Tipos de fallo

CWE-79 · XSS (CWE-79)27.075 CWE-89 · Unauthenticated SQL injection (CWE-89)12.106 CWE-862 · The software does not perform an authorization check when an actor attempts to access a resource or perform an action.7390 CWE-352 · The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.5858 CWE-284 · The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.5360 CWE-22 · The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.5181 CWE-20 · The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.5011 CWE-787 · OUT-OF-BOUNDS WRITE CWE-7874707 CWE-125 · OUT-OF-BOUNDS READ CWE-1254570 CWE-416 · USE AFTER FREE CWE-416 (CVE-2019-13510)4478 CWE-74 · Injection4375 CWE-200 · The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.4294 CWE-78 · The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.4063 CWE-94 · Script injection3986 CWE-121 · Stack buffer overflow (CWE-121)3567 CWE-119 · Memory Corruption - Generic (CWE-119)3047 CWE-120 · Execute unauthorized code or commands3024 CWE-434 · UNRESTRICTED UPLOAD OF FILE WITH DANGEROUS TYPE CWE-4342916 CWE-400 · UNCONTROLLED RESOURCE CONSUMPTION ('RESOURCE EXHAUSTION') CWE-4002639 CWE-77 · The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.2631 CWE-122 · Heap Overflow (CWE-122)2564 CWE-918 · The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.2499 CWE-502 · The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.2396 CWE-863 · The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.2395 CWE-476 · Remote authenticated null dereference (CWE-476)2187 CWE-306 · The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.2134 CWE-287 · When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.2075 CWE-269 · The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.2054 CWE-639 · The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.1868 CWE-770 · The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.1546 CWE-285 · The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.1433 CWE-190 · INTEGER OVERFLOW OR WRAPAROUND CWE-1901422 CWE-98 · Remote File Inclusion (CWE-98)1272 CWE-601 · URL REDIRECTION TO UNTRUSTED SITE ('OPEN REDIRECT') CWE-6011091 CWE-266 · Incorrect Privilege Assignment1042 CWE-362 · Race Condition (CWE-362), Classic Buffer Overflow (CWE-120)947 CWE-276 · INCORRECT DEFAULT PERMISSIONS CWE-276923 CWE-427 · Uncontrolled Search Path or Element864 CWE-798 · USE OF HARD-CODED CREDENTIALS CWE-798857 CWE-532 · Sensitive Information in Log Files777 CWE-295 · Information disclosure736 CWE-732 · The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.733 CWE-59 · Link Following709 CWE-693 · PROTECTIONS MECHANISM FAILURE CWE-693670 CWE-404 · IMPROPER RESOURCE SHUTDOWN OR RELEASE CWE-404625 CWE-288 · Improper access control623 CWE-401 · Missing Release of Memory after Effective Lifetime620 CWE-843 · Type Confusion607 CWE-611 · XXE CWE-611597 CWE-522 · INSUFFICIENTLY PROTECTED CREDENTIALS CWE-522595 CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)567 CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (CWE-80)564 CWE-347 · Information disclosure538 CWE-73 · Improper access control530 CWE-346 · ORIGIN VALIDATION ERROR CWE-346521 CWE-290 · This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.514 CWE-319 · The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.501 CWE-126 · Stack buffer over-read (CWE-126)480 CWE-23 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as .. that can resolve to a location that is outside of that directory.465 CWE-345 · Insufficient Verification of Data Authenticity (CWE-345)448 CWE-307 · IMPROPER RESTRICTION OF EXCESSIVE AUTHENTICATION ATTEMPTS CWE-307434 CWE-613 · Session Expiration432 CWE-754 · The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.428 CWE-312 · Information disclosure423 CWE-617 · Reachable Assertion (CWE-617)405 CWE-209 · Information Exposure Through Error Message393 CWE-201 · Insertion of Sensitive Information Into Sent Data378 CWE-327 · USE OF A BROKEN OR RISKY CRYPTOGRAPHIC ALGORITHM CWE-327376 CWE-497 · Information disclosure372 CWE-835 · The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.372 CWE-1333 · The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.370 CWE-428 · UNQUOTED SEARCH PATH OR ELEMENT CWE-428352 CWE-451 · User Interface (UI) Misrepresentation of Critical Information (CWE-451)346 CWE-1321 · Prototype Pollution343 CWE-250 · EXECUTION WITH UNNECESSARY PRIVILEGES CWE-250343 CWE-552 · Files or Directories Accessible to External Parties (CWE-552)334 CWE-191 · INTEGER UNDERFLOW (WRAP OR WRAPAROUND) CWE-191330 CWE-321 · USE OF HARD-CODED CRYPTOGRAPHIC KEY CWE-321320 CWE-415 · use-after-free312 CWE-203 · Observable Discrepancy309 CWE-116 · Improper Encoding or Escaping of Output (CWE-116), Improper Handling of Unicode Encoding (CWE-176)309 CWE-311 · MISSING ENCRYPTION OF SENSITIVE DATA CWE-311303 CWE-426 · UNTRUSTED SEARCH PATH CWE-426299 CWE-129 · IMPROPER VALIDATION OF ARRAY INDEX CWE-129289 CWE-264 · Privileges, and Access Control [CWE-264]288 CWE-674 · UNCONTROLLED RECURSION CWE-674282 CWE-922 · INSECURE STORAGE OF SENSITIVE INFORMATION CWE-922279 CWE-1284 · Improper Validation of Specified Quantity in Input274 CWE-444 · Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')270 CWE-908 · Use of Uninitialized Resource (CWE-908)268 CWE-88 · Information disclosure252 CWE-707 · Improper Neutralization251 CWE-248 · UNCAUGHT EXCEPTION CWE-248243 CWE-755 · Improper handling of exceptional conditions CWE-755232 CWE-384 · Session Fixiation232 CWE-457 · Use of Uninitialized Variable231 CWE-281 · Improper Preservation of Permissions219 CWE-668 · Information disclosure217 CWE-822 · UNTRUSTED POINTER DEREFERENCE CWE-822216 CWE-256 · Use of Hard-coded Password or Plaintext Storage of a Password215 CWE-829 · Inclusion of Functionality from Untrusted Control Sphere (CWE-829)210 CWE-824 · Uninitialized Pointer205 CWE-789 · Uncontrolled Memory Allocation203 CWE-1336 · Information disclosure201 CWE-1021 · Inappropriate implementation199 CWE-640 · WEAK PASSWORD RECOVERY MECHANISM FOR FORGOTTEN PASSWORD CWE-640197 CWE-359 · Privacy Violation (CWE-359)197 CWE-369 · dos195 CWE-259 · USE OF HARD-CODED PASSWORD CWE-259195 CWE-1188 · The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.190 CWE-326 · INADEQUATE ENCRYPTION STRENGTH CWE-326186 CWE-1236 · IMPROPER NEUTRALIZATION OF FORMULA ELEMENTS IN A CSV FILE CWE-1236178 CWE-749 · Exposed Dangerous Routine175 CWE-35 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.174 CWE-204 · The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.171 CWE-294 · CWE-294: Exposure of Sensitive Information to an Unauthorized Actor171 CWE-93 · Information disclosure169 CWE-208 · Observable Timing Discrepancy165 CWE-494 · Escalation of privilege163 CWE-399 · Resource Management Errors160 CWE-61 · UNIX Symbolic Link (Symlink) Following160 CWE-184 · Incomplete List of Disallowed Inputs159 CWE-602 · The product is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.158 CWE-95 · Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') (CWE-95)158 CWE-330 · USE OF INSUFFICIENTLY RANDOM VALUES CWE-330156 CWE-521 · WEAK PASSWORD REQUIREMENTS CWE-521156 CWE-703 · IMPROPER CHECK OR HANDLING OF EXCEPTIONAL CONDITIONS CWE-703155 CWE-280 · Improper Handling of Insufficient Permissions or Privileges (CWE-280)155 CWE-305 · The authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.154 CWE-667 · Improper Locking151 CWE-1287 · Improper Validation of Specified Type of Input149 CWE-665 · The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.148 CWE-788 · CWE-788: Access of Memory Location After End of Buffer147 CWE-131 · Incorrect Calculation of Buffer Size (CWE-131)147 CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) (CWE-338)145 CWE-472 · Integer overflow144 CWE-134 · Use of Externally-Controlled Format String144 CWE-915 · Improperly Controlled Modification of Dynamically-Determined Object Attributes139 CWE-36 · The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize absolute path sequences such as /abs/path that can resolve to a location that is outside of that directory.133 CWE-407 · Inefficient Algorithmic Complexity119 CWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains117 CWE-425 · The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.117 CWE-24 · Path Traversal: '../filedir'114 CWE-358 · Security Check for Standard114 CWE-193 · OFF-BY-ONE ERROR CWE-193109 CWE-1392 · Use of Default Credentials109 CWE-354 · Improper Validation of Integrity Check Value108 CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')107 CWE-130 · Improper Handling of Length Parameter Inconsistency (CWE-130)106 CWE-680 · Integer Overflow to Buffer Overflow (CWE-680)106 CWE-117 · The software does not neutralize or incorrectly neutralizes output that is written to logs.103 CWE-823 · Use of Out-of-range Pointer Offset (CWE-823)101 CWE-670 · input-validation101 CWE-252 · Unchecked Return Value101 CWE-1220 · Insufficient Granularity of Access Control100 CWE-303 · Incorrect Implementation of Authentication Algorithms (CWE-303)98 CWE-377 · Insecure Temporary File (CWE-377)98 CWE-840 · CWE-840: Business Logic Errors92 CWE-436 · Interpretation Conflict92 CWE-772 · Missing Release of Resource after Effective Lifetime91 CWE-328 · Use of Weak Hash90 CWE-506 · Embedded Malicious Code (CWE-506)90 CWE-620 · Unverified Password Change (CWE-620)90 CWE-409 · Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)90 CWE-1286 · Improper Validation of Syntactic Correctness of Input90 CWE-113 · The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.90 CWE-610 · Improper access control90 CWE-538 · Insertion of Sensitive Information into Externally-Accessible File or Directory88 CWE-598 · Use of HTTP Request With Sensitive Query String88 CWE-331 · Insufficient Entropy88 CWE-807 · Reliance on Untrusted Inputs in a Security Decision (CWE-807)87 CWE-459 · INCOMPLETE CLEANUP CWE-45987 CWE-926 · Improper Export of Android Application Components87 CWE-825 · memory-safety86 CWE-1390 · Weak Authentication86 CWE-489 · LEFTOVER DEBUG CODE CWE-48986 CWE-912 · HIDDEN FUNCTIONALITY CWE-91285 CWE-704 · INCORRECT TYPE VERSION OR CAST CWE-70481 CWE-310 · Information disclosure81 CWE-697 · Incorrect Comparison (CWE-697)80 CWE-591 · CWE-591: Sensitive Data Storage in Improperly Locked Memory77 CWE-91 · XML Injection (CWE-91)75 CWE-15 · External Control of System or Configuration Setting72 CWE-653 · The product does not properly compartmentalize or isolate functionality, processes, or resources that require different privilege levels, rights, or permissions.72 CWE-916 · USE OF PASSWORD HASH WITH INSUFFICIENT COMPUTATIONAL EFFORT CWE-91671 CWE-277 · Insecure Inherited Permissions (CWE-277)71 CWE-799 · Improper Control of Interaction Frequency71 CWE-913 · Improper Control of Dynamically-Managed Code Resources69 CWE-150 · Improper Neutralization of Escape, Meta, or Control Sequences (CWE-150)69 CWE-212 · Information disclosure68 CWE-923 · Improper Restriction of Communication Channel to Intended Endpoints68 CWE-648 · Incorrect Use of Privileged APIs67 CWE-943 · Improper Neutralization of Special Elements in Data Query Logic67 CWE-470 · Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')66 CWE-267 · Privilege Defined With Unsafe Actions65 CWE-257 · STORING PASSWORDS IN A RECOVERABLE FORMAT CWE-25765 CWE-682 · INCORRECT CALCULATION CWE-68265 CWE-348 · Use of Less Trusted Source65 CWE-90 · Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')65 CWE-614 · Sensitive Cookie Without Secure Attribute64 CWE-706 · Use of Incorrectly-Resolved Name or Reference (CWE-706)64 CWE-178 · Improper Handling of Case Sensitivity63 CWE-524 · Use of Cache Containing Sensitive Information63 CWE-29 · Path Traversal: '..filename'63 CWE-16 · Misconfiguration (CWE-16)62 CWE-255 · CWE-255 Credentials Management Errors61 CWE-681 · Incorrect Conversion between Numeric Types61 CWE-644 · IMPROPER NEUTRALIZATION OF HTTP HEADERS FOR SCRIPTING SYNTAX CWE-64460 CWE-297 · Information disclosure59 CWE-325 · Missing Required Cryptographic Step (CWE-325)59 CWE-841 · Enforcement of Behavioral Workflow59 CWE-379 · CWE-379: Creation of Temporary File in Directory with Insecure Permissions59 CWE-917 · Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')59 CWE-669 · Incorrect resource transfer between spheres59 CWE-1285 · Improper Validation of Specified Index, Position, or Offset in Input58 CWE-320 · Key Management Errors57 CWE-548 · INFORMATION EXPOSURE THROUGH DIRECTORY LISTING CWE-54857 CWE-99 · Resource Injection (CWE-99)56 CWE-805 · CWE-805: Buffer Access with Incorrect Length Value55 CWE-87 · Improper Neutralization of Alternate XSS Syntax55 CWE-300 · Man-in-the-Middle (CWE-300)55 CWE-940 · Improper Verification of Source of a Communication Channel55 CWE-672 · OPERATION ON A RESOURCE AFTER EXPIRATION OR RELEASE CWE-67255 CWE-1391 · Use of Weak Credentials53 CWE-197 · Execute unauthorized code or commands52 CWE-170 · Improper Null Termination (CWE-170)52 CWE-275 · Permission Issues (CWE-275)51 CWE-340 · Generation of Predictable Numbers or Identifiers50 CWE-123 · WRITE-WHAT-WHERE CONDITION CWE-12350 CWE-1395 · Dependency on Vulnerable Third-Party Component (CWE-1395)48 CWE-776 · XML Entity Expansion (CWE-776)46 CWE-378 · CWE-378: Creation of Temporary File With Insecure Permissions46 CWE-405 · CWE-405: Asymmetric Resource Consumption (Amplification)45 CWE-183 · Permissive List of Allowed Inputs44 CWE-1393 · Use of Default Password43 CWE-353 · Missing Support for Integrity Check (CWE-353)43 CWE-664 · Improper Control of a Resource Through its Lifetime43 CWE-323 · Reusing a Nonce, Key Pair in Encryption43 CWE-1004 · Sensitive Cookie Without 'HttpOnly' Flag42 CWE-274 · Privilege Escalation (CWE-274)42 CWE-636 · When the product encounters an error condition or failure, its design requires it to fall back to a state that is less secure than other options that are available, such as selecting the weakest encryption algorithm or using the most permissive access control restrictions.42 CWE-385 · CWE-385: Covert Timing Channel41 CWE-440 · CWE-440: Expected Behavior Violation41 CWE-302 · CWE-302: Authentication Bypass by Assumed-Immutable Data41 CWE-261 · Weak Encoding for Password41 CWE-782 · Exposed IOCTL with Insufficient Access Control (CWE-782)40 CWE-696 · Incorrect Behavior Order40 CWE-565 · Reliance on Cookies without Validation and Integrity Checking40 CWE-606 · Unchecked Input for Loop Condition39 CWE-349 · CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data39 CWE-763 · Release of Invalid Pointer or Reference39 CWE-124 · Execute unauthorized code or commands38 CWE-791 · Incomplete Filtering of Special Elements38 CWE-289 · CWE-289: Authentication Bypass by Alternate Name38 CWE-834 · Excessive Iteration (CWE-834)37 CWE-202 · Exposure of Sensitive Information Through Data Queries37 CWE-420 · Unprotected Alternate Channel37 CWE-471 · Modification of Assumed-Immutable Data (MAID) (CWE-471)37 CWE-75 · Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CWE-75)36 CWE-316 · The product stores sensitive information in cleartext in memory.36 CWE-304 · The product implements an authentication technique, but it skips a step that weakens the technique.36 CWE-272 · Least Privilege Violation35 CWE-1300 · Side-channel information leakage35 CWE-92 · Improper conditions check34 CWE-488 · Exposure of Data Element to Wrong Session34 CWE-1289 · Improper Validation of Unsafe Equivalence in Input34 CWE-1385 · Missing Origin Validation in WebSockets34 CWE-424 · Improper Protection of Alternate Path34 CWE-691 · Insufficient Control Flow Management (CWE-691)33 CWE-226 · Sensitive Information in Resource Not Removed Before Reuse33 CWE-241 · Improper Handling of Unexpected Data Type33 CWE-690 · CWE-690: Unchecked Return Value to NULL Pointer Dereference33 CWE-501 · Trust Boundary Violation32 CWE-356 · Product UI does not warn user of unsafe actions CWE-35632 CWE-213 · Exposure of Sensitive Information Due to Incompatible Policies32 CWE-286 · Incorrect User Management32 CWE-540 · Inclusion of Sensitive Information in Source Code31 CWE-189 · Numeric Error31 CWE-757 · Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')31 CWE-525 · CWE-525: Use of Web Browser Cache of Sensitive Information31 CWE-233 · Improper Handling of Parameters (CWE-233)31 CWE-176 · The software does not properly handle when an input contains Unicode encoding.30 CWE-313 · CWE-313: Cleartext Storage in a File or on Disk30 CWE-1288 · Improper Validation of Consistency within Input30 CWE-115 · Misinterpretation of Input30 CWE-282 · Improper Ownership Management29 CWE-27 · Path Traversal: 'dir/../../filename'28 CWE-185 · Incorrect Regular Expression28 CWE-41 · Information disclosure28 CWE-158 · IMPROPER NEUTRALIZATION OF NULL BYTE OR NUL CHARACTER CWE-15828 CWE-758 · Reliance on Undefined, Unspecified, or Implementation-Defined Behavior27 CWE-83 · The product does not neutralize or incorrectly neutralizes "javascript:" or other URIs from dangerous attributes within tags, such as onmouseover, onload, onerror, or style.27 CWE-684 · Incorrect Provision of Specified Functionality27 CWE-1230 · Inappropriate implementation26 CWE-350 · Reliance on Reverse DNS Resolution for a Security-Critical Action (CWE-350)26 CWE-114 · CWE-114: Process Control26 CWE-778 · Insufficient Logging (CWE-778)26 CWE-322 · Key Exchange without Entity Authentication26 CWE-279 · Incorrect Execution-Assigned Permissions26 CWE-270 · Privilege Context Switching Error26 CWE-523 · UNPROTECTED TRANSPORT OF CREDENTIALS CWE-52325 CWE-1275 · Sensitive Cookie with Improper SameSite Attribute25 CWE-833 · dos25 CWE-939 · Improper Authorization in Handler for Custom URL Scheme25 CWE-214 · Invocation of Process Using Visible Sensitive Information25 CWE-924 · CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel24 CWE-391 · Unchecked Error Condition (CWE-391)24 CWE-592 · This weakness has been deprecated because it covered redundant concepts already described in CWE-287.24 CWE-260 · Password in Configuration File24 CWE-1104 · Use of Unmaintained Third Party Components24 CWE-283 · Unverified Ownership24 CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization23 CWE-460 · Improper cleanup on thrown exception CWE-46023 CWE-253 · Incorrect Check of Function Return Value23 CWE-402 · Transmission of Private Resources into a New Sphere ('Resource Leak')23 CWE-273 · Improper Check for Dropped Privileges23 CWE-96 · CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')23 CWE-603 · USE OF CLIENT-SIDE AUTHENTICATION CWE-60322 CWE-1191 · On-Chip Debug and Test Interface With Improper Access Control22 CWE-324 · Use of a Key Past its Expiration Date22 CWE-195 · CWE-195: Signed to Unsigned Conversion Error22 CWE-268 · Privilege Chaining22 CWE-180 · Incorrect Behavior Order: Validate Before Canonicalize (CWE-180).22 CWE-1295 · Information disclosure22 CWE-410 · Insufficient Resource Pool21 CWE-1325 · Improperly Controlled Sequential Memory Allocation21 CWE-1327 · CWE-1327: Binding to an Unrestricted IP Address21 CWE-335 · CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)21 CWE-783 · Operator Precedence Logic Error20 CWE-228 · Improper Handling of Syntactically Invalid Structure20 CWE-357 · INSUFFICIENT UI WARNING OF DANGEROUS OPERATIONS CWE-35720 CWE-364 · Signal Handler Race Condition20 CWE-84 · The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.20 CWE-244 · Improper Clearing of Heap Memory Before Release ('Heap Inspection')20 CWE-590 · Free of Memory not on the Heap20 CWE-1240 · Use of a Cryptographic Primitive with a Risky Implementation20 CWE-140 · Improper Neutralization of Delimiters20 CWE-779 · Logging of Excessive Data20 CWE-708 · Incorrect Ownership Assignment20 CWE-453 · Insecure Default Variable Initialization19 CWE-657 · Violation of Secure Design Principles (CWE-657)19 CWE-390 · Detection of Error Condition Without Action19 CWE-406 · CWE-406: Insufficient Control of Network Message Volume (Network Amplification)19 CWE-366 · Race Condition within a Thread18 CWE-804 · Guessable CAPTCHA18 CWE-759 · USE OF A ONE-WAY HASH WITHOUT A SALT CWE-75918 CWE-526 · CWE-526: Exposure of Sensitive Information Through Environmental Variables18 CWE-229 · Improper Handling of Values18 CWE-215 · Insertion of Sensitive Information Into Debugging Code18 CWE-927 · CWE-927: Use of Implicit Intent for Sensitive Communication 18 CWE-26 · Path Traversal17 CWE-698 · Execution After Redirect (EAR)17 CWE-641 · Improper Restriction of Names for Files and Other Resources17 CWE-662 · Improper Synchronization17 CWE-296 · Improper Following of a Certificate's Chain of Trust (CWE-296)17 CWE-1394 · Use of Default Cryptographic Key17 CWE-395 · NULL pointer dereference17 CWE-836 · Use of Password Hash Instead of Password for Authentication16 CWE-1259 · CWE-1259: Improper Restriction of Security Token Assignment16 CWE-911 · Improper Update of Reference Count16 CWE-642 · External Control of Critical State Data (CWE-642)16 CWE-549 · Missing Password Field Masking16 CWE-477 · USE OF OBSOLETE FUNCTION CWE-47716 CWE-837 · Improper Enforcement of a Single, Unique Action16 CWE-820 · Missing Synchronization15 CWE-155 · CWE-155: Improper Neutralization of Wildcards or Matching Symbols15 CWE-341 · PREDICTABLE FROM OBSERVABLE STATE CWE-34115 CWE-413 · Improper Resource Locking15 CWE-909 · CWE-909: Missing Initialization of Resource15 CWE-475 · Undefined Behavior for Input to API15 CWE-1386 · CWE-1386: Insecure Operation on Windows Junction / Mount Point15 CWE-1050 · Excessive Platform Resource Consumption within a Loop15 CWE-1260 · Improper Handling of Overlap Between Protected Memory Ranges15 CWE-790 · CWE-790: Improper Filtering of Special Elements15 CWE-351 · CWE-351: Insufficient Type Distinction15 CWE-394 · CWE-394: Unexpected Status Code or Return Value14 CWE-449 · CWE-449: The UI Performs the Wrong Action14 CWE-308 · Use of Single-factor Authentication14 CWE-334 · Small Space of Random Values14 CWE-1242 · Inclusion of undocumented features or chicken bits14 CWE-643 · Improper Neutralization of Data within XPath Expressions ('XPath Injection')14 CWE-599 · CWE-599: Missing Validation of OpenSSL Certificate14 CWE-76 · Improper Neutralization of Equivalent Special Elements13 CWE-1244 · Improper Authorization on Physical Debug and Test Interfaces13 CWE-821 · Incorrect Synchronization13 CWE-138 · Improper Neutralization of Special Elements13 CWE-1023 · Incomplete Comparison with Missing Factors13 CWE-1263 · Improper Physical Access Control13 CWE-337 · Predictable Seed in Pseudo-Random Number Generator (PRNG)13 CWE-329 · NOT USING AN UNPREDICTABLE IV WITH CBC MODE (CWE-329)13 CWE-1427 · CWE-1427: Improper Neutralization of Input Used for LLM Prompting13 CWE-474 · Use of Function with Inconsistent Implementations13 CWE-159 · CWE-159: Improper Handling of Invalid Use of Special Elements13 CWE-762 · Mismatched Memory Management Routines13 CWE-1022 · CWE-1022: Use of Web Link to Untrusted Target with window.opener Access13 CWE-19 · Data Handling13 CWE-392 · Missing Report of Error Condition12 CWE-419 · CWE-419: Unprotected Primary Channel12 CWE-230 · Improper Handling of Missing Values12 CWE-25 · Path Traversal: '/../filedir'12