CWE Database

Improper Access Control

Improper Interaction Between Multiple Correctly-Behaving Entities

Improper Control of a Resource Through its Lifetime

Incorrect Calculation

Insufficient Control Flow Management

Protection Mechanism Failure

Incorrect Comparison

Improper Check or Handling of Exceptional Conditions

Improper Neutralization

Improper Adherence to Coding Standards

Incomplete Comparison with Missing Factors

Insecure Automated Optimizations

Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

Insufficient Technical Documentation

Insufficient Encapsulation

Insufficient Adherence to Expected Conventions

Inappropriate Source Code Style or Formatting

Excessively Complex Data Representation

Excessive Code Complexity

Process Control

Improper Encoding or Escaping of Output

Irrelevant Code

Inefficient CPU Computation

Use of Prohibited Code

Incorrect Access of Indexable Resource ('Range Error')

Improper Restriction of Operations within the Bounds of a Memory Buffer

Creation of Emergent Resource

Improper Physical Access Control

Insecure Security Identifier Mechanism

Reliance on Insufficiently Trustworthy Component

Insufficient Visual Distinction of Homoglyphs Presented to User

Improper Restriction of Rendered UI Layers or Frames

Comparison of Incompatible Types

Comparison Using Wrong Factors

Processor Optimization Removal or Modification of Security-critical Code

Use of Redundant Code

Data Element Aggregating an Excessively Large Number of Non-Primitive Elements

Architecture with Number of Horizontal Layers Outside of Expected Range

Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor

Creation of Immutable Text Using String Concatenation

Modules with Circular Dependencies

Invokable Control Element with Large Number of Outward Calls

Excessive Data Query Operations in a Large Data Table

Excessive Platform Resource Consumption within a Loop

Initialization with Hard-Coded Network Resource Configuration Data

Excessive Use of Hard-Coded Literals in Initialization

Missing Documentation for Design

Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer

Multiple Inheritance from Concrete Classes

Invokable Control Element with Variadic Parameters

Sensitive Cookie Without 'HttpOnly' Flag

Struts: Duplicate Validation Forms

Use of Web Link to Untrusted Target with window.opener Access

Struts: Incomplete validate() Method Definition

Struts: Form Bean Does Not Extend Validation Class

Static Member Data Element outside of a Singleton Class Element

Struts: Form Field Without Validator

Struts: Plug-in Framework not in Use

Empty Exception Block

Struts: Unused Validation Form

Floating Point Comparison with Incorrect Operator

Struts: Unvalidated Action Form

Struts: Validator Turned Off

Singleton Class Instance Creation without Proper Locking or Synchronization

ASP.NET Misconfiguration: Creating Debug Binary

Struts: Validator Without Form Field

Direct Use of Unsafe JNI

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

ASP.NET Misconfiguration: Improper Model Validation

ASP.NET Misconfiguration: Missing Custom Error Page

Cross-Site Request Forgery (CSRF)

Session Fixation

UNIX Symbolic Link (Symlink) Following

Integer Overflow to Buffer Overflow

Permission Race Condition During Resource Copy

Unchecked Return Value to NULL Pointer Dereference

Incomplete Denylist to Cross-Site Scripting