003, CWE-1081, CWE-1133, CWE-1358, CWE-1387, CWE-1400, CWE-1425, CWE-1450, CWE-2000 | | CWE-363 | Race Condition Enabling Link Following | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-367 | CWE-677, CWE-701, CWE-702, CWE-734, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-364 | Signal Handler Race Condition | Base | Incomplete | Allowed | Implementation | Signals, Interprocess Communication | CWE-362 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-700, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-365 | DEPRECATED: Race Condition in Switch | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-366 | Race Condition within a Thread | Base | Draft | Allowed | Implementation | | CWE-362, CWE-662, CWE-662 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | Base | Incomplete | Allowed | Implementation | | CWE-362, CWE-362 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-368 | Context Switching Race Condition | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-362 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-369 | Divide By Zero | Base | Draft | Allowed | Implementation | | CWE-682, CWE-682, CWE-682, CWE-682 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-734, CWE-844, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-1450, CWE-2000 | | CWE-370 | Missing Check for Certificate Revocation after Initial Check | Variant | Draft | Allowed | Implementation | | CWE-299 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-372 | Incomplete Internal State Distinction | Base | Draft | Discouraged | Implementation | | CWE-664 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-373 | DEPRECATED: State Synchronization Error | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-374 | Passing Mutable Objects to an Untrusted Method | Base | Draft | Allowed | Implementation | | CWE-668 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-375 | Returning a Mutable Object to an Untrusted Caller | Base | Draft | Allowed | Implementation | | CWE-668 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1178, CWE-1400, CWE-2000 | | CWE-377 | Insecure Temporary File | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-668 | CWE-700, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1154, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-378 | Creation of Temporary File With Insecure Permissions | Base | Draft | Allowed | Implementation | | CWE-377 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-379 | Creation of Temporary File in Directory with Insecure Permissions | Base | Incomplete | Allowed | Implementation | | CWE-377 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-382 | J2EE Bad Practices: Use of System.exit() | Variant | Draft | Allowed | Implementation | | CWE-705 | CWE-660, CWE-700, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-1450, CWE-2000 | | CWE-383 | J2EE Bad Practices: Direct Use of Threads | Variant | Draft | Allowed | Implementation | | CWE-695 | CWE-660, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-384 | Session Fixation | Compound | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-610, CWE-610 | CWE-678, CWE-700, CWE-702, CWE-711, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-385 | Covert Timing Channel | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-514 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-386 | Symbolic Name not Mapping to Correct Object | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-706 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-390 | Detection of Error Condition Without Action | Base | Draft | Allowed | Implementation | | CWE-755 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-844, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1305, CWE-1400, CWE-1450, CWE-2000 | | CWE-391 | Unchecked Error Condition | Base | Incomplete | Prohibited | Implementation | | CWE-754, CWE-703, CWE-703 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1154, CWE-1178, CWE-1305, CWE-1340, CWE-1400, CWE-1450, CWE-2000 | | CWE-392 | Missing Report of Error Condition | Base | Draft | Allowed | Implementation | | CWE-755, CWE-684, CWE-703, CWE-703 | CWE-677, CWE-699, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-393 | Return of Wrong Status Code | Base | Draft | Allowed | Implementation | | CWE-684, CWE-703 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-394 | Unexpected Status Code or Return Value | Base | Draft | Allowed | Implementation | | CWE-754 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1178, CWE-1305, CWE-1400, CWE-1450, CWE-2000 | | CWE-395 | Use of NullPointerException Catch to Detect NULL Pointer Dereference | Base | Draft | Allowed | Implementation | | CWE-705, CWE-755 | CWE-660, CWE-677, CWE-699, CWE-700, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-396 | Declaration of Catch for Generic Exception | Base | Draft | Allowed | Implementation | | CWE-705, CWE-755, CWE-221 | CWE-659, CWE-660, CWE-677, CWE-699, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1128, CWE-1400, CWE-1450, CWE-2000 | | CWE-397 | Declaration of Throws for Generic Exception | Base | Draft | Allowed | Implementation | | CWE-705, CWE-221, CWE-703 | CWE-659, CWE-660, CWE-677, CWE-699, CWE-700, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1128, CWE-1133, CWE-1400, CWE-1450, CWE-2000 | | CWE-400 | Uncontrolled Resource Consumption | Class | Draft | Discouraged | Architecture and Design, Implementation, Operation, System Configuration | | CWE-664 | CWE-701, CWE-702, CWE-711, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1200, CWE-1350, CWE-1387, CWE-1400, CWE-1424, CWE-1430, CWE-2000 | | CWE-401 | Missing Release of Memory after Effective Lifetime | Variant | Draft | Allowed | Implementation | Memory Management | CWE-772, CWE-404, CWE-404 | CWE-658, CWE-659, CWE-700, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1305, CWE-1400, CWE-2000 | | CWE-402 | Transmission of Private Resources into a New Sphere ('Resource Leak') | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-668 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-403 | Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak') | Base | Draft | Allowed | Implementation | Program Invocation | CWE-402 | CWE-658, CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-404 | Improper Resource Shutdown or Release | Class | Draft | Allowed-with-Review | Implementation | | CWE-664 | CWE-700, CWE-702, CWE-711, CWE-734, CWE-750, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-405 | Asymmetric Resource Consumption (Amplification) | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-400 | CWE-701, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-406 | Insufficient Control of Network Message Volume (Network Amplification) | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-405 | CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1358, CWE-1400, CWE-2000 | | CWE-407 | Inefficient Algorithmic Complexity | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | Cryptography | CWE-405 | CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1305, CWE-1400, CWE-2000 | | CWE-408 | Incorrect Behavior Order: Early Amplification | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-405, CWE-696 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-405 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-410 | Insufficient Resource Pool | Class | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-664 | CWE-699, CWE-701, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-412 | Unrestricted Externally Accessible Lock | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-667 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-413 | Improper Resource Locking | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-667 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-414 | Missing Lock Check | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-667 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-415 | Double Free | Variant | Draft | Allowed | Implementation | Memory Management | CWE-825, CWE-1341, CWE-672, CWE-672, CWE-672, CWE-666 | CWE-658, CWE-659, CWE-700, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-416 | Use After Free | Variant | Stable | Allowed | Implementation | Memory Management | CWE-825, CWE-672, CWE-672, CWE-672 | CWE-658, CWE-659, CWE-700, CWE-702, CWE-734, CWE-800, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1154, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1350, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1435, CWE-2000 | | CWE-419 | Unprotected Primary Channel | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-923 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-420 | Unprotected Alternate Channel | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-923 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-421 | Race Condition During Access to Alternate Channel | Base | Draft | Allowed | Architecture and Design | Program Invocation | CWE-420, CWE-362 | CWE-677, CWE-699, CWE-701, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-422 | Unprotected Windows Messaging Channel ('Shatter') | Variant | Draft | Allowed | Architecture and Design | | CWE-420, CWE-360 | CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-423 | DEPRECATED: Proxied Trusted Channel | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-424 | Improper Protection of Alternate Path | Class | Draft | Allowed-with-Review | Architecture and Design | | CWE-693, CWE-638 | CWE-701, CWE-888, CWE-1000, CWE-1305, CWE-1340, CWE-1400, CWE-1450, CWE-2000 | | CWE-425 | Direct Request ('Forced Browsing') | Base | Incomplete | Allowed | Implementation, Operation | | CWE-862, CWE-862, CWE-288, CWE-424 | CWE-629, CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-426 | Untrusted Search Path | Base | Stable | Allowed-with-Review | Implementation | Program Invocation, Code Libraries | CWE-642, CWE-668, CWE-673 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-750, CWE-800, CWE-868, CWE-1000, CWE-1003, CWE-1008, CWE-1200, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-427 | Uncontrolled Search Path Element | Base | Draft | Allowed-with-Review | Implementation | Program Invocation, Code Libraries | CWE-668, CWE-668 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1400, CWE-1450, CWE-2000 | | CWE-428 | Unquoted Search Path or Element | Base | Draft | Allowed | Implementation | Program Invocation | CWE-668, CWE-668 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1081, CWE-1400, CWE-2000 | | CWE-430 | Deployment of Wrong Handler | Base | Incomplete | Allowed | Implementation | | CWE-691 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-431 | Missing Handler | Base | Draft | Allowed | Implementation | | CWE-691 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-432 | Dangerous Signal Handler not Disabled During Sensitive Operations | Base | Draft | Allowed | Implementation | | CWE-364 | CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-433 | Unparsed Raw Web Content Delivery | Variant | Incomplete | Allowed | Implementation, Operation | | CWE-219 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-434 | Unrestricted Upload of File with Dangerous Type | Base | Draft | Allowed | Architecture and Design, Implementation | File Processing | CWE-669, CWE-669 | CWE-629, CWE-661, CWE-677, CWE-699, CWE-701, CWE-702, CWE-800, CWE-809, CWE-884, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1128, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1358, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-435 | Improper Interaction Between Multiple Correctly-Behaving Entities | Pillar | Draft | Discouraged | Architecture and Design, Implementation, Operation | | | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-436 | Interpretation Conflict | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-435 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1400, CWE-1450, CWE-2000 | | CWE-437 | Incomplete Model of Endpoint Features | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-436 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-439 | Behavioral Change in New Version or Environment | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-435 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-440 | Expected Behavior Violation | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-684 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | Class | Draft | Allowed-with-Review | Architecture and Design | | CWE-610 | CWE-701, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1194, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-443 | DEPRECATED: HTTP response splitting | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | Base | Incomplete | Allowed | Implementation | | CWE-436, CWE-436 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-446 | UI Discrepancy for Security Feature | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-684 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-447 | Unimplemented or Unsupported Feature in UI | Base | Draft | Allowed | Implementation | | CWE-446, CWE-671 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-448 | Obsolete Feature in UI | Base | Draft | Allowed | Implementation | | CWE-446 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-449 | The UI Performs the Wrong Action | Base | Incomplete | Allowed | Implementation | | CWE-446 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-450 | Multiple Interpretations of UI Input | Base | Draft | Allowed | Implementation | | CWE-357 | CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-451 | User Interface (UI) Misrepresentation of Critical Information | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-684, CWE-221 | CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1081, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-453 | Insecure Default Variable Initialization | Variant | Draft | Allowed | Implementation | | CWE-1188 | CWE-661, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-454 | External Initialization of Trusted Variables or Data Stores | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1419 | CWE-661, CWE-677, CWE-699, CWE-701, CWE-702, CWE-800, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-455 | Non-exit on Failed Initialization | Base | Draft | Allowed | Implementation | | CWE-665, CWE-705, CWE-636 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-456 | Missing Initialization of a Variable | Variant | Draft | Allowed | Implementation | | CWE-909, CWE-665, CWE-665 | CWE-702, CWE-800, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1040, CWE-1128, CWE-1154, CWE-1178, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-457 | Use of Uninitialized Variable | Variant | Draft | Allowed | Implementation | | CWE-908, CWE-665, CWE-665 | CWE-658, CWE-659, CWE-661, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1178, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-458 | DEPRECATED: Incorrect Initialization | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-459 | Incomplete Cleanup | Base | Draft | Allowed | Implementation | File Processing | CWE-404, CWE-404 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1305, CWE-1400, CWE-2000 | | CWE-460 | Improper Cleanup on Thrown Exception | Base | Draft | Allowed | Implementation | | CWE-459, CWE-755 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-702, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1178, CWE-1400, CWE-1450, CWE-2000 | | CWE-462 | Duplicate Key in Associative List (Alist) | Variant | Incomplete | Allowed | Implementation | | CWE-694 | CWE-658, CWE-659, CWE-660, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-463 | Deletion of Data Structure Sentinel | Base | Incomplete | Allowed | Implementation | | CWE-707 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-464 | Addition of Data Structure Sentinel | Base | Incomplete | Allowed | Implementation | | CWE-138 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-466 | Return of Pointer Value Outside of Expected Range | Base | Draft | Allowed | Implementation | Memory Management | CWE-119, CWE-20 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-700, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-467 | Use of sizeof() on a Pointer Type | Variant | Draft | Allowed | Implementation | | CWE-131 | CWE-658, CWE-659, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-468 | Incorrect Pointer Scaling | Base | Incomplete | Allowed | Implementation | | CWE-682 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-884, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-469 | Use of Pointer Subtraction to Determine Size | Base | Draft | Allowed | Implementation | | CWE-682 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-913, CWE-913, CWE-610, CWE-20 | CWE-660, CWE-661, CWE-677, CWE-699, CWE-700, CWE-701, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-471 | Modification of Assumed-Immutable Data (MAID) | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-664 | CWE-677, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-472 | External Control of Assumed-Immutable Web Parameter | Base | Draft | Allowed | Implementation | | CWE-642, CWE-471 | CWE-629, CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-473 | PHP External Variable Modification | Variant | Draft | Allowed | Implementation | | CWE-471 | CWE-661, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-474 | Use of Function with Inconsistent Implementations | Base | Draft | Allowed | Implementation | | CWE-758 | CWE-658, CWE-661, CWE-677, CWE-699, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-475 | Undefined Behavior for Input to API | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-573 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-476 | NULL Pointer Dereference | Base | Stable | Allowed | Implementation | | CWE-710, CWE-754, CWE-754 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-734, CWE-800, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1200, CWE-1305, CWE-1337, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1450, CWE-2000 | | CWE-477 | Use of Obsolete Function | Base | Draft | Allowed | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1040, CWE-1178, CWE-1305, CWE-1400, CWE-1450, CWE-2000 | | CWE-478 | Missing Default Case in Multiple Condition Expression | Base | Draft | Allowed | Implementation | | CWE-1023 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1305, CWE-1400, CWE-1450, CWE-2000 | | CWE-479 | Signal Handler Use of a Non-reentrant Function | Variant | Draft | Allowed | Implementation | | CWE-828, CWE-663 | CWE-658, CWE-659, CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-480 | Use of Incorrect Operator | Base | Draft | Allowed | Implementation | | CWE-670 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1154, CWE-1305, CWE-1400, CWE-2000 | | CWE-481 | Assigning instead of Comparing | Variant | Draft | Allowed | Implementation | | CWE-480 | CWE-658, CWE-659, CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-482 | Comparing instead of Assigning | Variant | Draft | Allowed | Implementation | | CWE-480 | CWE-658, CWE-659, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-483 | Incorrect Block Delimitation | Base | Draft | Allowed | Implementation | | CWE-670 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-484 | Omitted Break Statement in Switch | Base | Draft | Allowed | Implementation | | CWE-710, CWE-670 | CWE-658, CWE-659, CWE-660, CWE-661, CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1040, CWE-1305, CWE-1400, CWE-1450, CWE-2000 | | CWE-486 | Comparison of Classes by Name | Variant | Draft | Allowed | Implementation | | CWE-1025 | CWE-660, CWE-700, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-487 | Reliance on Package-level Scope | Base | Incomplete | Allowed | Implementation | | CWE-664 | CWE-660, CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-488 | Exposure of Data Element to Wrong Session | Base | Draft | Allowed | Implementation | | CWE-668 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-489 | Active Debug Code | Base | Draft | Allowed | Build and Compilation, Implementation, Operation | | CWE-710 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1040, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-491 | Public cloneable() Method Without Final ('Object Hijack') | Variant | Draft | Allowed | Implementation | | CWE-668 | CWE-660, CWE-700, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-492 | Use of Inner Class Containing Sensitive Data | Variant | Draft | Allowed | Implementation | | CWE-668 | CWE-660, CWE-700, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-493 | Critical Public Variable Without Final Modifier | Variant | Draft | Allowed | Implementation | | CWE-668 | CWE-659, CWE-660, CWE-700, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-494 | Download of Code Without Integrity Check | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-345, CWE-669, CWE-669 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-750, CWE-800, CWE-844, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-495 | Private Data Structure Returned From A Public Method | Variant | Draft | Allowed | Implementation | | CWE-664 | CWE-658, CWE-659, CWE-660, CWE-700, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-496 | Public Data Assigned to Private Array-Typed Field | Variant | Incomplete | Allowed | Implementation | | CWE-664 | CWE-658, CWE-659, CWE-660, CWE-700, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Base | Incomplete | Allowed | Implementation | | CWE-200 | CWE-677, CWE-699, CWE-700, CWE-702, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-498 | Cloneable Class Containing Sensitive Information | Variant | Draft | Allowed | Implementation | | CWE-668 | CWE-659, CWE-660, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-499 | Serializable Class Containing Sensitive Data | Variant | Draft | Allowed | Implementation | | CWE-668 | CWE-660, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-500 | Public Static Field Not Marked Final | Variant | Draft | Allowed | Implementation | | CWE-493 | CWE-659, CWE-660, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-1450, CWE-2000 | | CWE-501 | Trust Boundary Violation | Base | Draft | Allowed | Architecture and Design | | CWE-664 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-888, CWE-1000, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-502 | Deserialization of Untrusted Data | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-913, CWE-913 | CWE-660, CWE-661, CWE-677, CWE-699, CWE-701, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1081, CWE-1133, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-506 | Embedded Malicious Code | Class | Incomplete | Allowed-with-Review | Bundling, Distribution, Implementation, Installation | | CWE-912 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-507 | Trojan Horse | Base | Incomplete | Allowed | Distribution, Implementation, Operation | | CWE-506 | CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-508 | Non-Replicating Malicious Code | Base | Incomplete | Allowed | Distribution, Implementation, Operation | | CWE-507 | CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-509 | Replicating Malicious Code (Virus or Worm) | Base | Incomplete | Allowed | Implementation, Operation | | CWE-507 | CWE-677, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-510 | Trapdoor | Base | Incomplete | Allowed | Architecture and Design, Distribution, Implementation, Operation | | CWE-506 | CWE-677, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-511 | Logic/Time Bomb | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-506 | CWE-677, CWE-701, CWE-702, CWE-888, CWE-919, CWE-1000, CWE-1400, CWE-2000 | | CWE-512 | Spyware | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-506 | CWE-677, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-514 | Covert Channel | Class | Incomplete | Allowed-with-Review | Implementation, Operation | | CWE-1229 | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-515 | Covert Storage Channel | Base | Incomplete | Allowed | Implementation | | CWE-514 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-516 | DEPRECATED: Covert Timing Channel | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-520 | .NET Misconfiguration: Use of Impersonation | Variant | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-266 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-521 | Weak Password Requirements | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1391, CWE-287 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-522 | Insufficiently Protected Credentials | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-1390, CWE-287, CWE-668 | CWE-629, CWE-701, CWE-702, CWE-711, CWE-884, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1337, CWE-1344, CWE-1350, CWE-1400, CWE-1450, CWE-2000 | | CWE-523 | Unprotected Transport of Credentials | Base | Incomplete | Allowed | Architecture and Design | | CWE-522 | CWE-677, CWE-699, CWE-701, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-524 | Use of Cache Containing Sensitive Information | Base | Incomplete | Allowed | Implementation | | CWE-668 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-525 | Use of Web Browser Cache Containing Sensitive Information | Variant | Incomplete | Allowed | Implementation | | CWE-524 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-526 | Cleartext Storage of Sensitive Information in an Environment Variable | Variant | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-312 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-527 | Exposure of Version-Control Repository to an Unauthorized Control Sphere | Variant | Incomplete | Allowed | Operation | | CWE-552 | CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-528 | Exposure of Core Dump File to an Unauthorized Control Sphere | Variant | Draft | Allowed | Operation | | CWE-552 | CWE-711, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-529 | Exposure of Access Control List Files to an Unauthorized Control Sphere | Variant | Incomplete | Allowed | Operation | | CWE-552 | CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-530 | Exposure of Backup File to an Unauthorized Control Sphere | Variant | Incomplete | Allowed | Operation | | CWE-552 | CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-531 | Inclusion of Sensitive Information in Test Code | Variant | Incomplete | Allowed | Testing | | CWE-540 | CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-532 | Insertion of Sensitive Information into Log File | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-538, CWE-200 | CWE-677, CWE-701, CWE-702, CWE-711, CWE-844, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1133, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-533 | DEPRECATED: Information Exposure Through Server Log Files | Variant | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-534 | DEPRECATED: Information Exposure Through Debug Log Files | Variant | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-535 | Exposure of Information Through Shell Error Message | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-211 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-536 | Servlet Runtime Error Message Containing Sensitive Information | Variant | Incomplete | Allowed | Implementation | | CWE-211 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-537 | Java Runtime Error Message Containing Sensitive Information | Variant | Incomplete | Allowed | Implementation | | CWE-211 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | Base | Draft | Allowed | Implementation, Operation | | CWE-200 | CWE-677, CWE-699, CWE-702, CWE-809, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-539 | Use of Persistent Cookies Containing Sensitive Information | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-552 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-540 | Inclusion of Sensitive Information in Source Code | Base | Incomplete | Allowed | Implementation | | CWE-538 | CWE-677, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-541 | Inclusion of Sensitive Information in an Include File | Variant | Incomplete | Allowed | Implementation | | CWE-540 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-542 | DEPRECATED: Information Exposure Through Cleanup Log Files | Variant | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-543 | Use of Singleton Pattern Without Synchronization in a Multithreaded Context | Variant | Incomplete | Allowed | Implementation | | CWE-820, CWE-662, CWE-662 | CWE-659, CWE-660, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-544 | Missing Standardized Error Handling Mechanism | Base | Draft | Allowed | Architecture and Design | | CWE-755 | CWE-677, CWE-699, CWE-701, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-545 | DEPRECATED: Use of Dynamic Class Loading | Variant | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-546 | Suspicious Comment | Variant | Draft | Allowed | Implementation | | CWE-1078 | CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-547 | Use of Hard-coded, Security-relevant Constants | Base | Draft | Allowed | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-884, CWE-888, CWE-1000, CWE-1040, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-548 | Exposure of Information Through Directory Listing | Variant | Draft | Allowed | Implementation, Operation | | CWE-497 | CWE-702, CWE-711, CWE-888, CWE-928, CWE-1000, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-549 | Missing Password Field Masking | Base | Draft | Allowed | Implementation | | CWE-522 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-550 | Server-generated Error Message Containing Sensitive Information | Variant | Incomplete | Allowed | Implementation | | CWE-209 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | Base | Incomplete | Allowed | Implementation | | CWE-863, CWE-696 | CWE-677, CWE-699, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-552 | Files or Directories Accessible to External Parties | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-668, CWE-668, CWE-285 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-734, CWE-809, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-553 | Command Shell in Externally Accessible Directory | Variant | Incomplete | Allowed | Implementation, Operation | | CWE-552 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-554 | ASP.NET Misconfiguration: Not Using Input Validation Framework | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-1173 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-555 | J2EE Misconfiguration: Plaintext Password in Configuration File | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-260 | CWE-660, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-556 | ASP.NET Misconfiguration: Use of Identity Impersonation | Variant | Incomplete | Allowed | Implementation, Operation | | CWE-266 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-558 | Use of getlogin() in Multithreaded Application | Variant | Draft | Allowed | Implementation | | CWE-663 | CWE-658, CWE-659, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-560 | Use of umask() with chmod-style Argument | Variant | Draft | Allowed | Implementation | | CWE-687 | CWE-658, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-561 | Dead Code | Base | Draft | Allowed | Implementation | | CWE-1164 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1040, CWE-1128, CWE-1178, CWE-1305, CWE-1400, CWE-2000 | | CWE-562 | Return of Stack Variable Address | Base | Draft | Allowed | Implementation | Memory Management | CWE-758 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-888, CWE-1000, CWE-1040, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-563 | Assignment to Variable without Use | Base | Draft | Allowed | Implementation | | CWE-1164 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1040, CWE-1178, CWE-1400, CWE-2000 | | CWE-564 | SQL Injection: Hibernate | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-89, CWE-89, CWE-89 | CWE-702, CWE-888, CWE-928, CWE-1000, CWE-1026, CWE-1305, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-565 | Reliance on Cookies without Validation and Integrity Checking | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-642, CWE-669, CWE-602 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-566 | Authorization Bypass Through User-Controlled SQL Primary Key | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-639 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-567 | Unsynchronized Access to Shared Data in a Multithreaded Context | Base | Draft | Allowed | Implementation | | CWE-820, CWE-662, CWE-662 | CWE-660, CWE-677, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1133, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-568 | finalize() Method Without super.finalize() | Variant | Draft | Allowed | Implementation | | CWE-573, CWE-459 | CWE-660, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-570 | Expression is Always False | Base | Draft | Allowed | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1305, CWE-1400, CWE-2000 | | CWE-571 | Expression is Always True | Base | Draft | Allowed | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1305, CWE-1400, CWE-2000 | | CWE-572 | Call to Thread run() instead of start() | Variant | Draft | Allowed | Implementation | | CWE-821 | CWE-660, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-573 | Improper Following of Specification by Caller | Class | Draft | Allowed-with-Review | Implementation | | CWE-710 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-574 | EJB Bad Practices: Use of Synchronization Primitives | Variant | Draft | Allowed | Implementation | | CWE-695, CWE-821 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-575 | EJB Bad Practices: Use of AWT Swing | Variant | Draft | Allowed | Implementation | | CWE-695 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-576 | EJB Bad Practices: Use of Java I/O | Variant | Draft | Allowed | Implementation | | CWE-695 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-577 | EJB Bad Practices: Use of Sockets | Variant | Draft | Allowed | Implementation | | CWE-573 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-578 | EJB Bad Practices: Use of Class Loader | Variant | Draft | Allowed | Implementation | | CWE-573 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-579 | J2EE Bad Practices: Non-serializable Object Stored in Session | Variant | Draft | Allowed | Implementation | | CWE-573 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-2000 | | CWE-580 | clone() Method Without super.clone() | Variant | Draft | Allowed | Implementation | | CWE-664, CWE-573 | CWE-660, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-581 | Object Model Violation: Just One of Equals and Hashcode Defined | Variant | Draft | Allowed | Implementation | | CWE-573, CWE-697 | CWE-660, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-582 | Array Declared Public, Final, and Static | Variant | Draft | Allowed | Implementation | | CWE-668 | CWE-660, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-583 | finalize() Method Declared Public | Variant | Incomplete | Allowed | Implementation | | CWE-668 | CWE-660, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-584 | Return Inside Finally Block | Base | Draft | Allowed | Implementation | | CWE-705 | CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-585 | Empty Synchronized Block | Variant | Draft | Allowed | Implementation | | CWE-1071 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-586 | Explicit Call to Finalize() | Base | Draft | Allowed | Implementation | | CWE-1076 | CWE-660, CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-587 | Assignment of a Fixed Address to a Pointer | Variant | Draft | Allowed | Implementation | Memory Management | CWE-344, CWE-758 | CWE-658, CWE-659, CWE-699, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-1000, CWE-1040, CWE-1154, CWE-1400, CWE-2000 | | CWE-588 | Attempt to Access Child of a Non-structure Pointer | Variant | Incomplete | Allowed | Implementation | | CWE-704, CWE-758 | CWE-658, CWE-659, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-589 | Call to Non-ubiquitous API | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-474 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1040, CWE-1133, CWE-1400, CWE-2000 | | CWE-590 | Free of Memory not on the Heap | Variant | Incomplete | Allowed | Implementation | Memory Management | CWE-762 | CWE-658, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-591 | Sensitive Data Storage in Improperly Locked Memory | Variant | Draft | Allowed | Implementation | | CWE-413 | CWE-702, CWE-711, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-592 | DEPRECATED: Authentication Bypass Issues | Class | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-593 | Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created | Variant | Draft | Allowed | Implementation | | CWE-666, CWE-1390 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-594 | J2EE Framework: Saving Unserializable Objects to Disk | Variant | Incomplete | Allowed | Implementation | | CWE-1076 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-595 | Comparison of Object References Instead of Object Contents | Variant | Incomplete | Allowed | Implementation | | CWE-1025 | CWE-660, CWE-661, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1133, CWE-1305, CWE-1400, CWE-2000 | | CWE-596 | DEPRECATED: Incorrect Semantic Object Comparison | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-597 | Use of Wrong Operator in String Comparison | Variant | Draft | Allowed | Implementation | | CWE-595, CWE-595, CWE-480 | CWE-660, CWE-661, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1178, CWE-1305, CWE-1400, CWE-2000 | | CWE-598 | Use of HTTP Request With Sensitive Query String | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-201 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-599 | Missing Validation of OpenSSL Certificate | Variant | Incomplete | Allowed | Implementation | | CWE-295 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-600 | Uncaught Exception in Servlet | Variant | Draft | Allowed | Implementation | | CWE-248 | CWE-660, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-610, CWE-610 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-800, CWE-809, CWE-884, CWE-888, CWE-900, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-602 | Client-Side Enforcement of Server-Side Security | Class | Draft | Allowed-with-Review | Architecture and Design | | CWE-693 | CWE-701, CWE-711, CWE-750, CWE-884, CWE-888, CWE-919, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-603 | Use of Client-Side Authentication | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1390, CWE-602 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1358, CWE-1400, CWE-2000 | | CWE-605 | Multiple Binds to the Same Port | Variant | Draft | Allowed | Implementation, Operation | | CWE-675, CWE-666 | CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-606 | Unchecked Input for Loop Condition | Base | Draft | Allowed | Implementation | | CWE-1284 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1128, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-607 | Public Static Final Field References Mutable Object | Variant | Draft | Allowed | Implementation | | CWE-471 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-608 | Struts: Non-private Field in ActionForm Class | Variant | Draft | Allowed | Implementation | | CWE-668 | CWE-660, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-609 | Double-Checked Locking | Base | Draft | Allowed | Implementation | | CWE-667 | CWE-660, CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1133, CWE-1400, CWE-2000 | | CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | Class | Draft | Discouraged | Architecture and Design | | CWE-664 | CWE-701, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-611 | Improper Restriction of XML External Entity Reference | Base | Draft | Allowed | Implementation | | CWE-610, CWE-610 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1450, CWE-2000 | | CWE-612 | Improper Authorization of Index Containing Sensitive Information | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1230 | CWE-677, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-613 | Insufficient Session Expiration | Base | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-672, CWE-672 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | Variant | Draft | Allowed | Implementation | | CWE-319 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-615 | Inclusion of Sensitive Information in Source Code Comments | Variant | Incomplete | Allowed | Implementation | | CWE-540 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-616 | Incomplete Identification of Uploaded File Variables (PHP) | Variant | Incomplete | Allowed | Implementation | | CWE-345 | CWE-661, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-617 | Reachable Assertion | Base | Draft | Allowed | Implementation | | CWE-705, CWE-670 | CWE-658, CWE-660, CWE-677, CWE-699, CWE-702, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1400, CWE-2000 | | CWE-618 | Exposed Unsafe ActiveX Method | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-749 | CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-619 | Dangling Database Cursor ('Cursor Injection') | Base | Incomplete | Allowed | Implementation | | CWE-402 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-620 | Unverified Password Change | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1390 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-621 | Variable Extraction Error | Variant | Incomplete | Allowed | Implementation | | CWE-914 | CWE-661, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-622 | Improper Validation of Function Hook Arguments | Variant | Draft | Allowed | Implementation | | CWE-20 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-623 | Unsafe ActiveX Control Marked Safe For Scripting | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-267 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-624 | Executable Regular Expression Error | Base | Incomplete | Allowed | Implementation | | CWE-77, CWE-77, CWE-77 | CWE-661, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-625 | Permissive Regular Expression | Base | Draft | Allowed | Implementation | | CWE-185 | CWE-661, CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-626 | Null Byte Interaction Error (Poison Null Byte) | Variant | Draft | Allowed | Implementation | | CWE-147, CWE-436 | CWE-661, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-627 | Dynamic Variable Evaluation | Variant | Incomplete | Allowed | Implementation | | CWE-914 | CWE-661, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-628 | Function Call with Incorrectly Specified Arguments | Base | Draft | Allowed | Implementation | | CWE-573 | CWE-677, CWE-699, CWE-702, CWE-734, CWE-884, CWE-888, CWE-1000, CWE-1154, CWE-1178, CWE-1400, CWE-1450, CWE-2000 | | CWE-636 | Not Failing Securely ('Failing Open') | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-657, CWE-755 | CWE-701, CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-637 | Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism') | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-657 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-638 | Not Using Complete Mediation | Class | Draft | Allowed-with-Review | Implementation, Operation | | CWE-657, CWE-862 | CWE-702, CWE-888, CWE-1000, CWE-1358, CWE-1400, CWE-2000 | | CWE-639 | Authorization Bypass Through User-Controlled Key | Base | Incomplete | Allowed | Architecture and Design | | CWE-863, CWE-863, CWE-284 | CWE-629, CWE-677, CWE-699, CWE-701, CWE-711, CWE-809, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1081, CWE-1340, CWE-1344, CWE-1400, CWE-1435, CWE-1450, CWE-2000 | | CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | Base | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-1390, CWE-287 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1008, CWE-1026, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-641 | Improper Restriction of Names for Files and Other Resources | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-99 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-642 | External Control of Critical State Data | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-668 | CWE-701, CWE-702, CWE-750, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') | Base | Incomplete | Allowed | Implementation | | CWE-943, CWE-91 | CWE-677, CWE-702, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | Variant | Incomplete | Allowed | Implementation | | CWE-116 | CWE-702, CWE-711, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-645 | Overly Restrictive Account Lockout Mechanism | Base | Incomplete | Allowed | Architecture and Design | | CWE-287 | CWE-677, CWE-699, CWE-701, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-646 | Reliance on File Name or Extension of Externally-Supplied File | Variant | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-345 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | Variant | Incomplete | Allowed | Implementation, Operation | | CWE-863, CWE-180 | CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1400, CWE-2000 | | CWE-648 | Incorrect Use of Privileged APIs | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-269 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1358, CWE-1400, CWE-2000 | | CWE-649 | Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-345 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-650 | Trusting HTTP Permission Methods on the Server Side | Variant | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-436 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-651 | Exposure of WSDL File Containing Sensitive Information | Variant | Incomplete | Allowed | Implementation, Operation | | CWE-538 | CWE-702, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-652 | Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') | Base | Incomplete | Allowed | Implementation | | CWE-943, CWE-91 | CWE-677, CWE-702, CWE-888, CWE-928, CWE-1000, CWE-1008, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-2000 | | CWE-653 | Improper Isolation or Compartmentalization | Class | Draft | Allowed | Architecture and Design, Implementation | | CWE-657, CWE-693 | CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-654 | Reliance on a Single Factor in a Security Decision | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-657, CWE-693 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-1424, CWE-2000 | | CWE-655 | Insufficient Psychological Acceptability | Class | Draft | Allowed-with-Review | Architecture and Design | | CWE-657, CWE-693 | CWE-701, CWE-888, CWE-1000, CWE-1358, CWE-1400, CWE-1424, CWE-2000 | | CWE-656 | Reliance on Security Through Obscurity | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-657, CWE-693 | CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-657 | Violation of Secure Design Principles | Class | Draft | Discouraged | Architecture and Design | | CWE-710 | CWE-701, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-662 | Improper Synchronization | Class | Draft | Discouraged | Architecture and Design, Implementation | | CWE-664, CWE-691 | CWE-701, CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-663 | Use of a Non-reentrant Function in a Concurrent Context | Base | Draft | Allowed | Implementation | | CWE-662 | CWE-658, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-664 | Improper Control of a Resource Through its Lifetime | Pillar | Draft | Discouraged | Implementation | | | CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1154, CWE-1358, CWE-1400, CWE-2000 | | CWE-665 | Improper Initialization | Class | Draft | Discouraged | Implementation, Operation | | CWE-664 | CWE-702, CWE-734, CWE-750, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-666 | Operation on Resource in Wrong Phase of Lifetime | Class | Draft | Discouraged | Implementation | | CWE-664 | CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-667 | Improper Locking | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-662, CWE-662, CWE-662, CWE-662 | CWE-701, CWE-702, CWE-734, CWE-844, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1081, CWE-1128, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-668 | Exposure of Resource to Wrong Sphere | Class | Draft | Discouraged | Architecture and Design, Implementation, Operation | | CWE-664 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-669 | Incorrect Resource Transfer Between Spheres | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-664 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1358, CWE-1400, CWE-2000 | | CWE-670 | Always-Incorrect Control Flow Implementation | Class | Draft | Allowed-with-Review | Implementation | | CWE-691 | CWE-702, CWE-888, CWE-1000, CWE-1003, CWE-1081, CWE-1400, CWE-2000 | | CWE-671 | Lack of Administrator Control over Security | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-657 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-672 | Operation on a Resource after Expiration or Release | Class | Draft | Allowed-with-Review | Implementation, Operation | | CWE-666 | CWE-702, CWE-800, CWE-884, CWE-888, CWE-919, CWE-1000, CWE-1003, CWE-1128, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-673 | External Influence of Sphere Definition | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation | | CWE-664 | CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-674 | Uncontrolled Recursion | Class | Draft | Allowed-with-Review | Implementation | | CWE-834 | CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1128, CWE-1400, CWE-2000 | | CWE-675 | Multiple Operations on Resource in Single-Operation Context | Class | Draft | Allowed-with-Review | Implementation | | CWE-573 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-676 | Use of Potentially Dangerous Function | Base | Draft | Allowed | Implementation | | CWE-1177 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1040, CWE-1154, CWE-1400, CWE-1450, CWE-2000 | | CWE-680 | Integer Overflow to Buffer Overflow | Compound | Draft | Discouraged | Implementation | Memory Management | CWE-190 | CWE-658, CWE-659, CWE-702, CWE-709, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-681 | Incorrect Conversion between Numeric Types | Base | Draft | Allowed | Implementation | | CWE-704, CWE-704 | CWE-658, CWE-677, CWE-699, CWE-702, CWE-734, CWE-800, CWE-844, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1128, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-682 | Incorrect Calculation | Pillar | Draft | Discouraged | Implementation | | | CWE-702, CWE-734, CWE-750, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1133, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-683 | Function Call With Incorrect Order of Arguments | Variant | Draft | Allowed | Implementation | | CWE-628 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-684 | Incorrect Provision of Specified Functionality | Class | Draft | Allowed-with-Review | Implementation | | CWE-710 | CWE-702, CWE-734, CWE-888, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-685 | Function Call With Incorrect Number of Arguments | Variant | Draft | Allowed | Implementation | | CWE-628 | CWE-658, CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-686 | Function Call With Incorrect Argument Type | Variant | Draft | Allowed | Implementation | | CWE-628 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-687 | Function Call With Incorrectly Specified Argument Value | Variant | Draft | Allowed | Implementation | | CWE-628 | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-688 | Function Call With Incorrect Variable or Reference as Argument | Variant | Draft | Allowed | Implementation | | CWE-628 | CWE-658, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-689 | Permission Race Condition During Resource Copy | Compound | Draft | Allowed | Implementation | | CWE-362 | CWE-658, CWE-678, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-690 | Unchecked Return Value to NULL Pointer Dereference | Compound | Draft | Discouraged | Implementation | | CWE-252 | CWE-658, CWE-659, CWE-702, CWE-709, CWE-844, CWE-868, CWE-1000, CWE-1154, CWE-1178, CWE-1400, CWE-2000 | | CWE-691 | Insufficient Control Flow Management | Pillar | Draft | Discouraged | Architecture and Design, Implementation | | | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-692 | Incomplete Denylist to Cross-Site Scripting | Compound | Draft | Discouraged | Implementation | | CWE-184 | CWE-702, CWE-709, CWE-1000, CWE-1400, CWE-2000 | | CWE-693 | Protection Mechanism Failure | Pillar | Draft | Discouraged | Architecture and Design, Implementation, Operation | | | CWE-702, CWE-888, CWE-1000, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-694 | Use of Multiple Resources with Duplicate Identifier | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-99, CWE-573 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-695 | Use of Low-Level Functionality | Base | Incomplete | Allowed | Implementation | | CWE-573 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-696 | Incorrect Behavior Order | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-691 | CWE-701, CWE-702, CWE-734, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-697 | Incorrect Comparison | Pillar | Incomplete | Discouraged | Implementation | | | CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1081, CWE-1133, CWE-1400, CWE-2000 | | CWE-698 | Execution After Redirect (EAR) | Base | Incomplete | Allowed | Implementation | | CWE-705, CWE-670 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-703 | Improper Check or Handling of Exceptional Conditions | Pillar | Incomplete | Discouraged | Architecture and Design, Implementation, Operation | | | CWE-702, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1008, CWE-1133, CWE-1305, CWE-1340, CWE-1400, CWE-1450, CWE-2000 | | CWE-704 | Incorrect Type Conversion or Cast | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-664 | CWE-658, CWE-659, CWE-702, CWE-734, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1128, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-705 | Incorrect Control Flow Scoping | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-691 | CWE-702, CWE-734, CWE-844, CWE-868, CWE-888, CWE-1000, CWE-1133, CWE-1154, CWE-1178, CWE-1400, CWE-2000 | | CWE-706 | Use of Incorrectly-Resolved Name or Reference | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-664 | CWE-701, CWE-702, CWE-888, CWE-928, CWE-1000, CWE-1003, CWE-1344, CWE-1400, CWE-2000 | | CWE-707 | Improper Neutralization | Pillar | Incomplete | Discouraged | Implementation | | | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1358, CWE-1400, CWE-2000 | | CWE-708 | Incorrect Ownership Assignment | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation | | CWE-282 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-711, CWE-884, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-710 | Improper Adherence to Coding Standards | Pillar | Incomplete | Discouraged | Architecture and Design, Implementation | | | CWE-702, CWE-888, CWE-1000, CWE-1040, CWE-1358, CWE-1400, CWE-2000 | | CWE-732 | Incorrect Permission Assignment for Critical Resource | Class | Draft | Allowed-with-Review | Architecture and Design, Implementation, Installation, Operation | | CWE-285, CWE-668 | CWE-701, CWE-702, CWE-734, CWE-750, CWE-800, CWE-809, CWE-844, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1133, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1350, CWE-1400, CWE-1450, CWE-2000 | | CWE-733 | Compiler Optimization Removal or Modification of Security-critical Code | Base | Incomplete | Allowed | Build and Compilation | | CWE-1038 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-749 | Exposed Dangerous Method or Function | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-800, CWE-888, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-754 | Improper Check for Unusual or Exceptional Conditions | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-703 | CWE-702, CWE-734, CWE-800, CWE-868, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1133, CWE-1178, CWE-1358, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-755 | Improper Handling of Exceptional Conditions | Class | Incomplete | Discouraged | Implementation | | CWE-703 | CWE-702, CWE-868, CWE-888, CWE-1000, CWE-1003, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-756 | Missing Custom Error Page | Base | Incomplete | Allowed | Installation, Operation, System Configuration | | CWE-755 | CWE-677, CWE-699, CWE-884, CWE-888, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-757 | Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') | Base | Incomplete | Allowed | Architecture and Design | | CWE-693 | CWE-677, CWE-701, CWE-888, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-710 | CWE-702, CWE-888, CWE-1000, CWE-1040, CWE-1154, CWE-1305, CWE-1400, CWE-2000 | | CWE-759 | Use of a One-Way Hash without a Salt | Variant | Incomplete | Allowed | Implementation | | CWE-916 | CWE-702, CWE-809, CWE-888, CWE-900, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-760 | Use of a One-Way Hash with a Predictable Salt | Variant | Incomplete | Allowed | Implementation | | CWE-916 | CWE-702, CWE-888, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-761 | Free of Pointer not at Start of Buffer | Variant | Incomplete | Allowed | Implementation | Memory Management | CWE-763, CWE-404 | CWE-658, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1340, CWE-1400, CWE-2000 | | CWE-762 | Mismatched Memory Management Routines | Variant | Incomplete | Allowed | Implementation | Memory Management | CWE-763, CWE-404 | CWE-658, CWE-659, CWE-702, CWE-868, CWE-888, CWE-1000, CWE-1154, CWE-1340, CWE-1400, CWE-2000 | | CWE-763 | Release of Invalid Pointer or Reference | Base | Incomplete | Allowed | Implementation | Memory Management | CWE-404, CWE-404, CWE-404 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-884, CWE-888, CWE-1000, CWE-1003, CWE-1081, CWE-1340, CWE-1400, CWE-2000 | | CWE-764 | Multiple Locks of a Critical Resource | Base | Incomplete | Allowed | Implementation | | CWE-667, CWE-675, CWE-662, CWE-662 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-765 | Multiple Unlocks of a Critical Resource | Base | Incomplete | Allowed | Implementation | | CWE-667, CWE-675 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-766 | Critical Data Element Declared Public | Base | Incomplete | Allowed | Implementation | | CWE-732, CWE-1061 | CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-844, CWE-888, CWE-1000, CWE-1040, CWE-1128, CWE-1133, CWE-1400, CWE-2000 | | CWE-767 | Access to Critical Private Variable via Public Method | Base | Incomplete | Allowed | Implementation | | CWE-668 | CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1178, CWE-1400, CWE-2000 | | CWE-768 | Incorrect Short Circuit Evaluation | Variant | Incomplete | Allowed | Implementation | | CWE-691 | CWE-658, CWE-702, CWE-868, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-769 | DEPRECATED: Uncontrolled File Descriptor Consumption | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-770 | Allocation of Resources Without Limits or Throttling | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation, System Configuration | | CWE-400, CWE-665, CWE-400 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-800, CWE-844, CWE-868, CWE-884, CWE-888, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1133, CWE-1400, CWE-1424, CWE-1435, CWE-2000 | | CWE-771 | Missing Reference to Active Allocated Resource | Base | Incomplete | Allowed | Implementation | | CWE-400 | CWE-677, CWE-699, CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-1424, CWE-2000 | | CWE-772 | Missing Release of Resource after Effective Lifetime | Base | Draft | Allowed | Implementation | | CWE-404, CWE-404, CWE-404, CWE-404 | CWE-677, CWE-699, CWE-702, CWE-800, CWE-868, CWE-884, CWE-888, CWE-900, CWE-919, CWE-1000, CWE-1003, CWE-1081, CWE-1128, CWE-1154, CWE-1200, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-773 | Missing Reference to Active File Descriptor or Handle | Variant | Incomplete | Allowed | Implementation | | CWE-771 | CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-774 | Allocation of File Descriptors or Handles Without Limits or Throttling | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-770 | CWE-702, CWE-888, CWE-1000, CWE-1400, CWE-2000 | | CWE-775 | Missing Release of File Descriptor or Handle after Effective Lifetime | Variant | Incomplete | Allowed | Implementation | | CWE-772, CWE-404, CWE-404 | CWE-702, CWE-888, CWE-1000, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | Base | Draft | Allowed | Implementation, Operation | | CWE-674, CWE-674, CWE-405 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1026, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-777 | Regular Expression without Anchors | Variant | Incomplete | Allowed | Implementation | | CWE-625 | CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-778 | Insufficient Logging | Base | Draft | Allowed | Operation | | CWE-223 | CWE-677, CWE-699, CWE-1000, CWE-1008, CWE-1026, CWE-1305, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-779 | Logging of Excessive Data | Base | Draft | Allowed | Operation | | CWE-400 | CWE-677, CWE-699, CWE-1000, CWE-1008, CWE-1400, CWE-1424, CWE-2000 | | CWE-780 | Use of RSA Algorithm without OAEP | Variant | Incomplete | Allowed | Implementation | | CWE-327 | CWE-702, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-781 | Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code | Variant | Draft | Allowed | Implementation | | CWE-1285 | CWE-658, CWE-659, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-782 | Exposed IOCTL with Insufficient Access Control | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-749 | CWE-658, CWE-659, CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-783 | Operator Precedence Logic Error | Base | Draft | Allowed | Implementation | | CWE-670 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-884, CWE-1000, CWE-1178, CWE-1305, CWE-1400, CWE-2000 | | CWE-784 | Reliance on Cookies without Validation and Integrity Checking in a Security Decision | Variant | Draft | Allowed | Implementation | | CWE-807, CWE-565 | CWE-702, CWE-1000, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-785 | Use of Path Manipulation Function without Maximum-sized Buffer | Variant | Incomplete | Allowed | Implementation | | CWE-676, CWE-120, CWE-20 | CWE-658, CWE-659, CWE-700, CWE-702, CWE-888, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-786 | Access of Memory Location Before Start of Buffer | Base | Incomplete | Discouraged | Implementation | Memory Management | CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-884, CWE-1000, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-787 | Out-of-bounds Write | Base | Draft | Allowed-with-Review | Implementation | Memory Management | CWE-119, CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1350, CWE-1358, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1435, CWE-2000 | | CWE-788 | Access of Memory Location After End of Buffer | Base | Incomplete | Discouraged | Implementation | Memory Management | CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-884, CWE-1000, CWE-1128, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-789 | Memory Allocation with Excessive Size Value | Variant | Draft | Allowed | Implementation | Memory Management | CWE-770 | CWE-658, CWE-659, CWE-702, CWE-1000, CWE-1128, CWE-1154, CWE-1178, CWE-1305, CWE-1400, CWE-2000 | | CWE-790 | Improper Filtering of Special Elements | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-138 | CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-791 | Incomplete Filtering of Special Elements | Base | Incomplete | Allowed | Implementation | | CWE-790 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-792 | Incomplete Filtering of One or More Instances of Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-791 | CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-793 | Only Filtering One Instance of a Special Element | Variant | Incomplete | Allowed | Implementation | | CWE-792 | CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-794 | Incomplete Filtering of Multiple Instances of Special Elements | Variant | Incomplete | Allowed | Implementation | | CWE-792 | CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-795 | Only Filtering Special Elements at a Specified Location | Base | Incomplete | Allowed | Implementation | | CWE-791 | CWE-677, CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-796 | Only Filtering Special Elements Relative to a Marker | Variant | Incomplete | Allowed | Implementation | | CWE-795 | CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-797 | Only Filtering Special Elements at an Absolute Position | Variant | Incomplete | Allowed | Implementation | | CWE-795 | CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-798 | Use of Hard-coded Credentials | Base | Draft | Allowed-with-Review | Architecture and Design | | CWE-1391, CWE-287, CWE-344, CWE-671 | CWE-677, CWE-699, CWE-700, CWE-701, CWE-711, CWE-750, CWE-800, CWE-809, CWE-844, CWE-884, CWE-900, CWE-919, CWE-1000, CWE-1003, CWE-1008, CWE-1128, CWE-1133, CWE-1200, CWE-1305, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1450, CWE-2000 | | CWE-799 | Improper Control of Interaction Frequency | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-691 | CWE-701, CWE-702, CWE-800, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-804 | Guessable CAPTCHA | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-863, CWE-1390 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-800, CWE-1000, CWE-1400, CWE-2000 | | CWE-805 | Buffer Access with Incorrect Length Value | Base | Incomplete | Allowed | Implementation | Memory Management | CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-734, CWE-800, CWE-868, CWE-884, CWE-900, CWE-1000, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-806 | Buffer Access Using Size of Source Buffer | Variant | Incomplete | Allowed | Implementation | Memory Management | CWE-805 | CWE-658, CWE-659, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-807 | Reliance on Untrusted Inputs in a Security Decision | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-693 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-800, CWE-844, CWE-868, CWE-884, CWE-900, CWE-1000, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-820 | Missing Synchronization | Base | Incomplete | Allowed | Implementation | | CWE-662, CWE-662, CWE-662 | CWE-677, CWE-699, CWE-702, CWE-844, CWE-1000, CWE-1081, CWE-1133, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-821 | Incorrect Synchronization | Base | Incomplete | Allowed | Implementation | | CWE-662, CWE-662, CWE-662 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-822 | Untrusted Pointer Dereference | Base | Incomplete | Allowed | Implementation | Memory Management | CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-868, CWE-884, CWE-900, CWE-1000, CWE-1081, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-823 | Use of Out-of-range Pointer Offset | Base | Incomplete | Allowed | Implementation | Memory Management | CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-824 | Access of Uninitialized Pointer | Base | Incomplete | Allowed | Implementation | Memory Management | CWE-119, CWE-119, CWE-119, CWE-119 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1081, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-825 | Expired Pointer Dereference | Base | Incomplete | Allowed | Implementation | Memory Management | CWE-119, CWE-119, CWE-119, CWE-672 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-884, CWE-900, CWE-1000, CWE-1081, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-826 | Premature Release of Resource During Expected Lifetime | Base | Incomplete | Allowed | Implementation | | CWE-666 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-827 | Improper Control of Document Type Definition | Variant | Incomplete | Allowed | Implementation | | CWE-706, CWE-829 | CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-828 | Signal Handler with Functionality that is not Asynchronous-Safe | Variant | Incomplete | Allowed | Implementation | | CWE-364 | CWE-658, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Base | Incomplete | Allowed | Implementation | | CWE-669, CWE-669 | CWE-677, CWE-699, CWE-702, CWE-809, CWE-884, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-830 | Inclusion of Web Functionality from an Untrusted Source | Variant | Incomplete | Allowed | Implementation | | CWE-829 | CWE-702, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-831 | Signal Handler Function Associated with Multiple Signals | Variant | Incomplete | Allowed | Implementation | | CWE-364 | CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-832 | Unlock of a Resource that is not Locked | Base | Incomplete | Allowed | Implementation | | CWE-667 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-833 | Deadlock | Base | Incomplete | Allowed | Implementation | | CWE-667, CWE-662 | CWE-677, CWE-699, CWE-702, CWE-844, CWE-1000, CWE-1305, CWE-1400, CWE-2000 | | CWE-834 | Excessive Iteration | Class | Incomplete | Discouraged | Implementation | | CWE-691 | CWE-702, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | Base | Incomplete | Allowed | Implementation | | CWE-834, CWE-834 | CWE-677, CWE-699, CWE-702, CWE-884, CWE-1000, CWE-1003, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-836 | Use of Password Hash Instead of Password for Authentication | Base | Incomplete | Allowed | Implementation | | CWE-1390 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-837 | Improper Enforcement of a Single, Unique Action | Base | Incomplete | Allowed | Implementation | | CWE-799 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-838 | Inappropriate Encoding for Output Context | Base | Incomplete | Allowed | Implementation | | CWE-116, CWE-116 | CWE-677, CWE-699, CWE-702, CWE-844, CWE-884, CWE-900, CWE-1000, CWE-1003, CWE-1133, CWE-1400, CWE-2000 | | CWE-839 | Numeric Range Comparison Without Minimum Check | Base | Incomplete | Allowed | Implementation | | CWE-1023 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-884, CWE-1000, CWE-1400, CWE-2000 | | CWE-841 | Improper Enforcement of Behavioral Workflow | Class | Incomplete | Allowed | Implementation | | CWE-691 | CWE-699, CWE-702, CWE-884, CWE-900, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-842 | Placement of User into Incorrect Group | Base | Incomplete | Allowed | Implementation, Operation | | CWE-286 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-843 | Access of Resource Using Incompatible Type ('Type Confusion') | Base | Incomplete | Allowed | Implementation | | CWE-704, CWE-704 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1154, CWE-1400, CWE-2000 | | CWE-862 | Missing Authorization | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-285, CWE-284 | CWE-701, CWE-702, CWE-809, CWE-884, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1337, CWE-1340, CWE-1344, CWE-1350, CWE-1387, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-863 | Incorrect Authorization | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Operation | | CWE-285, CWE-284 | CWE-701, CWE-702, CWE-809, CWE-884, CWE-900, CWE-1000, CWE-1003, CWE-1008, CWE-1340, CWE-1344, CWE-1400, CWE-1424, CWE-1425, CWE-1430, CWE-1435, CWE-1450, CWE-2000 | | CWE-908 | Use of Uninitialized Resource | Base | Incomplete | Allowed | Implementation | | CWE-665, CWE-665 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1154, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-909 | Missing Initialization of Resource | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-665, CWE-665 | CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-910 | Use of Expired File Descriptor | Base | Incomplete | Allowed | Implementation | | CWE-672 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1154, CWE-1400, CWE-2000 | | CWE-911 | Improper Update of Reference Count | Base | Incomplete | Allowed | Implementation | | CWE-664 | CWE-658, CWE-659, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-912 | Hidden Functionality | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-684 | CWE-701, CWE-702, CWE-1000, CWE-1358, CWE-1400, CWE-2000 | | CWE-913 | Improper Control of Dynamically-Managed Code Resources | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-664 | CWE-701, CWE-702, CWE-1000, CWE-1003, CWE-1344, CWE-1400, CWE-2000 | | CWE-914 | Improper Control of Dynamically-Identified Variables | Base | Incomplete | Allowed | Implementation | | CWE-99, CWE-913 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-913 | CWE-661, CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-916 | Use of Password Hash With Insufficient Computational Effort | Base | Incomplete | Allowed | Architecture and Design | | CWE-328, CWE-327 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1003, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-77, CWE-74, CWE-77, CWE-77 | CWE-660, CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1003, CWE-1026, CWE-1081, CWE-1305, CWE-1340, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-918 | Server-Side Request Forgery (SSRF) | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-441, CWE-610 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1003, CWE-1337, CWE-1344, CWE-1387, CWE-1400, CWE-1425, CWE-1430, CWE-1435, CWE-1448, CWE-1450, CWE-2000 | | CWE-920 | Improper Restriction of Power Consumption | Base | Incomplete | Allowed | Architecture and Design | | CWE-400, CWE-400 | CWE-677, CWE-699, CWE-701, CWE-919, CWE-1000, CWE-1003, CWE-1400, CWE-1424, CWE-2000 | | CWE-921 | Storage of Sensitive Data in a Mechanism without Access Control | Base | Incomplete | Allowed | Architecture and Design | | CWE-922 | CWE-677, CWE-699, CWE-701, CWE-919, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-922 | Insecure Storage of Sensitive Information | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, System Configuration | | CWE-664 | CWE-701, CWE-702, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-923 | Improper Restriction of Communication Channel to Intended Endpoints | Class | Incomplete | Allowed-with-Review | Architecture and Design | | CWE-284 | CWE-701, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-924 | Improper Enforcement of Message Integrity During Transmission in a Communication Channel | Base | Incomplete | Allowed | Architecture and Design | | CWE-345, CWE-345 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1003, CWE-1008, CWE-1081, CWE-1400, CWE-2000 | | CWE-925 | Improper Verification of Intent by Broadcast Receiver | Variant | Incomplete | Allowed | Architecture and Design | | CWE-940 | CWE-919, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-926 | Improper Export of Android Application Components | Variant | Incomplete | Allowed | Architecture and Design | | CWE-285 | CWE-919, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-927 | Use of Implicit Intent for Sensitive Communication | Variant | Incomplete | Allowed | Architecture and Design | | CWE-285, CWE-668 | CWE-919, CWE-1000, CWE-1344, CWE-1400, CWE-2000 | | CWE-939 | Improper Authorization in Handler for Custom URL Scheme | Base | Incomplete | Allowed | Implementation | | CWE-862, CWE-940 | CWE-677, CWE-699, CWE-702, CWE-919, CWE-1000, CWE-1008, CWE-1400, CWE-2000 | | CWE-940 | Improper Verification of Source of a Communication Channel | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-923, CWE-346 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-919, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-941 | Incorrectly Specified Destination in a Communication Channel | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-923 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-919, CWE-1000, CWE-1008, CWE-1400, CWE-1450, CWE-2000 | | CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-863, CWE-923, CWE-183 | CWE-702, CWE-1000, CWE-1008, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-74 | CWE-702, CWE-1000, CWE-1008, CWE-1026, CWE-1400, CWE-2000 | | CWE-1004 | Sensitive Cookie Without 'HttpOnly' Flag | Variant | Incomplete | Allowed | Implementation | | CWE-732 | CWE-702, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-1007 | Insufficient Visual Distinction of Homoglyphs Presented to User | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-451 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | Base | Incomplete | Allowed | Implementation | | CWE-441, CWE-610, CWE-451 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-1022 | Use of Web Link to Untrusted Target with window.opener Access | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-266 | CWE-702, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-1023 | Incomplete Comparison with Missing Factors | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-697 | CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1024 | Comparison of Incompatible Types | Base | Incomplete | Allowed | Implementation | | CWE-697 | CWE-661, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1025 | Comparison Using Wrong Factors | Base | Incomplete | Allowed | Implementation | | CWE-697 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1037 | Processor Optimization Removal or Modification of Security-critical Code | Base | Incomplete | Allowed | Architecture and Design | | CWE-1038 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1038 | Insecure Automated Optimizations | Class | Draft | Allowed-with-Review | Architecture and Design | | CWE-435, CWE-758 | CWE-701, CWE-1000, CWE-1400, CWE-2000 | | CWE-1039 | Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-693, CWE-697 | CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-1448, CWE-2000 | | CWE-1041 | Use of Redundant Code | Base | Incomplete | Prohibited | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1042 | Static Member Data Element outside of a Singleton Class Element | Variant | Incomplete | Prohibited | Implementation | | CWE-1176 | CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1043 | Data Element Aggregating an Excessively Large Number of Non-Primitive Elements | Base | Incomplete | Prohibited | Implementation | | CWE-1093 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1044 | Architecture with Number of Horizontal Layers Outside of Expected Range | Base | Incomplete | Prohibited | Architecture and Design | | CWE-710 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1128, CWE-1400, CWE-2000 | | CWE-1045 | Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor | Base | Incomplete | Allowed | Implementation | | CWE-1076 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1046 | Creation of Immutable Text Using String Concatenation | Base | Incomplete | Allowed | Implementation | | CWE-1176 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1047 | Modules with Circular Dependencies | Base | Incomplete | Prohibited | Architecture and Design, Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1048 | Invokable Control Element with Large Number of Outward Calls | Base | Incomplete | Prohibited | Architecture and Design, Implementation | | CWE-710 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1049 | Excessive Data Query Operations in a Large Data Table | Base | Incomplete | Allowed | Implementation | | CWE-1176 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1050 | Excessive Platform Resource Consumption within a Loop | Base | Incomplete | Allowed | Implementation | | CWE-405 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1051 | Initialization with Hard-Coded Network Resource Configuration Data | Base | Incomplete | Prohibited | Implementation | | CWE-1419 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-1052 | Excessive Use of Hard-Coded Literals in Initialization | Base | Incomplete | Allowed | Implementation | | CWE-1419 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1053 | Missing Documentation for Design | Base | Incomplete | Prohibited | Architecture and Design, Documentation | | CWE-1059 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1054 | Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer | Base | Incomplete | Prohibited | Implementation | | CWE-1061 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1055 | Multiple Inheritance from Concrete Classes | Base | Incomplete | Prohibited | Implementation | | CWE-1093 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1056 | Invokable Control Element with Variadic Parameters | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1400, CWE-2000 | | CWE-1057 | Data Access Operations Outside of Expected Data Manager Component | Base | Incomplete | Prohibited | Implementation | | CWE-1061 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1058 | Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element | Base | Incomplete | Allowed | Implementation | | CWE-662, CWE-662, CWE-662 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-1059 | Insufficient Technical Documentation | Class | Incomplete | Prohibited | Architecture and Design, Documentation | | CWE-710 | CWE-701, CWE-1000, CWE-1040, CWE-1194, CWE-1358, CWE-1400, CWE-1424, CWE-2000 | | CWE-1060 | Excessive Number of Inefficient Server-Side Data Accesses | Base | Incomplete | Prohibited | Architecture and Design, Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1061 | Insufficient Encapsulation | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-710 | CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1062 | Parent Class with References to Child Class | Base | Incomplete | Prohibited | Implementation | | CWE-1061 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1063 | Creation of Class Instance within a Static Code Block | Base | Incomplete | Prohibited | Implementation | | CWE-1176 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1400, CWE-2000 | | CWE-1064 | Invokable Control Element with Signature Containing an Excessive Number of Parameters | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1065 | Runtime Resource Management Control Element in a Component Built to Run on Application Servers | Base | Incomplete | Prohibited | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1400, CWE-2000 | | CWE-1066 | Missing Serialization Control Element | Base | Incomplete | Prohibited | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1067 | Excessive Execution of Sequential Searches of Data Resource | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1176 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1068 | Inconsistency Between Implementation and Documented Design | Base | Incomplete | Prohibited | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1358, CWE-1400, CWE-2000 | | CWE-1069 | Empty Exception Block | Variant | Incomplete | Allowed | Implementation | | CWE-1071 | CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1400, CWE-2000 | | CWE-1070 | Serializable Data Element Containing non-Serializable Item Elements | Base | Incomplete | Prohibited | Implementation | | CWE-1076 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1071 | Empty Code Block | Base | Incomplete | Allowed | Implementation | | CWE-1164 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1072 | Data Resource Access without Use of Connection Pooling | Base | Incomplete | Prohibited | Architecture and Design, Implementation | | CWE-405 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1073 | Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses | Base | Incomplete | Prohibited | Architecture and Design | | CWE-405 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1074 | Class with Excessively Deep Inheritance | Base | Incomplete | Prohibited | Implementation | | CWE-1093 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1075 | Unconditional Control Flow Transfer outside of Switch Block | Base | Incomplete | Allowed | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1076 | Insufficient Adherence to Expected Conventions | Class | Incomplete | Prohibited | Architecture and Design, Documentation, Implementation | | CWE-710 | CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1077 | Floating Point Comparison with Incorrect Operator | Variant | Incomplete | Allowed | Implementation | | CWE-697 | CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1078 | Inappropriate Source Code Style or Formatting | Class | Incomplete | Prohibited | Implementation | | CWE-1076 | CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1079 | Parent Class without Virtual Destructor Method | Base | Incomplete | Allowed | Implementation | | CWE-1076 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1080 | Source Code File with Excessive Number of Lines of Code | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1082 | Class Instance Self Destruction Control Element | Base | Incomplete | Prohibited | Implementation | | CWE-1076 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1083 | Data Access from Outside Expected Data Manager Component | Base | Incomplete | Prohibited | Implementation | | CWE-1061 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1084 | Invokable Control Element with Excessive File or Data Access Operations | Base | Incomplete | Prohibited | Implementation | | CWE-405 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1085 | Invokable Control Element with Excessive Volume of Commented-out Code | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1086 | Class with Excessive Number of Child Classes | Base | Incomplete | Prohibited | Implementation | | CWE-1093 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1087 | Class with Virtual Method without a Virtual Destructor | Base | Incomplete | Allowed | Implementation | | CWE-1076 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1088 | Synchronous Access of Remote Resource without Timeout | Base | Incomplete | Allowed | Architecture and Design | | CWE-821 | CWE-677, CWE-701, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1089 | Large Data Table with Excessive Number of Indices | Base | Incomplete | Allowed | Implementation | | CWE-405 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1090 | Method Containing Access of a Member Element from Another Class | Base | Incomplete | Prohibited | Implementation | | CWE-1061 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1091 | Use of Object without Invoking Destructor Method | Base | Incomplete | Allowed | Implementation | | CWE-772, CWE-1076 | CWE-677, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1092 | Use of Same Invokable Control Element in Multiple Architectural Layers | Base | Incomplete | Prohibited | Architecture and Design | | CWE-710 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1128, CWE-1400, CWE-2000 | | CWE-1093 | Excessively Complex Data Representation | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-710 | CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1094 | Excessive Index Range Scan for a Data Resource | Base | Incomplete | Prohibited | Implementation | | CWE-405 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1095 | Loop Condition Value Update within the Loop | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1096 | Singleton Class Instance Creation without Proper Locking or Synchronization | Variant | Incomplete | Allowed | Implementation | | CWE-820, CWE-662, CWE-662 | CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1340, CWE-1400, CWE-2000 | | CWE-1097 | Persistent Storable Data Element without Associated Comparison Control Element | Base | Incomplete | Prohibited | Implementation | | CWE-1076, CWE-595 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1098 | Data Element containing Pointer Item without Proper Copy Control Element | Base | Incomplete | Allowed | Implementation | | CWE-1076 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1305, CWE-1400, CWE-2000 | | CWE-1099 | Inconsistent Naming Conventions for Identifiers | Base | Incomplete | Prohibited | Documentation, Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1100 | Insufficient Isolation of System-Dependent Functions | Base | Incomplete | Allowed | Implementation, Porting | | CWE-1061 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1101 | Reliance on Runtime Component in Generated Code | Base | Incomplete | Prohibited | Architecture and Design | | CWE-710 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1102 | Reliance on Machine-Dependent Data Representation | Base | Incomplete | Allowed | Implementation, Porting | | CWE-758 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1103 | Use of Platform-Dependent Third Party Components | Base | Incomplete | Prohibited | Architecture and Design | | CWE-758 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1104 | Use of Unmaintained Third Party Components | Base | Incomplete | Allowed | Architecture and Design | | CWE-1357 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1344, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-1105 | Insufficient Encapsulation of Machine-Dependent Functionality | Base | Incomplete | Prohibited | Implementation, Porting | | CWE-758, CWE-1061 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1106 | Insufficient Use of Symbolic Constants | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1107 | Insufficient Isolation of Symbolic Constant Definitions | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1108 | Excessive Reliance on Global Variables | Base | Incomplete | Allowed | Implementation | | CWE-1076 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1109 | Use of Same Variable for Multiple Purposes | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1110 | Incomplete Design Documentation | Base | Incomplete | Prohibited | Architecture and Design, Documentation | | CWE-1059 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1040, CWE-1358, CWE-1400, CWE-2000 | | CWE-1111 | Incomplete I/O Documentation | Base | Incomplete | Prohibited | Documentation | | CWE-1059 | CWE-677, CWE-699, CWE-1000, CWE-1040, CWE-1358, CWE-1400, CWE-2000 | | CWE-1112 | Incomplete Documentation of Program Execution | Base | Incomplete | Prohibited | Documentation | | CWE-1059 | CWE-677, CWE-699, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1113 | Inappropriate Comment Style | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1114 | Inappropriate Whitespace Style | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1115 | Source Code Element without Standard Prologue | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1116 | Inaccurate Source Code Comments | Base | Incomplete | Allowed | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1117 | Callable with Insufficient Behavioral Summary | Base | Incomplete | Prohibited | Implementation | | CWE-1078 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1118 | Insufficient Documentation of Error Handling Techniques | Base | Incomplete | Prohibited | Documentation | | CWE-1059 | CWE-677, CWE-699, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1119 | Excessive Use of Unconditional Branching | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1120 | Excessive Code Complexity | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-710 | CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1121 | Excessive McCabe Cyclomatic Complexity | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1128, CWE-1400, CWE-2000 | | CWE-1122 | Excessive Halstead Complexity | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1123 | Excessive Use of Self-Modifying Code | Base | Incomplete | Allowed | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1124 | Excessively Deep Nesting | Base | Incomplete | Prohibited | Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1125 | Excessive Attack Surface | Base | Incomplete | Prohibited | Architecture and Design, Implementation | | CWE-1120 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-1450, CWE-2000 | | CWE-1126 | Declaration of Variable with Unnecessarily Wide Scope | Base | Incomplete | Allowed | Implementation | | CWE-710 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1127 | Compilation with Insufficient Warnings or Errors | Base | Incomplete | Allowed | Build and Compilation | | CWE-710 | CWE-677, CWE-699, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1164 | Irrelevant Code | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-710 | CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1173 | Improper Use of Validation Framework | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-20 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1344, CWE-1400, CWE-2000 | | CWE-1174 | ASP.NET Misconfiguration: Improper Model Validation | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-1173 | CWE-702, CWE-1000, CWE-1040, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-1176 | Inefficient CPU Computation | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-405 | CWE-701, CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1177 | Use of Prohibited Code | Class | Incomplete | Allowed-with-Review | Implementation | | CWE-710 | CWE-702, CWE-1000, CWE-1040, CWE-1400, CWE-2000 | | CWE-1187 | DEPRECATED: Use of Uninitialized Resource | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-1188 | Initialization of a Resource with an Insecure Default | Base | Incomplete | Allowed | Implementation, System Configuration | | CWE-1419, CWE-344, CWE-665 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1081, CWE-1400, CWE-2000 | | CWE-1189 | Improper Isolation of Shared Resources on System-on-a-Chip (SoC) | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-653, CWE-668 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1358, CWE-1400, CWE-1432, CWE-2000 | | CWE-1190 | DMA Device Enabled Too Early in Boot Phase | Base | Draft | Allowed | Architecture and Design | | CWE-696 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1191 | On-Chip Debug and Test Interface With Improper Access Control | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1400, CWE-1432, CWE-2000 | | CWE-1192 | Improper Identifier for IP Block used in System-On-Chip (SOC) | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-657 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1193 | Power-On of Untrusted Execution Core Before Enabling Fabric Access Control | Base | Draft | Allowed | Architecture and Design | | CWE-696 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1204 | Generation of Weak Initialization Vector (IV) | Base | Incomplete | Allowed | Implementation | Cryptography | CWE-330 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1209 | Failure to Disable Reserved Bits | Base | Incomplete | Allowed | Architecture and Design, Documentation, Implementation | | CWE-710 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1220 | Insufficient Granularity of Access Control | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1221 | Incorrect Register Defaults or Module Parameters | Base | Incomplete | Allowed | Implementation | | CWE-1419 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1222 | Insufficient Granularity of Address Regions Protected by Register Locks | Variant | Incomplete | Allowed | Architecture and Design | | CWE-1220 | CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1223 | Race Condition for Write-Once Attributes | Base | Incomplete | Allowed | Architecture and Design | | CWE-362 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1224 | Improper Restriction of Write-Once Bit Fields | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1229 | Creation of Emergent Resource | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-664 | CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1230 | Exposure of Sensitive Information Through Metadata | Base | Incomplete | Allowed | Architecture and Design | | CWE-285 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1400, CWE-2000 | | CWE-1231 | Improper Prevention of Lock Bit Modification | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1358, CWE-1400, CWE-1432, CWE-2000 | | CWE-1232 | Improper Lock Behavior After Power State Transition | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-667 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-284, CWE-667 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1358, CWE-1400, CWE-1432, CWE-2000 | | CWE-1234 | Hardware Internal or Debug Modes Allow Override of Locks | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-667 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-1432, CWE-2000 | | CWE-1235 | Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations | Base | Incomplete | Allowed | Implementation | | CWE-400 | CWE-660, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-1424, CWE-2000 | | CWE-1236 | Improper Neutralization of Formula Elements in a CSV File | Base | Incomplete | Allowed | Implementation | | CWE-74, CWE-74 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-1239 | Improper Zeroization of Hardware Register | Variant | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-226, CWE-226 | CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1240 | Use of a Cryptographic Primitive with a Risky Implementation | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-327 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1343, CWE-1400, CWE-1450, CWE-2000 | | CWE-1241 | Use of Predictable Algorithm in Random Number Generator | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-330 | CWE-677, CWE-699, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-1450, CWE-2000 | | CWE-1242 | Inclusion of Undocumented Features or Chicken Bits | Base | Incomplete | Allowed | Architecture and Design, Documentation, Implementation | | CWE-912 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-1424, CWE-2000 | | CWE-1243 | Sensitive Non-Volatile Information Not Protected During Debug | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1263 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1244 | Internal Asset Exposed to Unsafe Debug Access Level or State | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-863 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1400, CWE-1432, CWE-2000 | | CWE-1245 | Improper Finite State Machines (FSMs) in Hardware Logic | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-684 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1246 | Improper Write Handling in Limited-write Non-Volatile Memories | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-400 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-1424, CWE-2000 | | CWE-1247 | Improper Protection Against Voltage and Clock Glitches | Base | Stable | Allowed | Operation | Power, Clock | CWE-1384 | CWE-677, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-1432, CWE-2000 | | CWE-1248 | Semiconductor Defects in Hardware Logic with Security-Sensitive Implications | Base | Incomplete | Allowed | Manufacturing, Operation | | CWE-693 | CWE-677, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1249 | Application-Level Admin Tool with Inconsistent View of Underlying Operating System | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1250 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1250 | Improper Preservation of Consistency Between Independent Representations of Shared State | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-664 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1251 | Mirrored Regions with Different Values | Base | Incomplete | Allowed | Architecture and Design | | CWE-1250 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1252 | CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations | Base | Incomplete | Allowed | Architecture and Design | | CWE-284 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1253 | Incorrect Selection of Fuse Values | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-693 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1254 | Incorrect Comparison Logic Granularity | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-208, CWE-697 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1255 | Comparison Logic is Vulnerable to Power Side-Channel Attacks | Variant | Draft | Allowed | Architecture and Design, Implementation | Power | CWE-1300 | CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1256 | Improper Restriction of Software Interfaces to Hardware Features | Base | Stable | Allowed | Architecture and Design, Implementation | Power, Clock | CWE-285 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1400, CWE-1432, CWE-2000 | | CWE-1257 | Improper Access Control Applied to Mirrored or Aliased Memory Regions | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-212 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1259 | Improper Restriction of Security Token Assignment | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284, CWE-1294 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1260 | Improper Handling of Overlap Between Protected Memory Ranges | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1343, CWE-1400, CWE-1432, CWE-2000 | | CWE-1261 | Improper Handling of Single Event Upsets | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1384 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1262 | Improper Access Control for Register Interface | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-1432, CWE-2000 | | CWE-1263 | Improper Physical Access Control | Class | Incomplete | Allowed-with-Review | Architecture and Design, Manufacturing | | CWE-284 | CWE-701, CWE-1000, CWE-1081, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1264 | Hardware Logic with Insecure De-Synchronization between Control and Data Channels | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-821 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1265 | Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls | Base | Draft | Allowed | Implementation | | CWE-662 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1266 | Improper Scrubbing of Sensitive Data from Decommissioned Device | Base | Incomplete | Allowed | Architecture and Design, Implementation, Policy | | CWE-404 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1267 | Policy Uses Obsolete Encoding | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1268 | Policy Privileges are not Assigned Consistently Between Control and Data Agents | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-266 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1269 | Product Released in Non-Release Configuration | Base | Incomplete | Allowed | Implementation, Integration, Manufacturing | | CWE-693 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1270 | Generation of Incorrect Security Tokens | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284, CWE-1294 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1271 | Uninitialized Value on Reset for Registers Holding Security Settings | Base | Incomplete | Allowed | Implementation | | CWE-909 | CWE-677, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1272 | Sensitive Information Uncleared Before Debug/Power State Transition | Base | Stable | Allowed | Architecture and Design | Power | CWE-226 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1343, CWE-1400, CWE-1432, CWE-2000 | | CWE-1273 | Device Unlock Credential Sharing | Base | Incomplete | Allowed | Integration, Manufacturing | | CWE-200 | CWE-677, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1274 | Improper Access Control for Volatile Memory Containing Boot Code | Base | Stable | Allowed | Architecture and Design | | CWE-284 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1343, CWE-1400, CWE-2000 | | CWE-1275 | Sensitive Cookie with Improper SameSite Attribute | Variant | Incomplete | Allowed | Implementation | | CWE-923 | CWE-702, CWE-1000, CWE-1344, CWE-1400, CWE-1450, CWE-2000 | | CWE-1276 | Hardware Child Block Incorrectly Connected to Parent System | Base | Incomplete | Allowed | Implementation | | CWE-284 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1277 | Firmware Not Updateable | Base | Draft | Allowed | Architecture and Design, Implementation, Requirements | | CWE-1329 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1400, CWE-2000 | | CWE-1278 | Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques | Base | Incomplete | Allowed | Architecture and Design | | CWE-693 | CWE-677, CWE-701, CWE-1000, CWE-1081, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1279 | Cryptographic Operations are run Before Supporting Units are Ready | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-696, CWE-665 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1280 | Access Control Check Implemented After Asset is Accessed | Base | Incomplete | Allowed | Implementation | | CWE-696, CWE-284 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1281 | Sequence of Processor Instructions Leads to Unexpected Behavior | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-691 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1282 | Assumed-Immutable Data is Stored in Writable Memory | Base | Incomplete | Allowed | Implementation | | CWE-668 | CWE-677, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1283 | Mutable Attestation or Measurement Reporting Data | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1284 | Improper Validation of Specified Quantity in Input | Base | Incomplete | Allowed | Implementation | | CWE-20, CWE-20 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1081, CWE-1400, CWE-2000 | | CWE-1285 | Improper Validation of Specified Index, Position, or Offset in Input | Base | Incomplete | Allowed | Implementation | | CWE-20 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1286 | Improper Validation of Syntactic Correctness of Input | Base | Incomplete | Allowed | Implementation | | CWE-20 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1287 | Improper Validation of Specified Type of Input | Base | Incomplete | Allowed | Implementation | | CWE-20 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1288 | Improper Validation of Consistency within Input | Base | Incomplete | Allowed | Implementation | | CWE-20 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1289 | Improper Validation of Unsafe Equivalence in Input | Base | Incomplete | Allowed | Implementation | | CWE-20 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1290 | Incorrect Decoding of Security Identifiers | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-284, CWE-1294 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1291 | Public Key Re-Use for Signing both Debug and Production Code | Base | Draft | Allowed | Implementation | | CWE-693 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1292 | Incorrect Conversion of Security Identifiers | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284, CWE-1294 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1293 | Missing Source Correlation of Multiple Independent Data | Base | Draft | Allowed | Architecture and Design, Implementation, Operation | | CWE-345 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1294 | Insecure Security Identifier Mechanism | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-284 | CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1295 | Debug Messages Revealing Unnecessary Information | Base | Incomplete | Allowed | Implementation | | CWE-200 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1296 | Incorrect Chaining or Granularity of Debug Components | Base | Incomplete | Allowed | Implementation | | CWE-284 | CWE-677, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1297 | Unprotected Confidential Information on Device is Accessible by OSAT Vendors | Base | Incomplete | Allowed | Implementation | | CWE-285 | CWE-677, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1298 | Hardware Logic Contains Race Conditions | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-362 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1299 | Missing Protection Mechanism for Alternate Hardware Interface | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-420, CWE-288 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1300 | Improper Protection of Physical Side Channels | Base | Stable | Allowed | Implementation | Power | CWE-203, CWE-203 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1343, CWE-1400, CWE-1432, CWE-2000 | | CWE-1301 | Insufficient or Incomplete Data Removal within Hardware Component | Base | Incomplete | Allowed | Implementation | | CWE-226 | CWE-677, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1302 | Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1294 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1303 | Non-Transparent Sharing of Microarchitectural Resources | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-1189, CWE-203 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1304 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation | Base | Draft | Allowed | Architecture and Design, Integration | Power | CWE-284 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1310 | Missing Ability to Patch ROM Code | Base | Draft | Allowed | Architecture and Design, Implementation, Integration, Manufacturing | | CWE-1329 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1311 | Improper Translation of Security Attributes by Fabric Bridge | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1312 | Missing Protection for Mirrored Regions in On-Chip Fabric Firewall | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1313 | Hardware Allows Activation of Test or Debug Logic at Runtime | Base | Draft | Allowed | Architecture and Design, Implementation, Integration | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1314 | Missing Write Protection for Parametric Data Values | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-862 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1315 | Improper Setting of Bus Controlling Capability in Fabric End-point | Base | Incomplete | Allowed | Architecture and Design, Implementation, System Configuration | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1316 | Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1317 | Improper Access Control in Fabric Bridge | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1318 | Missing Support for Security Features in On-chip Fabrics or Buses | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-693 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1319 | Improper Protection against Electromagnetic Fault Injection (EM-FI) | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-693 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1320 | Improper Protection for Outbound Error Messages and Alert Signals | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-915, CWE-913 | CWE-702, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-1322 | Use of Blocking Code in Single-threaded, Non-blocking Context | Base | Incomplete | Allowed | Implementation | | CWE-834 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1323 | Improper Management of Sensitive Trace Data | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1324 | DEPRECATED: Sensitive Information Accessible by Physical Probing of JTAG Interface | Base | Deprecated | Prohibited | | | | CWE-604, CWE-2000 | | CWE-1325 | Improperly Controlled Sequential Memory Allocation | Base | Incomplete | Allowed | Implementation | | CWE-770 | CWE-658, CWE-659, CWE-677, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1326 | Missing Immutable Root of Trust in Hardware | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-693 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1327 | Binding to an Unrestricted IP Address | Base | Incomplete | Allowed | System Configuration | | CWE-668 | CWE-677, CWE-699, CWE-1000, CWE-1400, CWE-2000 | | CWE-1328 | Security Version Number Mutable to Older Versions | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-285 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1329 | Reliance on Component That is Not Updateable | Base | Incomplete | Allowed | Architecture and Design, Implementation, Requirements | | CWE-1357, CWE-1357, CWE-664 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-1330 | Remanent Data Readable after Memory Erase | Variant | Draft | Allowed | Architecture and Design, Implementation | | CWE-1301, CWE-1301 | CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1331 | Improper Isolation of Shared Resources in Network On Chip (NoC) | Base | Stable | Allowed | Architecture and Design, Implementation | | CWE-653, CWE-668 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1332 | Improper Handling of Faults that Lead to Instruction Skips | Base | Stable | Allowed | Architecture and Design, Implementation | Power | CWE-1384 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1333 | Inefficient Regular Expression Complexity | Base | Draft | Allowed | Implementation | | CWE-407, CWE-407 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1003, CWE-1400, CWE-2000 | | CWE-1334 | Unauthorized Error Injection Can Degrade Hardware Redundancy | Base | Draft | Allowed | Architecture and Design, Implementation, Integration | | CWE-284 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1335 | Incorrect Bitwise Shift of Integer | Base | Draft | Allowed | Implementation | | CWE-682 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-94 | CWE-660, CWE-661, CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-1448, CWE-2000 | | CWE-1338 | Improper Protections Against Hardware Overheating | Base | Draft | Allowed | Architecture and Design, Implementation | | CWE-693 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1339 | Insufficient Precision or Accuracy of a Real Number | Base | Draft | Allowed | Implementation | | CWE-682 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1341 | Multiple Releases of Same Resource or Handle | Base | Incomplete | Allowed | Implementation | | CWE-675 | CWE-658, CWE-659, CWE-660, CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1342 | Information Exposure through Microarchitectural State after Transient Execution | Base | Incomplete | Allowed | Architecture and Design, Requirements | | CWE-226, CWE-226 | CWE-677, CWE-701, CWE-1000, CWE-1081, CWE-1194, CWE-1400, CWE-2000 | | CWE-1351 | Improper Handling of Hardware Behavior in Exceptionally Cold Environments | Base | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-1384 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1357 | Reliance on Insufficiently Trustworthy Component | Class | Incomplete | Allowed-with-Review | Architecture and Design, Requirements | | CWE-710 | CWE-701, CWE-1000, CWE-1040, CWE-1081, CWE-1194, CWE-1358, CWE-1400, CWE-1424, CWE-2000 | | CWE-1384 | Improper Handling of Physical or Environmental Conditions | Class | Incomplete | Allowed-with-Review | Architecture and Design, Manufacturing | | CWE-703 | CWE-701, CWE-1000, CWE-1194, CWE-1358, CWE-1400, CWE-2000 | | CWE-1385 | Missing Origin Validation in WebSockets | Variant | Incomplete | Allowed | Architecture and Design, Implementation | | CWE-346 | CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1386 | Insecure Operation on Windows Junction / Mount Point | Base | Incomplete | Allowed | Implementation | | CWE-59 | CWE-677, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-2000 | | CWE-1389 | Incorrect Parsing of Numbers with Different Radices | Base | Incomplete | Allowed | Implementation | | CWE-704 | CWE-677, CWE-699, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1390 | Weak Authentication | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-287 | CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-1391 | Use of Weak Credentials | Class | Incomplete | Allowed-with-Review | Architecture and Design, Installation, Operation, Requirements | | CWE-1390 | CWE-701, CWE-1000, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-1392 | Use of Default Credentials | Base | Incomplete | Allowed | Architecture and Design | | CWE-1391 | CWE-677, CWE-699, CWE-701, CWE-1000, CWE-1400, CWE-1450, CWE-2000 | | CWE-1393 | Use of Default Password | Base | Incomplete | Allowed | Architecture and Design | | CWE-1392 | CWE-677, CWE-701, CWE-1000, CWE-1358, CWE-1400, CWE-1450, CWE-2000 | | CWE-1394 | Use of Default Cryptographic Key | Base | Incomplete | Allowed | Architecture and Design | | CWE-1392 | CWE-677, CWE-701, CWE-1000, CWE-1400, CWE-2000 | | CWE-1395 | Dependency on Vulnerable Third-Party Component | Class | Incomplete | Allowed-with-Review | Architecture and Design, Implementation, Patching and Maintenance | | CWE-1357, CWE-657 | CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-1424, CWE-1450, CWE-2000 | | CWE-1419 | Incorrect Initialization of Resource | Class | Incomplete | Allowed-with-Review | Implementation, Installation, Manufacturing, Operation, System Configuration | | CWE-665 | CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1420 | Exposure of Sensitive Information during Transient Execution | Base | Incomplete | Allowed-with-Review | Architecture and Design, Implementation | | CWE-669 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1421 | Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution | Base | Incomplete | Allowed | Architecture and Design, Implementation, System Configuration | | CWE-1420, CWE-1420 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-1432, CWE-2000 | | CWE-1422 | Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution | Base | Incomplete | Allowed | Architecture and Design | | CWE-1420, CWE-1420 | CWE-677, CWE-701, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1423 | Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution | Base | Incomplete | Allowed | Architecture and Design, Implementation, System Configuration | | CWE-1420, CWE-1420 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-1432, CWE-2000 | | CWE-1426 | Improper Validation of Generative AI Output | Base | Incomplete | Discouraged | Architecture and Design, Implementation | | CWE-707 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1081, CWE-1400, CWE-1448, CWE-2000 | | CWE-1427 | Improper Neutralization of Input Used for LLM Prompting | Base | Incomplete | Allowed | Architecture and Design, Bundling, Implementation, Integration, System Configuration | | CWE-77 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-1448, CWE-2000 | | CWE-1428 | Reliance on HTTP instead of HTTPS | Base | Incomplete | Allowed | Architecture and Design, Implementation, Operation, Requirements | | CWE-319 | CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1400, CWE-2000 | | CWE-1429 | Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface | Base | Incomplete | Allowed | Architecture and Design, Implementation, Requirements | | CWE-223 | CWE-658, CWE-659, CWE-677, CWE-701, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-2000 | | CWE-1431 | Driving Intermediate Cryptographic State/Results to Hardware Module Outputs | Base | Incomplete | Allowed | Implementation | | CWE-200 | CWE-677, CWE-702, CWE-1000, CWE-1194, CWE-1400, CWE-1432, CWE-2000 | | CWE-1434 | Insecure Setting of Generative AI/ML Model Inference Parameters | Base | Draft | Allowed | Build and Compilation, Installation, Patching and Maintenance | | CWE-440, CWE-665 | CWE-677, CWE-1000, CWE-1400, CWE-1448, CWE-2000 | ## scripts ``` ``` ## scripts/build_cwe_references.py ```python #!/usr/bin/env python3 """Build searchable CWE review references from a CWE catalog XML and schema XSD.""" from __future__ import annotations import argparse import json import re import xml.etree.ElementTree as ET from collections import Counter, defaultdict from pathlib import Path from typing import Any, Iterable CWE_NS = "http://cwe.mitre.org/cwe-7" XSD_NS = "http://www.w3.org/2001/XMLSchema" NS = {"cwe": CWE_NS, "xs": XSD_NS} REVIEW_VIEW_NOTES = { "699": "Primary software-development browsing view. Use it to scope common review surfaces by development concept.", "1000": "Research graph. Use it to move between broad parents and precise child weaknesses while tracing root cause.", "1003": "Simplified vulnerability-mapping graph. Use it when a finding needs a practical mapping candidate before refining it.", "1435": "2025 CWE Top 25 view from this catalog release. Use it as prioritization context, never as proof of severity.", "1344": "OWASP Top Ten 2021 view. Use it when a review or report must align findings with the OWASP 2021 grouping.", "1450": "OWASP Top Ten 2025 RC1 view. Use it only when the RC1 taxonomy is specifically relevant.", "1448": "AI/ML product view. Use it when model inputs, training, inference, or agentic behavior are in scope.", "658": "Implicit C-language view.", "659": "Implicit C++-language view.", "660": "Implicit Java-language view.", "661": "Implicit PHP-language view.", "701": "Implicit design-introduction view.", "702": "Implicit implementation-introduction view.", "919": "Implicit mobile-application view.", } CORE_COMPLEX_TYPES = [ "WeaknessType", "MappingNotesType", "RelatedWeaknessesType", "RelationshipsType", "ModesOfIntroductionType", "ApplicablePlatformsType", "FunctionalAreasType", "CommonConsequencesType", "DetectionMethodsType", "PotentialMitigationsType", "ObservedExampleType", ] def normalize_space(value: str | None) -> str: return re.sub(r"\s+", " ", value or "").strip() def text_of(node: ET.Element | None) -> str: if node is None: return "" return normalize_space(" ".join(node.itertext())) def doc_of(node: ET.Element | None) -> str: if node is None: return "" docs = [text_of(item) for item in node.findall("xs:annotation/xs:documentation", NS)] return normalize_space(" ".join(item for item in docs if item)) def short_text(value: str, limit: int = 180) -> str: value = normalize_space(value) if len(value) <= limit: return value return value[: limit - 3].rstrip() + "..." def md_escape(value: str) -> str: return value.replace("|", "\\|").replace("\n", " ") def snake_key(value: str) -> str: value = re.sub(r"([a-z0-9])([A-Z])", r"\1_\2", value) return value.replace("-", "_").lower() def normalized_attrs(node: ET.Element) -> dict[str, str]: return {snake_key(key): value for key, value in node.attrib.items()} def first_text(node: ET.Element, path: str) -> str: return text_of(node.find(path, NS)) def all_text(node: ET.Element, path: str) -> list[str]: return [text_of(item) for item in node.findall(path, NS) if text_of(item)] def parse_external_references(root: ET.Element) -> dict[str, dict[str, Any]]: references: dict[str, dict[str, Any]] = {} for ref in root.findall("cwe:External_References/cwe:External_Reference", NS): ref_id = ref.attrib["Reference_ID"] references[ref_id] = { "reference_id": ref_id, "authors": all_text(ref, "cwe:Author"), "title": first_text(ref, "cwe:Title"), "edition": first_text(ref, "cwe:Edition"), "publication": first_text(ref, "cwe:Publication"), "publication_year": first_text(ref, "cwe:Publication_Year"), "publisher": first_text(ref, "cwe:Publisher"), "url": first_text(ref, "cwe:URL"), "url_date": first_text(ref, "cwe:URL_Date"), } return references def parse_mapping_notes(node: ET.Element) -> dict[str, Any]: mapping = node.find("cwe:Mapping_Notes", NS) if mapping is None: return {} return { "usage": first_text(mapping, "cwe:Usage"), "rationale": first_text(mapping, "cwe:Rationale"), "comments": first_text(mapping, "cwe:Comments"), "reasons": [ item.attrib.get("Type", "") for item in mapping.findall("cwe:Reasons/cwe:Reason", NS) if item.attrib.get("Type") ], "suggestions": [ { "cwe_id": item.attrib.get("CWE_ID", ""), "comment": item.attrib.get("Comment", ""), } for item in mapping.findall("cwe:Suggestions/cwe:Suggestion", NS) ], } def parse_platforms(node: ET.Element) -> list[dict[str, str]]: platforms: list[dict[str, str]] = [] parent = node.find("cwe:Applicable_Platforms", NS) if parent is None: return platforms for child in list(parent): item = {"kind": child.tag.rsplit("}", 1)[-1]} item.update(normalized_attrs(child)) platforms.append(item) return platforms def parse_relationships(node: ET.Element) -> list[dict[str, str]]: return [ normalized_attrs(item) for item in node.findall("cwe:Related_Weaknesses/cwe:Related_Weakness", NS) ] def parse_consequences(node: ET.Element) -> list[dict[str, Any]]: consequences: list[dict[str, Any]] = [] for item in node.findall("cwe:Common_Consequences/cwe:Consequence", NS): consequences.append( { "consequence_id": item.attrib.get("Consequence_ID", ""), "scopes": all_text(item, "cwe:Scope"), "impacts": all_text(item, "cwe:Impact"), "likelihood": first_text(item, "cwe:Likelihood"), "note": first_text(item, "cwe:Note"), } ) return consequences def parse_detection_methods(node: ET.Element) -> list[dict[str, str]]: methods: list[dict[str, str]] = [] for item in node.findall("cwe:Detection_Methods/cwe:Detection_Method", NS): methods.append( { "detection_method_id": item.attrib.get("Detection_Method_ID", ""), "method": first_text(item, "cwe:Method"), "description": first_text(item, "cwe:Description"), "effectiveness": first_text(item, "cwe:Effectiveness"), "effectiveness_notes": first_text(item, "cwe:Effectiveness_Notes"), } ) return methods def parse_mitigations(node: ET.Element) -> list[dict[str, Any]]: mitigations: list[dict[str, Any]] = [] for item in node.findall("cwe:Potential_Mitigations/cwe:Mitigation", NS): mitigations.append( { "mitigation_id": item.attrib.get("Mitigation_ID", ""), "phases": all_text(item, "cwe:Phase"), "strategy": first_text(item, "cwe:Strategy"), "description": first_text(item, "cwe:Description"), "effectiveness": first_text(item, "cwe:Effectiveness"), "effectiveness_notes": first_text(item, "cwe:Effectiveness_Notes"), } ) return mitigations def parse_taxonomy_mappings(node: ET.Element) -> list[dict[str, str]]: mappings: list[dict[str, str]] = [] for item in node.findall("cwe:Taxonomy_Mappings/cwe:Taxonomy_Mapping", NS): mappings.append( { "taxonomy_name": item.attrib.get("Taxonomy_Name", ""), "entry_id": first_text(item, "cwe:Entry_ID"), "entry_name": first_text(item, "cwe:Entry_Name"), "mapping_fit": first_text(item, "cwe:Mapping_Fit"), } ) return mappings def parse_weakness( node: ET.Element, external_references: dict[str, dict[str, Any]], ) -> dict[str, Any]: record: dict[str, Any] = { "id": node.attrib["ID"], "name": node.attrib["Name"], "abstraction": node.attrib.get("Abstraction", ""), "structure": node.attrib.get("Structure", ""), "status": node.attrib.get("Status", ""), "diagram": node.attrib.get("Diagram", ""), "description": first_text(node, "cwe:Description"), "extended_description": first_text(node, "cwe:Extended_Description"), "relationships": parse_relationships(node), "weakness_ordinalities": [ { "ordinality": first_text(item, "cwe:Ordinality"), "description": first_text(item, "cwe:Description"), } for item in node.findall("cwe:Weakness_Ordinalities/cwe:Weakness_Ordinality", NS) ], "platforms": parse_platforms(node), "background_details": all_text(node, "cwe:Background_Details/cwe:Background_Detail"), "alternate_terms": [ { "term": first_text(item, "cwe:Term"), "description": first_text(item, "cwe:Description"), } for item in node.findall("cwe:Alternate_Terms/cwe:Alternate_Term", NS) ], "modes_of_introduction": [ { "phase": first_text(item, "cwe:Phase"), "note": first_text(item, "cwe:Note"), } for item in node.findall("cwe:Modes_Of_Introduction/cwe:Introduction", NS) ], "exploitation_factors": all_text(node, "cwe:Exploitation_Factors/cwe:Exploitation_Factor"), "likelihood_of_exploit": first_text(node, "cwe:Likelihood_Of_Exploit"), "consequences": parse_consequences(node), "detection_methods": parse_detection_methods(node), "mitigations": parse_mitigations(node), "functional_areas": all_text(node, "cwe:Functional_Areas/cwe:Functional_Area"), "affected_resources": all_text(node, "cwe:Affected_Resources/cwe:Affected_Resource"), "taxonomy_mappings": parse_taxonomy_mappings(node), "related_attack_patterns": [ item.attrib.get("CAPEC_ID", "") for item in node.findall("cwe:Related_Attack_Patterns/cwe:Related_Attack_Pattern", NS) if item.attrib.get("CAPEC_ID") ], "observed_examples": [ { "reference": first_text(item, "cwe:Reference"), "description": first_text(item, "cwe:Description"), "link": first_text(item, "cwe:Link"), } for item in node.findall("cwe:Observed_Examples/cwe:Observed_Example", NS) ], "mapping": parse_mapping_notes(node), "notes": [ { "type": item.attrib.get("Type", ""), "text": text_of(item), } for item in node.findall("cwe:Notes/cwe:Note", NS) ], } ref_ids = list( dict.fromkeys( item.attrib.get("External_Reference_ID", "") for item in node.findall("cwe:References/cwe:Reference", NS) if item.attrib.get("External_Reference_ID") ) ) record["references"] = [ external_references[ref_id] for ref_id in ref_ids if ref_id in external_references ] return record def parse_categories(root: ET.Element) -> dict[str, dict[str, Any]]: categories: dict[str, dict[str, Any]] = {} for node in root.findall("cwe:Categories/cwe:Category", NS): categories[node.attrib["ID"]] = { "id": node.attrib["ID"], "name": node.attrib["Name"], "status": node.attrib.get("Status", ""), "summary": first_text(node, "cwe:Summary"), "relationships": [ { "kind": item.tag.rsplit("}", 1)[-1], **normalized_attrs(item), } for item in node.findall("cwe:Relationships/*", NS) ], "mapping": parse_mapping_notes(node), } return categories def parse_views(root: ET.Element) -> dict[str, dict[str, Any]]: views: dict[str, dict[str, Any]] = {} for node in root.findall("cwe:Views/cwe:View", NS): views[node.attrib["ID"]] = { "id": node.attrib["ID"], "name": node.attrib["Name"], "type": node.attrib.get("Type", ""), "status": node.attrib.get("Status", ""), "objective": first_text(node, "cwe:Objective"), "filter": first_text(node, "cwe:Filter"), "members": [ { "kind": item.tag.rsplit("}", 1)[-1], **normalized_attrs(item), } for item in node.findall("cwe:Members/*", NS) ], "mapping": parse_mapping_notes(node), } return views def implicit_view_members(view_id: str, records: dict[str, dict[str, Any]]) -> set[str]: members: set[str] = set() for record in records.values(): if view_id == "1040" and any( item["ordinality"] == "Indirect" for item in record["weakness_ordinalities"] ): members.add(record["id"]) elif view_id == "1081" and any(item["type"] == "Maintenance" for item in record["notes"]): members.add(record["id"]) elif view_id == "1424" and any( item["taxonomy_name"] == "ISA/IEC 62443" for item in record["taxonomy_mappings"] ): members.add(record["id"]) elif view_id == "2000": members.add(record["id"]) elif view_id == "604" and record["status"] == "Deprecated": members.add(record["id"]) elif view_id in {"658", "659", "660", "661"}: language = {"658": "C", "659": "C++", "660": "Java", "661": "PHP"}[view_id] if any(item.get("kind") == "Language" and item.get("name") == language for item in record["platforms"]): members.add(record["id"]) elif view_id == "677" and record["abstraction"] == "Base" and record["status"] != "Deprecated": members.add(record["id"]) elif view_id == "678" and record["structure"] == "Composite" and record["status"] != "Deprecated": members.add(record["id"]) elif view_id in {"679", "999"}: continue elif view_id == "701" and record["abstraction"] in {"Base", "Class"} and any( item["phase"] == "Architecture and Design" for item in record["modes_of_introduction"] ): members.add(record["id"]) elif view_id == "702" and any( item["phase"] == "Implementation" for item in record["modes_of_introduction"] ): members.add(record["id"]) elif view_id == "709" and record["structure"] == "Chain": members.add(record["id"]) elif view_id == "919" and any( item.get("kind") == "Technology" and item.get("class") == "Mobile" for item in record["platforms"] ): members.add(record["id"]) return members def attach_relationship_names(records: dict[str, dict[str, Any]]) -> None: for record in records.values(): for relationship in record["relationships"]: target = records.get(relationship.get("cwe_id", "")) if target: relationship["target_name"] = target["name"] def attach_view_memberships( records: dict[str, dict[str, Any]], categories: dict[str, dict[str, Any]], views: dict[str, dict[str, Any]], ) -> None: view_members: dict[str, set[str]] = defaultdict(set) for view_id, view in views.items(): if view["type"] == "Implicit": view_members[view_id].update(implicit_view_members(view_id, records)) for member in view["members"]: cwe_id = member.get("cwe_id", "") if cwe_id in records: view_members[view_id].add(cwe_id) for category in categories.values(): for relationship in category["relationships"]: view_id = relationship.get("view_id", "") cwe_id = relationship.get("cwe_id", "") if relationship.get("kind") == "Has_Member" and cwe_id in records: view_members[view_id].add(cwe_id) for record in records.values(): for relationship in record["relationships"]: view_id = relationship.get("view_id", "") view_members[view_id].add(record["id"]) cwe_id = relationship.get("cwe_id", "") if cwe_id in records: view_members[view_id].add(cwe_id) for view_id, view in views.items(): view["weakness_member_ids"] = sorted(view_members[view_id], key=int) for record in records.values(): record["view_ids"] = sorted( [view_id for view_id, members in view_members.items() if record["id"] in members], key=int, ) def parse_schema(schema_root: ET.Element) -> dict[str, Any]: appinfo = schema_root.find("xs:annotation/xs:appinfo", NS) metadata = { "version": schema_root.attrib.get("version", ""), "schema": first_text(appinfo, "schema") if appinfo is not None else "", "date": first_text(appinfo, "date") if appinfo is not None else "", "documentation": doc_of(schema_root), } simple_types: dict[str, dict[str, Any]] = {} for node in schema_root.findall("xs:simpleType", NS): values = [] for enum in node.findall(".//xs:enumeration", NS): values.append( { "value": enum.attrib.get("value", ""), "documentation": doc_of(enum), } ) if values: simple_types[node.attrib.get("name", "")] = { "documentation": doc_of(node), "values": values, } complex_types: dict[str, dict[str, Any]] = {} for name in CORE_COMPLEX_TYPES: node = schema_root.find(f"xs:complexType[@name='{name}']", NS) if node is None: continue elements = [] for child in node.findall("xs:sequence/xs:element", NS): elements.append( { "name": child.attrib.get("name", ""), "type": child.attrib.get("type", ""), "min_occurs": child.attrib.get("minOccurs", "1"), "max_occurs": child.attrib.get("maxOccurs", "1"), } ) attributes = [] for attribute in node.findall("xs:attribute", NS): attributes.append( { "name": attribute.attrib.get("name", ""), "type": attribute.attrib.get("type", ""), "use": attribute.attrib.get("use", "optional"), } ) complex_types[name] = { "documentation": doc_of(node), "elements": elements, "attributes": attributes, } return { "metadata": metadata, "simple_types": simple_types, "complex_types": complex_types, } def entity_label( cwe_id: str, records: dict[str, dict[str, Any]], categories: dict[str, dict[str, Any]], views: dict[str, dict[str, Any]], ) -> str: if cwe_id in records: return f"CWE-{cwe_id} {records[cwe_id]['name']} [Weakness]" if cwe_id in categories: return f"CWE-{cwe_id} {categories[cwe_id]['name']} [Category]" if cwe_id in views: return f"CWE-{cwe_id} {views[cwe_id]['name']} [View]" return f"CWE-{cwe_id}" def write_jsonl(path: Path, records: dict[str, dict[str, Any]]) -> None: with path.open("w", encoding="utf-8") as handle: for record in sorted(records.values(), key=lambda item: int(item["id"])): handle.write(json.dumps(record, sort_keys=True, ensure_ascii=True) + "\n") def write_metadata_json( path: Path, root: ET.Element, schema: dict[str, Any], categories: dict[str, dict[str, Any]], views: dict[str, dict[str, Any]], ) -> None: payload = { "catalog": { "name": root.attrib.get("Name", ""), "version": root.attrib.get("Version", ""), "date": root.attrib.get("Date", ""), "namespace": CWE_NS, "schema_location": root.attrib.get( "{http://www.w3.org/2001/XMLSchema-instance}schemaLocation", "" ), }, "schema": schema["metadata"], "categories": categories, "views": views, } path.write_text(json.dumps(payload, indent=2, sort_keys=True, ensure_ascii=True) + "\n", encoding="utf-8") def write_catalog_summary( path: Path, root: ET.Element, schema: dict[str, Any], records: dict[str, dict[str, Any]], categories: dict[str, dict[str, Any]], views: dict[str, dict[str, Any]], ) -> None: abstraction_counts = Counter(record["abstraction"] for record in records.values()) status_counts = Counter(record["status"] for record in records.values()) usage_counts = Counter(record["mapping"].get("usage", "") for record in records.values()) structure_counts = Counter(record["structure"] for record in records.values()) mapping_usage_summary = ", ".join( f"{key or 'Unknown'}: {value}" for key, value in sorted(usage_counts.items()) ) lines = [ "# CWE Catalog Summary", "", "Generated by `scripts/build_cwe_references.py` from the local CWE catalog and XSD supplied to the skill.", "", "## Source", "", f"- Catalog: {root.attrib.get('Name', '')} {root.attrib.get('Version', '')} dated {root.attrib.get('Date', '')}", f"- Catalog namespace: `{CWE_NS}`", f"- Schema: {schema['metadata'].get('schema', '')} {schema['metadata'].get('version', '')} dated {schema['metadata'].get('date', '')}", f"- Counts: {len(records)} weaknesses, {len(categories)} categories, {len(views)} views", "", "## How To Use This Corpus", "", "- Start with code evidence and a trust-boundary failure, then use the corpus to refine the root-cause weakness.", "- Prefer weaknesses with mapping usage `Allowed` or `Allowed-with-Review`; treat `Discouraged` and `Prohibited` entries as navigation aids unless the mapping notes justify an exception.", "- Prefer the most precise supported weakness over a broad Pillar, Class, Category, or View. Categories and Views organize the corpus and are not root-cause mappings.", "- Use view membership as coverage or prioritization context, not as a severity rating.", "- Use `scripts/cwe_lookup.py` for detail retrieval. Use `references/cwe-weakness-index.md` for fast grep-based browsing.", "", "## Catalog Shape", "", "| Dimension | Values |", "| --- | --- |", f"| Abstraction | {', '.join(f'{key}: {value}' for key, value in sorted(abstraction_counts.items()))} |", f"| Structure | {', '.join(f'{key}: {value}' for key, value in sorted(structure_counts.items()))} |", f"| Status | {', '.join(f'{key}: {value}' for key, value in sorted(status_counts.items()))} |", f"| Mapping usage | {mapping_usage_summary} |", "", "## Review-Oriented Views", "", "| View | Type | Status | Weakness Members | Use |", "| --- | --- | --- | ---: | --- |", ] for view_id in REVIEW_VIEW_NOTES: view = views.get(view_id) if not view: continue lines.append( f"| CWE-{view_id} {md_escape(view['name'])} | {view['type']} | {view['status']} | " f"{len(view.get('weakness_member_ids', []))} | {md_escape(REVIEW_VIEW_NOTES[view_id])} |" ) lines.extend( [ "", "## Generated Files", "", "- `cwe-weakness-index.md`: compact, line-oriented index of every weakness for grep and quick scanning.", "- `cwe-review-views.md`: review-oriented view descriptions, filters, and member lists.", "- `cwe-schema-guide.md`: XSD-derived field semantics and enumeration vocabulary.", "- `cwe-records.jsonl`: machine-readable record per weakness with mapping notes, relationships, detection methods, mitigations, and examples.", "- `cwe-catalog-metadata.json`: machine-readable catalog, schema, category, and view metadata.", "", ] ) path.write_text("\n".join(lines), encoding="utf-8") def write_weakness_index(path: Path, records: dict[str, dict[str, Any]]) -> None: lines = [ "# CWE Weakness Index", "", "Generated from the local CWE catalog. Search this file first, then use `scripts/cwe_lookup.py --id ` for complete detail.", "", "| CWE | Name | Abstraction | Status | Mapping | Phases | Functional Areas | Parent IDs | View IDs |", "| --- | --- | --- | --- | --- | --- | --- | --- | --- |", ] for record in sorted(records.values(), key=lambda item: int(item["id"])): parents = [ f"CWE-{item['cwe_id']}" for item in record["relationships"] if item.get("nature") == "ChildOf" and item.get("cwe_id") ] phases = sorted({item["phase"] for item in record["modes_of_introduction"] if item["phase"]}) lines.append( "| " + " | ".join( [ f"CWE-{record['id']}", md_escape(record["name"]), record["abstraction"], record["status"], record["mapping"].get("usage", ""), md_escape(", ".join(phases)), md_escape(", ".join(record["functional_areas"])), md_escape(", ".join(parents)), md_escape(", ".join(f"CWE-{item}" for item in record["view_ids"])), ] ) + " |" ) path.write_text("\n".join(lines) + "\n", encoding="utf-8") def write_review_views( path: Path, records: dict[str, dict[str, Any]], categories: dict[str, dict[str, Any]], views: dict[str, dict[str, Any]], ) -> None: lines = [ "# CWE Review Views", "", "Use these views to scope coverage and navigate the catalog. A view is not itself a finding or a root-cause mapping.", "", "## Contents", "", ] for view_id in REVIEW_VIEW_NOTES: if view_id in views: lines.append(f"- [CWE-{view_id} {views[view_id]['name']}](#cwe-{view_id})") for view_id, note in REVIEW_VIEW_NOTES.items(): view = views.get(view_id) if not view: continue lines.extend( [ "", f"## CWE-{view_id}", "", f"**{view['name']}**", "", f"- Type: {view['type']}", f"- Status: {view['status']}", f"- Weakness members: {len(view.get('weakness_member_ids', []))}", f"- Review use: {note}", "", short_text(view["objective"], 600), ] ) if view["filter"]: lines.extend(["", f"Filter: `{view['filter']}`"]) if view["members"]: label = "Ordered direct members:" if view_id == "1435" else "Direct members:" lines.extend(["", label, ""]) for index, member in enumerate(view["members"], start=1): prefix = f"{index}." if view_id == "1435" else "-" lines.append( f"{prefix} {entity_label(member.get('cwe_id', ''), records, categories, views)}" ) weakness_member_ids = view.get("weakness_member_ids", []) show_all = view_id in {"1003", "1448"} if show_all: lines.extend(["", "Weakness members:", ""]) for cwe_id in weakness_member_ids: record = records[cwe_id] lines.append( f"- CWE-{cwe_id} {record['name']} " f"({record['abstraction']}; mapping {record['mapping'].get('usage', '')})" ) elif weakness_member_ids: sample = weakness_member_ids[:20] lines.extend( [ "", f"Sample weakness members ({len(sample)} of {len(weakness_member_ids)}):", "", ] ) for cwe_id in sample: record = records[cwe_id] lines.append(f"- CWE-{cwe_id} {record['name']}") path.write_text("\n".join(lines) + "\n", encoding="utf-8") def write_schema_guide(path: Path, schema: dict[str, Any]) -> None: lines = [ "# CWE Schema Guide", "", "Generated from the local CWE XSD. Use this file when interpreting field meaning, relationship semantics, or allowed vocabulary.", "", "## Contents", "", "- [Schema Metadata](#schema-metadata)", "- [Core Complex Types](#core-complex-types)", "- [Enumerations](#enumerations)", "", "## Schema Metadata", "", f"- Name: {schema['metadata'].get('schema', '')}", f"- Version: {schema['metadata'].get('version', '')}", f"- Date: {schema['metadata'].get('date', '')}", "", "## Core Complex Types", "", ] for name in CORE_COMPLEX_TYPES: item = schema["complex_types"].get(name) if not item: continue lines.extend([f"### {name}", "", short_text(item["documentation"], 900), ""]) if item["elements"]: lines.extend( [ "| Element | Type | Cardinality |", "| --- | --- | --- |", ] ) for element in item["elements"]: lines.append( f"| {element['name']} | {element['type'] or 'inline type'} | " f"{element['min_occurs']}..{element['max_occurs']} |" ) lines.append("") if item["attributes"]: lines.extend( [ "| Attribute | Type | Use |", "| --- | --- | --- |", ] ) for attribute in item["attributes"]: lines.append( f"| {attribute['name']} | {attribute['type'] or 'inline type'} | {attribute['use']} |" ) lines.append("") lines.extend(["## Enumerations", ""]) for name, item in sorted(schema["simple_types"].items()): lines.extend([f"### {name}", "", short_text(item["documentation"], 500), ""]) lines.extend(["| Value | Notes |", "| --- | --- |"]) for value in item["values"]: lines.append( f"| {md_escape(value['value'])} | {md_escape(short_text(value['documentation'], 240))} |" ) lines.append("") path.write_text("\n".join(lines), encoding="utf-8") def build(catalog_path: Path, schema_path: Path, output_dir: Path) -> None: catalog_root = ET.parse(catalog_path).getroot() schema_root = ET.parse(schema_path).getroot() external_references = parse_external_references(catalog_root) records = { node.attrib["ID"]: parse_weakness(node, external_references) for node in catalog_root.findall("cwe:Weaknesses/cwe:Weakness", NS) } categories = parse_categories(catalog_root) views = parse_views(catalog_root) schema = parse_schema(schema_root) attach_relationship_names(records) attach_view_memberships(records, categories, views) output_dir.mkdir(parents=True, exist_ok=True) write_jsonl(output_dir / "cwe-records.jsonl", records) write_metadata_json(output_dir / "cwe-catalog-metadata.json", catalog_root, schema, categories, views) write_catalog_summary(output_dir / "cwe-catalog-summary.md", catalog_root, schema, records, categories, views) write_weakness_index(output_dir / "cwe-weakness-index.md", records) write_review_views(output_dir / "cwe-review-views.md", records, categories, views) write_schema_guide(output_dir / "cwe-schema-guide.md", schema) def main() -> None: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--catalog", required=True, type=Path, help="Path to CWE catalog XML.") parser.add_argument("--schema", required=True, type=Path, help="Path to CWE schema XSD.") parser.add_argument( "--output-dir", type=Path, default=Path(__file__).resolve().parent.parent / "references", help="Directory for generated references.", ) args = parser.parse_args() build(args.catalog, args.schema, args.output_dir) print(f"Generated CWE references in {args.output_dir}") if __name__ == "__main__": main() ``` ## scripts/cwe_lookup.py ```python #!/usr/bin/env python3 """Search and render the generated CWE review corpus.""" from __future__ import annotations import argparse import json import re from pathlib import Path from typing import Any, Iterable DEFAULT_DATA_PATH = Path(__file__).resolve().parent.parent / "references" / "cwe-records.jsonl" DEFAULT_METADATA_PATH = Path(__file__).resolve().parent.parent / "references" / "cwe-catalog-metadata.json" def normalize_space(value: str | None) -> str: return re.sub(r"\s+", " ", value or "").strip() def short_text(value: str, limit: int = 220) -> str: value = normalize_space(value) if len(value) <= limit: return value return value[: limit - 3].rstrip() + "..." def md_escape(value: str) -> str: return value.replace("|", "\\|").replace("\n", " ") def load_records(path: Path) -> list[dict[str, Any]]: with path.open("r", encoding="utf-8") as handle: return [json.loads(line) for line in handle if line.strip()] def load_metadata(path: Path) -> dict[str, Any]: with path.open("r", encoding="utf-8") as handle: return json.load(handle) def normalize_id(value: str) -> str: match = re.fullmatch(r"(?:CWE-)?(\d+)", value.strip(), re.IGNORECASE) return match.group(1) if match else value.strip() def flatten_text(value: Any) -> str: if isinstance(value, dict): return " ".join(flatten_text(item) for item in value.values()) if isinstance(value, list): return " ".join(flatten_text(item) for item in value) return str(value) def score_query(record: dict[str, Any], query: str) -> int: if normalize_id(query) == record["id"]: return 100 terms = [term for term in re.findall(r"[a-z0-9+/#.-]+", query.lower()) if term] if not terms: return 0 name = record["name"].lower() description = record["description"].lower() alternate_terms = " ".join(item.get("term", "") for item in record["alternate_terms"]).lower() functional_areas = " ".join(record["functional_areas"]).lower() blob = flatten_text(record).lower() if not all(term in blob for term in terms): return 0 score = 0 for term in terms: if term in name: score += 8 if term in alternate_terms: score += 6 if term in description: score += 4 if term in functional_areas: score += 2 if term in blob: score += 1 return score def matches_filters(record: dict[str, Any], args: argparse.Namespace) -> bool: if args.id and record["id"] not in {normalize_id(item) for item in args.id}: return False if args.view and normalize_id(args.view) not in record.get("view_ids", []): return False if args.phase and not any( item.get("phase", "").lower() == args.phase.lower() for item in record["modes_of_introduction"] ): return False if args.functional_area and not any( item.lower() == args.functional_area.lower() for item in record["functional_areas"] ): return False if args.impact and not any( args.impact.lower() in impact.lower() for consequence in record["consequences"] for impact in consequence["impacts"] ): return False if args.mapping and record["mapping"].get("usage", "").lower() != args.mapping.lower(): return False if args.abstraction and record["abstraction"].lower() != args.abstraction.lower(): return False if args.status and record["status"].lower() != args.status.lower(): return False return True def sort_matches(records: Iterable[dict[str, Any]], query: str | None) -> list[dict[str, Any]]: if not query: return sorted(records, key=lambda item: int(item["id"])) if re.fullmatch(r"(?:CWE-)?\d+", query.strip(), re.IGNORECASE): exact_id = normalize_id(query) return [record for record in records if record["id"] == exact_id] scored = [(score_query(record, query), record) for record in records] return [ record for score, record in sorted(scored, key=lambda item: (-item[0], int(item[1]["id"]))) if score > 0 ] def render_relationships(record: dict[str, Any]) -> list[str]: lines: list[str] = [] for item in record["relationships"]: target = f"CWE-{item.get('cwe_id', '')}" if item.get("target_name"): target += f" {item['target_name']}" details = [item.get("nature", "")] if item.get("view_id"): details.append(f"view CWE-{item['view_id']}") if item.get("ordinal"): details.append(item["ordinal"]) lines.append(f"- {target}: {', '.join(part for part in details if part)}") return lines def render_record(record: dict[str, Any], metadata: dict[str, Any], full: bool) -> str: mapping = record["mapping"] view_names = metadata.get("views", {}) lines = [ f"# CWE-{record['id']}: {record['name']}", "", f"- Abstraction: {record['abstraction']}", f"- Structure: {record['structure']}", f"- Status: {record['status']}", f"- Mapping usage: {mapping.get('usage', '')}", f"- Likelihood of exploit: {record['likelihood_of_exploit'] or 'Not specified'}", "", "## Description", "", record["description"], ] if record["extended_description"]: lines.extend(["", "## Extended Description", "", record["extended_description"]]) lines.extend( [ "", "## Mapping Guidance", "", f"- Usage: {mapping.get('usage', '')}", f"- Reasons: {', '.join(mapping.get('reasons', [])) or 'None listed'}", f"- Rationale: {mapping.get('rationale', '')}", f"- Comments: {mapping.get('comments', '')}", ] ) if mapping.get("suggestions"): lines.extend(["", "Suggestions:"]) for suggestion in mapping["suggestions"]: lines.append(f"- CWE-{suggestion['cwe_id']}: {suggestion['comment']}") if record["relationships"]: lines.extend(["", "## Relationships", "", *render_relationships(record)]) phases = [item["phase"] for item in record["modes_of_introduction"] if item["phase"]] if phases: lines.extend(["", "## Introduction Phases", "", "- " + "\n- ".join(phases)]) if record["functional_areas"]: lines.extend(["", "## Functional Areas", "", "- " + "\n- ".join(record["functional_areas"])]) if record["platforms"]: lines.extend(["", "## Applicable Platforms", ""]) for platform in record["platforms"]: details = ", ".join( f"{key}={value}" for key, value in platform.items() if key != "kind" and value ) lines.append(f"- {platform['kind']}: {details}") if record["consequences"]: lines.extend(["", "## Common Consequences", ""]) for item in record["consequences"]: scope = ", ".join(item["scopes"]) impact = ", ".join(item["impacts"]) note = f" {item['note']}" if item["note"] else "" lines.append(f"- Scope: {scope}; Impact: {impact}.{note}") if record["detection_methods"]: lines.extend(["", "## Detection Methods", ""]) for item in record["detection_methods"]: effectiveness = f" ({item['effectiveness']})" if item["effectiveness"] else "" lines.append(f"- {item['method']}{effectiveness}: {item['description']}") if record["mitigations"]: lines.extend(["", "## Potential Mitigations", ""]) for item in record["mitigations"]: prefix = "; ".join( part for part in [ ", ".join(item["phases"]), item["strategy"], item["effectiveness"], ] if part ) lines.append(f"- {prefix}: {item['description']}" if prefix else f"- {item['description']}") if record["view_ids"]: lines.extend(["", "## View Membership", ""]) for view_id in record["view_ids"]: view = view_names.get(view_id, {}) lines.append(f"- CWE-{view_id}: {view.get('name', '')}") if full: if record["background_details"]: lines.extend(["", "## Background Details", ""]) lines.extend(f"- {item}" for item in record["background_details"]) if record["exploitation_factors"]: lines.extend(["", "## Exploitation Factors", ""]) lines.extend(f"- {item}" for item in record["exploitation_factors"]) if record["observed_examples"]: lines.extend(["", "## Observed Examples", ""]) for item in record["observed_examples"]: lines.append(f"- {item['reference']}: {item['description']}") if record["notes"]: lines.extend(["", "## Notes", ""]) lines.extend(f"- {item['type']}: {item['text']}" for item in record["notes"]) if record["references"]: lines.extend(["", "## External References", ""]) for item in record["references"]: suffix = f" ({item['url']})" if item.get("url") else "" lines.append(f"- {item['reference_id']}: {item['title']}{suffix}") return "\n".join(lines) + "\n" def render_list(records: list[dict[str, Any]], metadata: dict[str, Any], args: argparse.Namespace) -> str: catalog = metadata.get("catalog", {}) lines = [ f"# CWE Matches ({len(records)})", "", f"Catalog: {catalog.get('name', '')} {catalog.get('version', '')} dated {catalog.get('date', '')}", "", "| CWE | Name | Abstraction | Status | Mapping | Description |", "| --- | --- | --- | --- | --- | --- |", ] for record in records[: args.limit]: lines.append( f"| CWE-{record['id']} | {md_escape(record['name'])} | {record['abstraction']} | " f"{record['status']} | {record['mapping'].get('usage', '')} | " f"{md_escape(short_text(record['description']))} |" ) if len(records) > args.limit: lines.extend(["", f"Showing {args.limit} of {len(records)} matches."]) return "\n".join(lines) + "\n" def main() -> None: parser = argparse.ArgumentParser(description=__doc__) parser.add_argument("--data", type=Path, default=DEFAULT_DATA_PATH, help="Path to cwe-records.jsonl.") parser.add_argument( "--metadata", type=Path, default=DEFAULT_METADATA_PATH, help="Path to cwe-catalog-metadata.json.", ) parser.add_argument("--id", action="append", help="CWE ID, with or without the CWE- prefix.") parser.add_argument("--query", help="Keyword search across weakness content.") parser.add_argument("--view", help="Filter by view ID.") parser.add_argument("--phase", help="Filter by introduction phase.") parser.add_argument("--functional-area", help="Filter by functional area.") parser.add_argument("--impact", help="Filter by technical impact substring.") parser.add_argument("--mapping", help="Filter by mapping usage.") parser.add_argument("--abstraction", help="Filter by abstraction.") parser.add_argument("--status", help="Filter by status.") parser.add_argument("--limit", type=int, default=10, help="Maximum list results to render.") parser.add_argument("--full", action="store_true", help="Include background details, notes, and references.") parser.add_argument("--json", action="store_true", help="Emit JSON instead of Markdown.") args = parser.parse_args() records = load_records(args.data) metadata = load_metadata(args.metadata) matches = [record for record in records if matches_filters(record, args)] matches = sort_matches(matches, args.query) if args.json: print(json.dumps(matches[: args.limit] if len(matches) != 1 else matches[0], indent=2, sort_keys=True)) return if not matches: print("No matching CWE records found.") return if len(matches) == 1: print(render_record(matches[0], metadata, args.full), end="") return print(render_list(matches, metadata, args), end="") if __name__ == "__main__": main() ```