🧩

Common Weakness Enumeration

Explore the comprehensive database of software security weaknesses. CWE provides a unified, measurable set of software weaknesses that enables more effective discussion, description, selection, and use of software security tools and services.

1935

Total CWEs

J2EE Misconfiguration: Weak Access Permissions for EJB Methods

If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Inject…

The product constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incor…

Use of Uninitialized Resource

The product uses or accesses a resource that has not been initialized.

Missing Initialization of Resource

The product does not initialize a critical resource.

XML Injection (aka Blind XPath Injection)

The product does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the …

Use of Expired File Descriptor

The product uses or accesses a file descriptor after it has been closed.

Improper Update of Reference Count

The product uses a reference count to manage a resource, but it does not update or incorrectly updates the reference count.

Hidden Functionality

The product contains functionality that is not documented, not part of the specification, and not accessible through an interface or command sequence…

Improper Control of Dynamically-Managed Code Resources

The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes,…

Improper Control of Dynamically-Identified Variables

The product does not properly restrict reading from or writing to dynamically-identified variables.

Improperly Controlled Modification of Dynamically-Determined Object Attributes

The product receives input from an upstream component that specifies multiple attributes, properties, or fields that are to be initialized or updated…

Use of Password Hash With Insufficient Computational Effort

The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make pa…

Improper Neutralization of Special Elements used in an Expression Language Stat…

The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenc…

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensu…

DEPRECATED: Improper Sanitization of Custom Special Characters

This entry has been deprecated. It originally came from PLOVER, which sometimes defined 'other' and 'miscellaneous' categories in order to satisfy ex…

Improper Restriction of Power Consumption

The product operates in an environment in which power is a limited resource that cannot be automatically replenished, but the product does not proper…

Storage of Sensitive Data in a Mechanism without Access Control

The product stores sensitive information in a file system or device that does not have built-in access control.

Insecure Storage of Sensitive Information

The product stores sensitive information without properly limiting read or write access by unauthorized actors.

Improper Restriction of Communication Channel to Intended Endpoints

The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that…

Improper Enforcement of Message Integrity During Transmission in a Communicatio…

The product establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that …

Improper Verification of Intent by Broadcast Receiver

The Android application uses a Broadcast Receiver that receives an Intent but does not properly verify that the Intent came from an authorized source.

Improper Export of Android Application Components

The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component…

Use of Implicit Intent for Sensitive Communication

The Android application uses an implicit intent for transmitting sensitive data to other applications.

Improper Neutralization of CRLF Sequences ('CRLF Injection')

The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly…

Improper Authorization in Handler for Custom URL Scheme

The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.

Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or inco…

Improper Verification of Source of a Communication Channel

The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify th…

Incorrectly Specified Destination in a Communication Channel

The product creates a communication channel to initiate an outgoing request to an actor, but it does not correctly specify the intended destination f…

Permissive Cross-domain Security Policy with Untrusted Domains

The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the pol…

Improper Neutralization of Special Elements in Data Query Logic

The product generates a query intended to access or manipulate data in a data store such as a database, but it does not neutralize or incorrectly neu…

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Inje…

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a …

Improper Neutralization of Directives in Statically Saved Code ('Static Code In…

The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before inserting the input i…

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

The product generates a web page, but does not neutralize or incorrectly neutralizes user-controllable input that could be interpreted as a server-si…

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP…

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in 'requi…

Improper Control of Resource Identifiers ('Resource Injection')

The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier…

CWE ID

Title

Type

Action

J2EE Misconfiguration: Weak Access Permissions for EJB Methods

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Inject…

Use of Uninitialized Resource

Missing Initialization of Resource

XML Injection (aka Blind XPath Injection)

Use of Expired File Descriptor

Improper Update of Reference Count

Hidden Functionality

Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Identified Variables

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Use of Password Hash With Insufficient Computational Effort

Improper Neutralization of Special Elements used in an Expression Language Stat…

Server-Side Request Forgery (SSRF)

DEPRECATED: Improper Sanitization of Custom Special Characters

Improper Restriction of Power Consumption

Storage of Sensitive Data in a Mechanism without Access Control

Insecure Storage of Sensitive Information

Improper Restriction of Communication Channel to Intended Endpoints

Improper Enforcement of Message Integrity During Transmission in a Communicatio…

Improper Verification of Intent by Broadcast Receiver

Improper Export of Android Application Components

Use of Implicit Intent for Sensitive Communication

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Improper Authorization in Handler for Custom URL Scheme

Improper Control of Generation of Code ('Code Injection')

Improper Verification of Source of a Communication Channel

Incorrectly Specified Destination in a Communication Channel

Permissive Cross-domain Security Policy with Untrusted Domains

Improper Neutralization of Special Elements in Data Query Logic

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Inje…

Improper Neutralization of Directives in Statically Saved Code ('Static Code In…

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP…

Improper Control of Resource Identifiers ('Resource Injection')

1 ... 37 38 39