At its core, Common Weakness Enumeration (CWE) is a community-developed list of software weaknesses. CWE provides a taxonomy to categorize and describe software weaknesses—giving developers and security practitioners a common language for software security.
MITRE owns and maintains the project. To learn more about CWE, click here.
Search below to see Coverity's CWE support of languages in your codebase:
| Language | CWE | Name | Coverity Checker |
|---|---|---|---|
| Android | 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
|
| Android | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
|
| Android | 79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
|
| Android | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| Android | 94 | Improper Control of Generation of Code ('Code Injection') |
|
| Android | 99 | Improper Control of Resource Identifiers ('Resource Injection') |
|
| Android | 209 | Information Exposure Through an Error Message |
|
| Android | 215 | Information Exposure Through Debug Information |
|
| Android | 259 | Use of Hard-coded Password |
|
| Android | 296 | Improper Following of a Certificate's Chain of Trust |
|
| Android | 297 | Improper Validation of Certificate with Host Mismatch |
|
| Android | 299 | Improper Check for Certificate Revocation |
|
| Android | 311 | Missing Encryption of Sensitive Data |
|
| Android | 312 | Cleartext Storage of Sensitive Information |
|
| Android | 313 | Cleartext Storage in a File or on Disk |
|
| Android | 317 | Cleartext Storage of Sensitive Information in GUI |
|
| Android | 319 | Cleartext Transmission of Sensitive Information |
|
| Android | 321 | Use of Hard-coded Cryptographic Key |
|
| Android | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| Android | 328 | Reversible One-Way Hash |
|
| Android | 330 | Use of Insufficiently Random Values |
|
| Android | 336 | Same Seed in PRNG |
|
| Android | 337 | Predictable Seed in PRNG |
|
| Android | 470 | Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) |
|
| Android | 502 | Deserialization of Untrusted Data |
|
| Android | 530 | Exposure of Backup File to an Unauthorized Control Sphere |
|
| Android | 532 | Information Exposure Through Log Files |
|
| Android | 538 | File and Directory Information Exposure |
|
| Android | 611 | Improper Restriction of XML External Entity Reference ('XXE') |
|
| Android | 759 | Use of a One-Way Hash without a Salt |
|
| Android | 760 | Use of a One-Way Hash with a Predictable Salt |
|
| Android | 776 | Use of a One-Way Hash with a Predictable Salt |
|
| Android | 798 | Use of Hard-coded Credentials |
|
| Android | 827 | Improper Control of Document Type Definition |
|
| Android | 916 | Use of Password Hash With Insufficient Computational Effort |
|
| Android | 921 | Storage of Sensitive Data in a Mechanism without Access Control |
|
| Android | 926 | Improper Export of Android Application Components |
|
| Android | 927 | Use of Implicit Intent for Sensitive Communication |
|
| C# | 10 | ASP.NET Environment Issues |
|
| C# | 11 | Security Misconfiguration |
|
| C# | 12 | Missing Custom Error Page |
|
| C# | 13 | Unencrypted Connection String Password |
|
| C# | 20 | Improper Input Validation |
|
| C# | 21 | Pathname Traversal and Equivalence Errors |
|
| C# | 22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
|
| C# | 23 | Relative Path Traversal |
|
| C# | 36 | Absolute Path Traversal |
|
| C# | 73 | External Control of File Name or Path |
|
| C# | 77 | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) |
|
| C# | 78 | Improper Neutralization of Special Elements used in an OS Command (‘OSCommand Injection’) |
|
| C# | 79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
|
| C# | 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
|
| C# | 82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page |
|
| C# | 83 | Improper Neutralization of Script in Attributes in a Web Page |
|
| C# | 85 | Doubled Character XSS Manipulations |
|
| C# | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages |
|
| C# | 87 | Improper Neutralization of Alternate XSS Syntax |
|
| C# | 88 | Argument Injection or Modification |
|
| C# | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| C# | 90 | Improper Neutralization of Special Elements used in an LDAP Query |
|
| C# | 91 | XML Injection (aka Blind XPath Injection) |
|
| C# | 94 | Improper Control of Generation of Code (‘Code Injection’) |
|
| C# | 117 | Improper Output Neutralization for Logs |
|
| C# | 171 | Cleansing, Canonicalization, and Comparison Errors |
|
| C# | 190 | Integer Overflow or Wraparound |
|
| C# | 200 | Information Exposure |
|
| C# | 209 | Information Exposure Through an Error Message |
|
| C# | 259 | Use of Hard-coded Password |
|
| C# | 285 | Missing Authorization Check |
|
| C# | 313 | Cleartext Storage in a File or on Disk |
|
| C# | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| C# | 319 | Cleartext Transmission of Sensitive Information |
|
| C# | 321 | Use of Hard-coded Cryptographic Key |
|
| C# | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| C# | 328 | Reversible One-Way Hash |
|
| C# | 330 | Use of Insufficiently Random Values |
|
| C# | 352 | Cross-Site Request Forgery (CSRF) |
|
| C# | 366 | Race Condition within a Thread |
|
| C# | 369 | Divide By Zero |
|
| C# | 390 | Detection of Error Condition Without Action |
|
| C# | 398 | Indicator of Poor Code Quality |
|
| C# | 403 | Exposure of File Descriptor to Unintended Control Sphere (‘File Descriptor Leak’) |
|
| C# | 404 | Improper Resource Shutdown or Release |
|
| C# | 476 | NULL Pointer Dereference |
|
| C# | 480 | Use of Incorrect Operator |
|
| C# | 502 | Deserialization of Untrusted Data |
|
| C# | 519 | Disabled View State MAC generation |
|
| C# | 532 | Information Exposure Through Log Files |
|
| C# | 543 | Use of Singleton Pattern Without Synchronization in a Multithreaded Context |
|
| C# | 561 | Dead Code |
|
| C# | 563 | Assignment to Variable without Use (‘Unused Variable’) |
|
| C# | 569 | Expression Issues |
|
| C# | 570 | Expression is Always False |
|
| C# | 573 | Improper Following of Specification by Caller |
|
| C# | 595 | Comparison of Object References Instead of Object Contents |
|
| C# | 601 | URL Redirection to Untrusted Site ('Open Redirect') |
|
| C# | 609 | Double-Checked Locking |
|
| C# | 610 | Externally Controlled Reference to a Resource in Another Sphere |
|
| C# | 611 | Improper Restriction of XML External Entity Reference ('XXE') |
|
| C# | 670 | Always-Incorrect Control Flow Implementation |
|
| C# | 683 | Function Call With Incorrect Order of Arguments |
|
| C# | 759 | Use of a One-Way Hash without a Salt |
|
| C# | 760 | Use of a One-Way Hash with a Predictable Salt |
|
| C# | 776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
|
| C# | 778 | Insufficient Logging |
|
| C# | 783 | Operator Precedence Logic Error |
|
| C# | 798 | Use of Hard-coded Credentials |
|
| C# | 827 | Improper Control of Document Type Definition |
|
| C# | 833 | Deadlock |
|
| C# | 835 | Loop with Unreachable Exit Condition (‘Infinite Loop’) |
|
| C# | 863 | Incorrect Authorization |
|
| C# | 916 | Use of Password Hash With Insufficient Computational Effort |
|
| C/C++ & Objective-C | 20 | Improper Input Validation |
|
| C/C++ & Objective-C | 22 | Filesystem path, filename, or URI manipulation |
|
| C/C++ & Objective-C | 78 | OS Command Injection |
|
| C/C++ & Objective-C | 89 | SQL injection |
|
| C/C++ & Objective-C | 119 | Improper Restriction of Operations within the Bounds of a Memory Buffer |
|
| C/C++ & Objective-C | 120 | Buffer Copy without Checking Size of Input (‘Classic Buffer Overflow’) |
|
| C/C++ & Objective-C | 125 | Out-of-bounds Read |
|
| C/C++ & Objective-C | 129 | Improper Validation of Array Index |
|
| C/C++ & Objective-C | 131 | Incorrect Calculation of Buffer Size |
|
| C/C++ & Objective-C | 134 | Uncontrolled Format String |
|
| C/C++ & Objective-C | 170 | Improper Null Termination |
|
| C/C++ & Objective-C | 188 | Reliance on Data/Memory Layout |
|
| C/C++ & Objective-C | 190 | Integer Overflow or Wraparound |
|
| C/C++ & Objective-C | 194 | Unexpected Sign Extension |
|
| C/C++ & Objective-C | 195 | Signed to Unsigned Conversion Error |
|
| C/C++ & Objective-C | 197 | Numeric Truncation Error |
|
| C/C++ & Objective-C | 243 | Creation of chroot Jail Without Changing Working Directory |
|
| C/C++ & Objective-C | 248 | Uncaught Exception |
|
| C/C++ & Objective-C | 252 | Unchecked Return Value |
|
| C/C++ & Objective-C | 253 | Incorrect Check of Function Return Value |
|
| C/C++ & Objective-C | 259 | Use of Hard-coded Password |
|
| C/C++ & Objective-C | 290 | Authentication Bypass by Spoofing |
|
| C/C++ & Objective-C | 291 | Reliance on IP Address for Authentication |
|
| C/C++ & Objective-C | 293 | Using Referer Field for Authentication |
|
| C/C++ & Objective-C | 313 | Cleartext Storage in a File or on Disk |
|
| C/C++ & Objective-C | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| C/C++ & Objective-C | 319 | Cleartext Transmission of Sensitive Information |
|
| C/C++ & Objective-C | 321 | Use of Hard-coded Cryptographic Key |
|
| C/C++ & Objective-C | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| C/C++ & Objective-C | 328 | Reversible One-Way Hash |
|
| C/C++ & Objective-C | 350 | Reliance on Reverse DNS Resolution for a Security-Critical Action |
|
| C/C++ & Objective-C | 366 | Race Condition within a Thread |
|
| C/C++ & Objective-C | 367 | Time-of-check Time-of-use (TOCTOU) Race Condition |
|
| C/C++ & Objective-C | 369 | Divide By Zero |
|
| C/C++ & Objective-C | 377 | Insecure Temporary File |
|
| C/C++ & Objective-C | 394 | Unexpected Status Code or Return Value |
|
| C/C++ & Objective-C | 398 | Indicator of Poor Code Quality |
|
| C/C++ & Objective-C | 400 | Uncontrolled Resource Consumption (‘Resource Exhaustion’) |
|
| C/C++ & Objective-C | 401 | Improper Release of Memory Before Removing Last Reference (‘Memory Leak’) |
|
| C/C++ & Objective-C | 404 | Improper Resource Shutdown or Release |
|
| C/C++ & Objective-C | 415 | Double Free |
|
| C/C++ & Objective-C | 416 | Use After Free |
|
| C/C++ & Objective-C | 456 | Missing Initialization of a Variable |
|
| C/C++ & Objective-C | 457 | Use of Uninitialized Variable |
|
| C/C++ & Objective-C | 459 | Incomplete Cleanup |
|
| C/C++ & Objective-C | 465 | Pointer Issues |
|
| C/C++ & Objective-C | 467 | Use of sizeof() on a Pointer Type |
|
| C/C++ & Objective-C | 475 | Invalid printf format string |
|
| C/C++ & Objective-C | 476 | NULL Pointer Dereference |
|
| C/C++ & Objective-C | 480 | Use of Incorrect Operator |
|
| C/C++ & Objective-C | 481 | Assigning instead of Comparing |
|
| C/C++ & Objective-C | 482 | Comparing instead of Assigning |
|
| C/C++ & Objective-C | 483 | Incorrect Block Delimitation |
|
| C/C++ & Objective-C | 484 | Omitted Break Statement in Switch |
|
| C/C++ & Objective-C | 561 | Dead Code |
|
| C/C++ & Objective-C | 562 | Return of Stack Variable Address |
|
| C/C++ & Objective-C | 563 | Assignment to Variable without Use (‘Unused Variable’) |
|
| C/C++ & Objective-C | 569 | Expression Issues |
|
| C/C++ & Objective-C | 570 | Expression is Always False |
|
| C/C++ & Objective-C | 573 | Improper Following of Specification by Caller |
|
| C/C++ & Objective-C | 584 | Return Inside Finally Block |
|
| C/C++ & Objective-C | 590 | Free of Memory not on the Heap |
|
| C/C++ & Objective-C | 597 | Use of Wrong Operator in String Comparison |
|
| C/C++ & Objective-C | 606 | Unchecked Input for Loop Condition |
|
| C/C++ & Objective-C | 617 | Reachable Assertion |
|
| C/C++ & Objective-C | 628 | Function Call with Incorrectly Specified Arguments |
|
| C/C++ & Objective-C | 633 | Weaknesses that Affect Memory |
|
| C/C++ & Objective-C | 643 | XML Path (XPath) Language injection |
|
| C/C++ & Objective-C | 662 | Improper Synchronization |
|
| C/C++ & Objective-C | 665 | Improper Initialization |
|
| C/C++ & Objective-C | 667 | Improper Locking |
|
| C/C++ & Objective-C | 670 | Always-Incorrect Control Flow Implementation |
|
| C/C++ & Objective-C | 672 | Operation on a Resource after Expiration or Release |
|
| C/C++ & Objective-C | 676 | Use of Potentially Dangerous Function |
|
| C/C++ & Objective-C | 681 | Incorrect Conversion between Numeric Types |
|
| C/C++ & Objective-C | 683 | Function Call With Incorrect Order of Arguments |
|
| C/C++ & Objective-C | 685 | Function Call With Incorrect Number of Arguments |
|
| C/C++ & Objective-C | 685 | Extra argument to printf format specifier |
|
| C/C++ & Objective-C | 686 | Function Call With Incorrect Argument Type |
|
| C/C++ & Objective-C | 686 | Invalid type in argument to printf format specifier |
|
| C/C++ & Objective-C | 687 | Function Call With Incorrectly Specified Argument Value |
|
| C/C++ & Objective-C | 704 | Incorrect Type Conversion or Cast |
|
| C/C++ & Objective-C | 710 | Coding Standards Violation |
|
| C/C++ & Objective-C | 758 | Reliance on Undefined, Unspecified, or Implementation-Defined Behavior |
|
| C/C++ & Objective-C | 759 | Use of a One-Way Hash without a Salt |
|
| C/C++ & Objective-C | 760 | Use of a One-Way Hash with a Predictable Salt |
|
| C/C++ & Objective-C | 762 | Mismatched Memory Management Routines |
|
| C/C++ & Objective-C | 764 | Multiple Locks of a Critical Resource |
|
| C/C++ & Objective-C | 772 | Missing Release of Resource after Effective Lifetime |
|
| C/C++ & Objective-C | 775 | Missing Release of File Descriptor or Handle after Effective Lifetime |
|
| C/C++ & Objective-C | 783 | Operator Precedence Logic Error |
|
| C/C++ & Objective-C | 798 | Use of Hard-coded Credentials |
|
| C/C++ & Objective-C | 833 | Deadlock |
|
| C/C++ & Objective-C | 835 | Loop with Unreachable Exit Condition (‘Infinite Loop’) |
|
| C/C++ & Objective-C | 916 | Use of Password Hash With Insufficient Computational Effort |
|
| Java | 4 | J2EE Environment Issues |
|
| Java | 7 | J2EE Misconfiguration: Missing Custom Error Page |
|
| Java | 11 | ASP.NET Misconfiguration: Creating Debug Binary |
|
| Java | 20 | Improper Input Validation |
|
| Java | 21 | Pathname Traversal and Equivalence Errors |
|
| Java | 22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
|
| Java | 23 | Relative Path Traversal |
|
| Java | 36 | Absolute Path Traversal |
|
| Java | 73 | External Control of File Name or Path |
|
| Java | 77 | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) |
|
| Java | 78 | Improper Neutralization of Special Elements used in an OS Command (‘OSCommand Injection’) |
|
| Java | 79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
|
| Java | 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
|
| Java | 81 | Improper Neutralization of Script in an Error Message Web Page |
|
| Java | 82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page |
|
| Java | 83 | Improper Neutralization of Script in Attributes in a Web Page |
|
| Java | 85 | Doubled Character XSS Manipulations |
|
| Java | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages |
|
| Java | 87 | Improper Neutralization of Alternate XSS Syntax |
|
| Java | 88 | Argument Injection or Modification |
|
| Java | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| Java | 90 | Improper Neutralization of Special Elements used in an LDAP Query (‘LDAP Injection’) |
|
| Java | 91 | XML Injection (aka Blind XPath Injection) |
|
| Java | 94 | Improper Control of Generation of Code (‘Code Injection’) |
|
| Java | 99 | Improper Control of Resource Identifiers (‘Resource Injection’) |
|
| Java | 113 | Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Response Splitting’) |
|
| Java | 185 | Incorrect Regular Expression |
|
| Java | 190 | Integer Overflow or Wraparound |
|
| Java | 192 | Integer Coercion Error |
|
| Java | 200 | Information Exposure |
|
| Java | 209 | Information Exposure Through an Error Message |
|
| Java | 218 | DEPRECATED (Duplicate): Failure to provide confidentiality for stored data |
|
| Java | 227 | Improper Fulfillment of API Contract (‘API Abuse’) |
|
| Java | 247 | DEPRECATED (Duplicate): Reliance on DNS Lookups in a Security Decision |
|
| Java | 252 | Unchecked Return Value |
|
| Java | 253 | Incorrect Check of Function Return Value |
|
| Java | 259 | Use of Hard-coded Password |
|
| Java | 285 | Improper Authorization |
|
| Java | 290 | Authentication Bypass by Spoofing |
|
| Java | 291 | Reliance on IP Address for Authentication |
|
| Java | 293 | Using Referer Field for Authentication |
|
| Java | 296 | Improper Following of a Certificate’s Chain of Trust |
|
| Java | 297 | Improper Validation of Certificate with Host Mismatch |
|
| Java | 299 | Improper Check for Certificate Revocation |
|
| Java | 311 | Missing Encryption of Sensitive Data |
|
| Java | 312 | Cleartext Storage of Sensitive Information |
|
| Java | 313 | Cleartext Storage in a File or on Disk |
|
| Java | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| Java | 317 | Cleartext Storage of Sensitive Information in GUI |
|
| Java | 319 | Cleartext Transmission of Sensitive Information |
|
| Java | 321 | Use of Hard-coded Cryptographic Key |
|
| Java | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| Java | 328 | Reversible One-Way Hash |
|
| Java | 330 | Use of Insufficiently Random Values |
|
| Java | 337 | Predictable Seed in PRNG |
|
| Java | 350 | Reliance on Reverse DNS Resolution for a Security-Critical Action |
|
| Java | 352 | Cross-Site Request Forgery (CSRF) |
|
| Java | 366 | Race Condition within a Thread |
|
| Java | 369 | Divide By Zero |
|
| Java | 374 | Passing Mutable Objects to an Untrusted Method |
|
| Java | 382 | J2EE Bad Practices: Use of System.exit() |
|
| Java | 384 | Session Fixation |
|
| Java | 390 | Detection of Error Condition Without Action |
|
| Java | 391 | Unchecked Error Condition |
|
| Java | 396 | Declaration of Catch for Generic Exception |
|
| Java | 398 | Indicator of Poor Code Quality |
|
| Java | 403 | Exposure of File Descriptor to Unintended Control Sphere (‘File Descriptor Leak’) |
|
| Java | 404 | J2EE Misconfiguration: Missing Custom Error PageImproper Resource Shutdown or Release |
|
| Java | 425 | Direct Request (‘Forced Browsing’) |
|
| Java | 427 | Uncontrolled Search Path Element |
|
| Java | 440 | Expected Behavior Violation |
|
| Java | 470 | Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) |
|
| Java | 476 | NULL Pointer Dereference |
|
| Java | 480 | Use of Incorrect Operator |
|
| Java | 481 | Assigning instead of Comparing |
|
| Java | 483 | Incorrect Block Delimitation |
|
| Java | 484 | Omitted Break Statement in Switch |
|
| Java | 501 | Trust Boundary Violation |
|
| Java | 502 | Deserialization of Untrusted Data |
|
| Java | 532 | Information Exposure Through Log Files |
|
| Java | 538 | File and Directory Information Exposure |
|
| Java | 543 | Use of Singleton Pattern Without Synchronization in a Multithreaded Context |
|
| Java | 561 | Dead Code |
|
| Java | 563 | Assignment to Variable without Use (‘Unused Variable’) |
|
| Java | 564 | SQL Injection: Hibernate |
|
| Java | 567 | Unsynchronized Access to Shared Data in a Multithreaded Context |
|
| Java | 568 | finalize() Method Without super.finalize() |
|
| Java | 569 | Expression Issues |
|
| Java | 570 | Expression is Always False |
|
| Java | 571 | Expression is Always True |
|
| Java | 572 | Call to Thread run() instead of start() |
|
| Java | 573 | Improper Following of Specification by Caller |
|
| Java | 579 | J2EE Bad Practices: Non-serializable Object Stored in Session |
|
| Java | 580 | clone() Method Without super.clone() |
|
| Java | 583 | finalize() Method Declared Public |
|
| Java | 585 | Empty Synchronized Block |
|
| Java | 586 | Explicit Call to Finalize() |
|
| Java | 595 | Comparison of Object References Instead of Object Contents |
|
| Java | 596 | Incorrect Semantic Object Comparison |
|
| Java | 597 | Use of Wrong Operator in String Comparison |
|
| Java | 601 | URL Redirection to Untrusted Site (‘Open Redirect’) |
|
| Java | 609 | Double-Checked Locking |
|
| Java | 610 | Externally Controlled Reference to a Resource in Another Sphere |
|
| Java | 611 | Improper Restriction of XML External Entity Reference (‘XXE’) |
|
| Java | 613 | Insufficient Session Expiration |
|
| Java | 615 | Information Exposure Through Comments |
|
| Java | 643 | Improper Neutralization of Data within XPath Expressions (‘XPath Injection’) |
|
| Java | 650 | Trusting HTTP Permission Methods on the Server Side |
|
| Java | 662 | Improper Synchronization |
|
| Java | 670 | Always-Incorrect Control Flow Implementation |
|
| Java | 672 | Operation on a Resource after Expiration or Release |
|
| Java | 674 | Uncontrolled Recursion |
|
| Java | 676 | Use of Potentially Dangerous Function |
|
| Java | 683 | Function Call With Incorrect Order of Arguments |
|
| Java | 731 | OWASP Top Ten 2004 Category A10 – Insecure Configuration Management |
|
| Java | 759 | Use of a One-Way Hash without a Salt |
|
| Java | 760 | Use of a One-Way Hash with a Predictable Salt |
|
| Java | 776 | Improper Restriction of Recursive Entity References in DTDs (‘XML Entity Expansion’) |
|
| Java | 778 | Insufficient Logging |
|
| Java | 783 | Operator Precedence Logic Error |
|
| Java | 798 | Use of Hard-coded Credentials |
|
| Javascript | 20 | Improper Input Validation |
|
| Javascript | 22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
|
| Javascript | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
|
| Javascript | 78 | Improper Neutralization of Special Elements used in an OS Command (‘OSCommand Injection’) |
|
| Javascript | 79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
|
| Javascript | 88 | Argument Injection or Modification |
|
| Javascript | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| Javascript | 94 | Improper Control of Generation of Code (‘Code Injection’) |
|
| Javascript | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) |
|
| Javascript | 99 | Improper Control of Resource Identifiers ('Resource Injection') |
|
| Javascript | 209 | Information Exposure Through an Error Message |
|
| Javascript | 285 | Improper Authorization |
|
| Javascript | 295 | Improper Certificate Validation |
|
| Javascript | 313 | Cleartext Storage in a File or on Disk |
|
| Javascript | 313 | Cleartext Sensitive Data in a Database |
|
| Javascript | 314 | Cleartext Storage in the Registry |
|
| Javascript | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| Javascript | 317 | Cleartext Storage of Sensitive Information in GUI |
|
| Javascript | 319 | Cleartext Transmission of Sensitive Information |
|
| Javascript | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| Javascript | 328 | Reversible One-Way Hash |
|
| Javascript | 346 | Origin Validation Error |
|
| Javascript | 352 | Cross-Site Request Forgery (CSRF) |
|
| Javascript | 398 | Indicator of Poor Code Quality |
|
| Javascript | 400 | Uncontrolled Resource Consumption |
|
| Javascript | 476 | NULL Pointer Dereference |
|
| Javascript | 480 | Use of Incorrect Operator |
|
| Javascript | 482 | Comparing instead of Assigning |
|
| Javascript | 483 | Incorrect Block Delimitation |
|
| Javascript | 484 | Omitted Break Statement in Switch |
|
| Javascript | 532 | Information Exposure Through Log Files |
|
| Javascript | 561 | Dead Code |
|
| Javascript | 569 | Expression Issues |
|
| Javascript | 601 | URL Redirection to Untrusted Site (‘Open Redirect’) |
|
| Javascript | 611 | Improper Restriction of XML External Entity Reference ('XXE') |
|
| Javascript | 613 | Insufficient Session Expiration |
|
| Javascript | 628 | Function Call with Incorrectly Specified Arguments |
|
| Javascript | 665 | Improper Initialization |
|
| Javascript | 668 | Exposure of Resource to Wrong Sphere |
|
| Javascript | 670 | Always-Incorrect Control Flow Implementation |
|
| Javascript | 688 | Function Call With Incorrect Variable or Reference as Argument |
|
| Javascript | 760 | Use of a One-Way Hash with a Predictable Salt |
|
| Javascript | 776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
|
| Javascript | 778 | Insufficient logging |
|
| Javascript | 783 | Operator Precedence Logic Error |
|
| Javascript | 798 | Use of Hard-coded Credentials |
|
| Javascript | 829 | Inclusion of Functionality from Untrusted Control Sphere |
|
| Javascript | 922 | Insecure Storage of Sensitive Information |
|
| Node.js | 22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
|
| Node.js | 78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |
|
| Node.js | 79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
|
| Node.js | 88 | Argument Injection or Modification |
|
| Node.js | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| Node.js | 94 | Improper Control of Generation of Code (‘Code Injection’) |
|
| Node.js | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) |
|
| Node.js | 209 | Information Exposure Through an Error Message |
|
| Node.js | 285 | Improper Authorization |
|
| Node.js | 313 | Cleartext Storage in a File or on Disk |
|
| Node.js | 313 | Cleartext Sensitive Data in a Database |
|
| Node.js | 314 | Cleartext Storage in the Registry |
|
| Node.js | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| Node.js | 317 | Cleartext Storage of Sensitive Information in GUI |
|
| Node.js | 319 | Cleartext Transmission of Sensitive Information |
|
| Node.js | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| Node.js | 328 | Reversible One-Way Hash |
|
| Node.js | 352 | Cross-Site Request Forgery (CSRF) |
|
| Node.js | 398 | Indicator of Poor Code Quality |
|
| Node.js | 476 | NULL Pointer Dereference |
|
| Node.js | 480 | Use of Incorrect Operator |
|
| Node.js | 483 | Incorrect Block Delimitation |
|
| Node.js | 484 | Omitted Break Statement in Switch |
|
| Node.js | 532 | Information Exposure Through Log Files |
|
| Node.js | 561 | Dead Code |
|
| Node.js | 569 | Expression Issues |
|
| Node.js | 601 | URL Redirection to Untrusted Site (‘Open Redirect’) |
|
| Node.js | 665 | Improper Initialization |
|
| Node.js | 688 | Function Call With Incorrect Variable or Reference as Argument |
|
| Node.js | 670 | Always-Incorrect Control Flow Implementation |
|
| Node.js | 783 | Operator Precedence Logic Error |
|
| Node.js | 798 | Use of Hard-coded Credentials |
|
| PHP | 20 | Improper Input Validation |
|
| PHP | 21 | Pathname Traversal and Equivalence Errors |
|
| PHP | 22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
|
| PHP | 23 | Relative Path Traversal |
|
| PHP | 36 | Relative Path Traversal |
|
| PHP | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) |
|
| PHP | 78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |
|
| PHP | 79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
|
| PHP | 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
|
| PHP | 82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page |
|
| PHP | 83 | Improper Neutralization of Script in Attributes in a Web Page |
|
| PHP | 85 | Doubled Character XSS Manipulations |
|
| PHP | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages |
|
| PHP | 87 | Improper Neutralization of Alternate XSS Syntax |
|
| PHP | 88 | Argument Injection or Modification |
|
| PHP | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| PHP | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) |
|
| PHP | 209 | Information Exposure Through an Error Message |
|
| PHP | 313 | Cleartext Sensitive Data in a Database |
|
| PHP | 313 | Cleartext Storage in a File or on Disk |
|
| PHP | 314 | Cleartext Storage in the Registry |
|
| PHP | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| PHP | 317 | Cleartext Storage of Sensitive Information in GUI |
|
| PHP | 319 | Cleartext Transmission of Sensitive Information |
|
| PHP | 398 | Indicator of Poor Code Quality |
|
| PHP | 476 | NULL Pointer Dereference |
|
| PHP | 480 | Use of Incorrect Operator |
|
| PHP | 482 | Comparing instead of Assigning |
|
| PHP | 483 | Incorrect Block Delimitation |
|
| PHP | 484 | Omitted Break Statement in Switch |
|
| PHP | 502 | Deserialization of Untrusted Data |
|
| PHP | 532 | Information Exposure Through Log Files |
|
| PHP | 561 | Dead Code |
|
| PHP | 569 | Expression Issues |
|
| PHP | 611 | Improper Restriction of XML External Entity Reference ('XXE') |
|
| PHP | 665 | Improper Initialization |
|
| PHP | 670 | Always-Incorrect Control Flow Implementation |
|
| PHP | 688 | Function Call With Incorrect Variable or Reference as Argument |
|
| PHP | 783 | Operator Precedence Logic Error |
|
| PHP | 798 | Use of Hard-coded Credentials |
|
| Python | 20 | Improper Input Validation |
|
| Python | 21 | Pathname Traversal and Equivalence Errors |
|
| Python | 22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) |
|
| Python | 23 | Relative Path Traversal |
|
| Python | 36 | Absolute Path Traversal |
|
| Python | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) |
|
| Python | 78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |
|
| Python | 79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) |
|
| Python | 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
|
| Python | 82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page |
|
| Python | 83 | Improper Neutralization of Script in Attributes in a Web Page |
|
| Python | 85 | Doubled Character XSS Manipulations |
|
| Python | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages |
|
| Python | 87 | Improper Neutralization of Alternate XSS Syntax |
|
| Python | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| Python | 94 | Improper Control of Generation of Code (‘Code Injection’) |
|
| Python | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code (‘Eval Injection’) |
|
| Python | 209 | Information Exposure Through an Error Message |
|
| Python | 313 | Cleartext Sensitive Data in a Database |
|
| Python | 313 | Cleartext Storage in a File or on Disk |
|
| Python | 314 | Cleartext Storage in the Registry |
|
| Python | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| Python | 317 | Cleartext Storage of Sensitive Information in GUI |
|
| Python | 319 | Cleartext Transmission of Sensitive Information |
|
| Python | 398 | Indicator of Poor Code Quality |
|
| Python | 476 | NULL Pointer Dereference |
|
| Python | 480 | Use of Incorrect Operator |
|
| Python | 502 | Deserialization of Untrusted Data |
|
| Python | 532 | Information Exposure Through Log Files |
|
| Python | 561 | Dead Code |
|
| Python | 569 | Expression Issues |
|
| Python | 601 | URL Redirection to Untrusted Site (‘Open Redirect’) |
|
| Python | 611 | Improper Restriction of XML External Entity Reference ('XXE') |
|
| Python | 688 | Function Call With Incorrect Variable or Reference as Argument |
|
| Python | 783 | Operator Precedence Logic Error |
|
| Ruby | 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
|
| Ruby | 73 | External Control of File Name or Path |
|
| Ruby | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
|
| Ruby | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
|
| Ruby | 83 | Improper Neutralization of Script in Attributes in a Web Page |
|
| Ruby | 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
|
| Ruby | 94 | Improper Control of Generation of Code ('Code Injection') |
|
| Ruby | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') |
|
| Ruby | 113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting'). |
|
| Ruby | 183 | Permissive Whitelist |
|
| Ruby | 184 | Incomplete Blacklist |
|
| Ruby | 209 | Information Exposure Through an Error Message |
|
| Ruby | 215 | Information Exposure Through Debug Information |
|
| Ruby | 259 | Use of Hard-coded Password |
|
| Ruby | 263 | Password Aging with Long Expiration |
|
| Ruby | 287 | Improper Authentication |
|
| Ruby | 289 | Authentication Bypass by Alternate Name |
|
| Ruby | 307 | Improper Restriction of Excessive Authentication Attempts |
|
| Ruby | 321 | Use of Hard-coded Cryptographic Key |
|
| Ruby | 352 | Cross-Site Request Forgery (CSRF) |
|
| Ruby | 369 | Divide By Zero |
|
| Ruby | 398 | Indicator of Poor Code Quality |
|
| Ruby | 400 | Uncontrolled Resource Consumption ('Resource Exhaustion'). |
|
| Ruby | 470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') |
|
| Ruby | 476 | NULL Pointer Dereference |
|
| Ruby | 480 | Use of Incorrect Operator |
|
| Ruby | 482 | Comparing instead of Assigning |
|
| Ruby | 483 | Incorrect Block Delimitation |
|
| Ruby | 484 | Omitted Break Statement in Switch |
|
| Ruby | 502 | Deserialization of Untrusted Data |
|
| Ruby | 521 | Weak Password Requirements |
|
| Ruby | 561 | Dead Code |
|
| Ruby | 569 | Expression Issues |
|
| Ruby | 599 | Missing Validation of OpenSSL Certificate |
|
| Ruby | 601 | URL Redirection to Untrusted Site ('Open Redirect') |
|
| Ruby | 614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute |
|
| Ruby | 639 | Authorization Bypass Through User-Controlled Key |
|
| Ruby | 642 | External Control of Critical State Data |
|
| Ruby | 665 | Improper Initialization |
|
| Ruby | 688 | Function Call With Incorrect Variable or Reference as Argument |
|
| Ruby | 704 | Incorrect Type Conversion or Cast |
|
| Ruby | 777 | Regular Expression without Anchors. |
|
| Ruby | 783 | Operator Precedence Logic Error |
|
| Ruby | 798 | Use of Hard-coded Credentials |
|
| Ruby | 862 | Missing Authorization |
|
| Ruby | 915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes |
|
| Ruby | 916 | Use of Password Hash With Insufficient Computational Effort |
|
| Ruby | 1004 | Sensitive Cookie Without 'HttpOnly' Flag |
|
| Scala | 190 | Integer Overflow or Wraparound |
|
| Scala | 398 | Indicator of Poor Code Quality |
|
| Scala | 476 | NULL Pointer Dereference |
|
| Scala | 480 | Use of Incorrect Operator |
|
| Scala | 482 | Comparing instead of Assigning |
|
| Scala | 483 | Incorrect Block Delimitation |
|
| Scala | 561 | Dead Code |
|
| Scala | 569 | Expression Issues |
|
| Scala | 783 | Operator Precedence Logic Error |
|
| Swift | 20 | Improper Input Validation |
|
| Swift | 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
|
| Swift | 209 | Information Exposure Through an Error Message |
|
| Swift | 227 | Improper Fulfillment of API Contract ('API Abuse') |
|
| Swift | 287 | Improper Authentication |
|
| Swift | 313 | Cleartext Sensitive Data in a Database |
|
| Swift | 314 | Cleartext Storage in the Registry |
|
| Swift | 315 | Cleartext Storage of Sensitive Information in a Cookie |
|
| Swift | 317 | Cleartext Storage of Sensitive Information in GUI |
|
| Swift | 319 | Cleartext Transmission of Sensitive Information |
|
| Swift | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| Swift | 328 | Reversible One-Way Hash |
|
| Swift | 391 | Unchecked Error Condition |
|
| Swift | 398 | Indicator of Poor Code Quality |
|
| Swift | 476 | NULL Pointer Dereference |
|
| Swift | 480 | Use of Incorrect Operator |
|
| Swift | 532 | Information Exposure Through Log Files |
|
| Swift | 561 | Dead Code |
|
| Swift | 569 | Expression Issues |
|
| Swift | 710 | Improper Adherence to Coding Standards |
|
| Swift | 798 | Use of Hard-coded Credentials |
|
| Swift | 829 | Inclusion of Functionality from Untrusted Control Sphere |
|
| VB.NET | 79 | Improper Neutralization of Input During Web Page Generation (‘Crosssite Scripting’) |
|
| VB.NET | 89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) |
|
| VB.NET | 90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') |
|
| VB.NET | 209 | Information Exposure Through an Error Message |
|
| VB.NET | 223 | Omission of Security-relevant Information |
|
| VB.NET | 285 | Improper Authorization |
|
| VB.NET | 311 | Missing Encryption of Sensitive Data |
|
| VB.NET | 312 | Cleartext Storage of Sensitive Information |
|
| VB.NET | 319 | Cleartext Transmission of Sensitive Information |
|
| VB.NET | 321 | Key Management Errors |
|
| VB.NET | 327 | Use of a Broken or Risky Cryptographic Algorithm |
|
| VB.NET | 328 | Reversible One-Way Hash |
|
| VB.NET | 398 | Indicator of Poor Code Quality |
|
| VB.NET | 404 | Improper Resource Shutdown or Release |
|
| VB.NET | 459 | Incomplete Cleanup |
|
| VB.NET | 476 | NULL Pointer Dereference |
|
| VB.NET | 502 | Deserialization of Untrusted Data |
|
| VB.NET | 561 | Dead Code |
|
| VB.NET | 573 | Improper Following of Specification by Caller |
|
| VB.NET | 611 | Improper Restriction of XML External Entity Reference ('XXE') |
|
| VB.NET | 619 | Dangling Database Cursor ('Cursor Injection') |
|
| VB.NET | 639 | Authorization Bypass Through User-Controlled Key |
|
| VB.NET | 683 | Function Call With Incorrect Order of Arguments |
|
| VB.NET | 690 | Unchecked Return Value to NULL Pointer Dereference |
|
| VB.NET | 763 | Release of Invalid Pointer or Reference |
|
| VB.NET | 772 | Missing Release of Resource after Effective Lifetime |
|
| VB.NET | 776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') |
|
| VB.NET | 778 | Insufficient Logging |
|