🧩

Common Weakness Enumeration

Explore the comprehensive database of software security weaknesses. CWE provides a unified, measurable set of software weaknesses that enables more effective discussion, description, selection, and use of software security tools and services.

1935

Total CWEs

Unconditional Control Flow Transfer outside of Switch Block

The product performs unconditional control transfer (such as a 'goto') in code outside of a branching structure such as a switch block.

Insufficient Adherence to Expected Conventions

The product's architecture, source code, design, documentation, or other artifact does not follow required conventions.

Floating Point Comparison with Incorrect Operator

The code performs a comparison such as an equality test between two float (floating point) values, but it uses comparison operators t…

Inappropriate Source Code Style or Formatting

The source code does not follow desired style or formatting for indentation, white space, comments, etc.

Parent Class without Virtual Destructor Method

A parent class contains one or more child classes, but the parent class does not have a virtual destructor method.

Struts: Unvalidated Action Form

Every Action Form must have a corresponding validation form.

Source Code File with Excessive Number of Lines of Code

A source code file has too many lines of code.

Class Instance Self Destruction Control Element

The code contains a class instance that calls the method or function to delete or destroy itself.

Data Access from Outside Expected Data Manager Component

The product is intended to manage data access through a particular data manager component such as a relational or non-SQL database, but it contains c…

Invokable Control Element with Excessive File or Data Access Operations

A function or method contains too many operations that utilize a data manager or file resource.

Invokable Control Element with Excessive Volume of Commented-out Code

A function, method, procedure, etc. contains an excessive amount of code that has been commented out within its body.

Class with Excessive Number of Child Classes

A class contains an unnecessarily large number of children.

Class with Virtual Method without a Virtual Destructor

A class contains a virtual method, but the method does not have an associated virtual destructor.

Synchronous Access of Remote Resource without Timeout

The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.

Struts: Validator Turned Off

Automatic filtering via a Struts bean has been turned off, which disables the Struts Validator and custom validation logic. This exposes the applicat…

Method Containing Access of a Member Element from Another Class

A method for a class performs an operation that directly accesses a member element from another class.

Use of Object without Invoking Destructor Method

The product contains a method that accesses an object but does not later invoke the element's associated finalize/destructor method.

Use of Same Invokable Control Element in Multiple Architectural Layers

The product uses the same control element across multiple architectural layers.

Excessively Complex Data Representation

The product uses an unnecessarily complex internal representation for its data structures or interrelationships between those structures.

Excessive Index Range Scan for a Data Resource

The product contains an index range scan for a large data table, but the scan can cover a large number of rows.

Loop Condition Value Update within the Loop

The product uses a loop with a control flow condition based on a value that is updated within the body of the loop.

Singleton Class Instance Creation without Proper Locking or Synchronization

The product implements a Singleton design pattern but does not use appropriate locking or other synchronization mechanism to ensure that the singleto…

Persistent Storable Data Element without Associated Comparison Control Element

The product uses a storable data element that does not have all of the associated functions or methods that are necessary to support compar…

Data Element containing Pointer Item without Proper Copy Control Element

The code contains a data element with a pointer that does not have an associated copy or constructor method.

Inconsistent Naming Conventions for Identifiers

The product's code, documentation, or other artifacts do not consistently use the same naming conventions for variables, callables, groups of …

ASP.NET Misconfiguration: Creating Debug Binary

Debugging messages help attackers learn about the system and plan a form of attack.

Struts: Validator Without Form Field

Validation fields that do not appear in forms they are associated with indicate that the validation logic is out of date.

Insufficient Isolation of System-Dependent Functions

The product or code does not isolate system-dependent functionality into separate standalone modules.

Reliance on Runtime Component in Generated Code

The product uses automatically-generated code that cannot be executed without a specific runtime support component.

Reliance on Machine-Dependent Data Representation

The code uses a data representation that relies on low-level data representation or constructs that may vary across different processors, p…

Use of Platform-Dependent Third Party Components

The product relies on third-party components that do not provide equivalent functionality across all desirable platforms.

Use of Unmaintained Third Party Components

The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for…

Insufficient Encapsulation of Machine-Dependent Functionality

The product or code uses machine-dependent functionality, but it does not sufficiently encapsulate or isolate this functionality from the r…

Insufficient Use of Symbolic Constants

The source code uses literal constants that may need to change or evolve over time, instead of using symbolic constants.

Insufficient Isolation of Symbolic Constant Definitions

The source code uses symbolic constants, but it does not sufficiently place the definitions of these constants into a more centralized or i…

Excessive Reliance on Global Variables

The code is structured in a way that relies too much on using or setting global variables throughout various points in the code, instead of …

Use of Same Variable for Multiple Purposes

The code contains a callable, block, or other code element in which the same variable is used to control more than one unique task or store …

Direct Use of Unsafe JNI

When a Java application uses the Java Native Interface (JNI) to call code written in another programming language, it can expose the application to w…

Incomplete Design Documentation

The product's design documentation does not adequately describe control flow, data flow, system initialization, relationships between tasks, …

Incomplete I/O Documentation

The product's documentation does not adequately define inputs, outputs, or system/software interfaces.

Incomplete Documentation of Program Execution

The document does not fully define all mechanisms that are used to control or influence how product-specific programs are executed.

Inappropriate Comment Style

The source code uses comment styles or formats that are inconsistent or do not follow expected standards for the product.

Inappropriate Whitespace Style

The source code contains whitespace that is inconsistent across the code or does not follow expected standards for the product.

Source Code Element without Standard Prologue

The source code contains elements such as source files that do not consistently provide a prologue or header that has been standardized fo…

Inaccurate Comments

The source code contains comments that do not accurately describe or explain aspects of the portion of the code with which the comment is a…

Callable with Insufficient Behavioral Summary

The code contains a function or method whose signature and/or associated inline documentation does not sufficiently describe the callable's inpu…

Insufficient Documentation of Error Handling Techniques

The documentation does not sufficiently describe the techniques that are used for error handling, exception processing, or similar mechanis…

Excessive Use of Unconditional Branching

The code uses too many unconditional branches (such as 'goto').

Missing XML Validation

The product accepts XML from an untrusted source but does not validate the XML against the proper schema.

Excessive Code Complexity

The code is too complex, as calculated using a well-defined, quantitative measure.

CWE ID

Title

Type

Action

Unconditional Control Flow Transfer outside of Switch Block

Insufficient Adherence to Expected Conventions

Floating Point Comparison with Incorrect Operator

Inappropriate Source Code Style or Formatting

Parent Class without Virtual Destructor Method

Struts: Unvalidated Action Form

Source Code File with Excessive Number of Lines of Code

Class Instance Self Destruction Control Element

Data Access from Outside Expected Data Manager Component

Invokable Control Element with Excessive File or Data Access Operations

Invokable Control Element with Excessive Volume of Commented-out Code

Class with Excessive Number of Child Classes

Class with Virtual Method without a Virtual Destructor

Synchronous Access of Remote Resource without Timeout

Struts: Validator Turned Off

Method Containing Access of a Member Element from Another Class

Use of Object without Invoking Destructor Method

Use of Same Invokable Control Element in Multiple Architectural Layers

Excessively Complex Data Representation

Excessive Index Range Scan for a Data Resource

Loop Condition Value Update within the Loop

Singleton Class Instance Creation without Proper Locking or Synchronization

Persistent Storable Data Element without Associated Comparison Control Element

Data Element containing Pointer Item without Proper Copy Control Element

Inconsistent Naming Conventions for Identifiers

ASP.NET Misconfiguration: Creating Debug Binary

Struts: Validator Without Form Field

Insufficient Isolation of System-Dependent Functions

Reliance on Runtime Component in Generated Code

Reliance on Machine-Dependent Data Representation

Use of Platform-Dependent Third Party Components

Use of Unmaintained Third Party Components

Insufficient Encapsulation of Machine-Dependent Functionality

Insufficient Use of Symbolic Constants

Insufficient Isolation of Symbolic Constant Definitions

Excessive Reliance on Global Variables

Use of Same Variable for Multiple Purposes

Direct Use of Unsafe JNI

Incomplete Design Documentation

Incomplete I/O Documentation

Incomplete Documentation of Program Execution

Inappropriate Comment Style

Inappropriate Whitespace Style

Source Code Element without Standard Prologue

Inaccurate Comments

Callable with Insufficient Behavioral Summary

Insufficient Documentation of Error Handling Techniques

Excessive Use of Unconditional Branching

Missing XML Validation

Excessive Code Complexity

1 2 3 4 ... 39