Common Weakness Enumeration, cross-linked.

J2EE Misconfiguration: Data Transmission Without Encryption

J2EE Misconfiguration: Insufficient Session-ID Length

J2EE Misconfiguration: Missing Custom Error Page

J2EE Misconfiguration: Entity Bean Declared Remote

J2EE Misconfiguration: Weak Access Permissions for EJB Methods

ASP.NET Misconfiguration: Creating Debug Binary

ASP.NET Misconfiguration: Missing Custom Error Page

ASP.NET Misconfiguration: Password in Configuration File

Compiler Removal of Code to Clear Buffers

External Control of System or Configuration Setting

Improper Input Validation

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Relative Path Traversal

Path Traversal: '../filedir'

Path Traversal: '/../filedir'

Path Traversal: '/dir/../filename'

Path Traversal: 'dir/../../filename'

Path Traversal: '..filedir'

Path Traversal: '..filename'

Path Traversal: 'dir..filename'

Path Traversal: 'dir....filename'

Path Traversal: '...' (Triple Dot)

Path Traversal: '....' (Multiple Dot)

Path Traversal: '....//'

Path Traversal: '.../...//'

Absolute Path Traversal

Path Traversal: '/absolute/pathname/here'

Path Traversal: 'absolutepathnamehere'

Path Traversal: 'C:dirname'

Path Traversal: 'UNCsharename' (Windows UNC Share)

Improper Resolution of Path Equivalence

Path Equivalence: 'filename.' (Trailing Dot)

Path Equivalence: 'filename....' (Multiple Trailing Dot)

Path Equivalence: 'file.name' (Internal Dot)

Path Equivalence: 'file...name' (Multiple Internal Dot)

Path Equivalence: 'filename ' (Trailing Space)

Path Equivalence: ' filename' (Leading Space)

Path Equivalence: 'file name' (Internal Whitespace)

Path Equivalence: 'filename/' (Trailing Slash)

Path Equivalence: '//multiple/leading/slash'

Path Equivalence: '/multiple//internal/slash'

Path Equivalence: '/multiple/trailing/slash//'

Path Equivalence: 'multipleinternalbackslash'

Path Equivalence: 'filedir' (Trailing Backslash)

Path Equivalence: '/./' (Single Dot Directory)

Path Equivalence: 'filedir*' (Wildcard)

Path Equivalence: 'fakedir/../realdir/filename'

Path Equivalence: Windows 8.3 Filename

Improper Link Resolution Before File Access ('Link Following')

UNIX Symbolic Link (Symlink) Following

UNIX Hard Link

Windows Shortcut Following (.LNK)

Windows Hard Link

Improper Handling of File Names that Identify Virtual Resources

Improper Handling of Windows Device Names

Improper Handling of Windows ::DATA Alternate Data Stream

DEPRECATED: Apple '.DS_Store'

Improper Handling of Apple HFS+ Alternate Data Stream Path

External Control of File Name or Path

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

Improper Neutralization of Equivalent Special Elements

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper Neutralization of Script in an Error Message Web Page

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

Improper Neutralization of Script in Attributes in a Web Page

Improper Neutralization of Encoded URI Schemes in a Web Page

Doubled Character XSS Manipulations

Improper Neutralization of Invalid Characters in Identifiers in Web Pages

Improper Neutralization of Alternate XSS Syntax

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

XML Injection (aka Blind XPath Injection)

DEPRECATED: Improper Sanitization of Custom Special Characters

Improper Neutralization of CRLF Sequences ('CRLF Injection')

Improper Control of Generation of Code ('Code Injection')

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Improper Control of Resource Identifiers ('Resource Injection')

Struts: Duplicate Validation Forms

Struts: Incomplete validate() Method Definition

Struts: Form Bean Does Not Extend Validation Class

Struts: Form Field Without Validator

Struts: Plug-in Framework not in Use

Struts: Unused Validation Form

Struts: Unvalidated Action Form

Struts: Validator Turned Off

Struts: Validator Without Form Field

Direct Use of Unsafe JNI

Missing XML Validation

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Process Control

Misinterpretation of Input

Improper Encoding or Escaping of Output

Improper Output Neutralization for Logs

Incorrect Access of Indexable Resource ('Range Error')

Improper Restriction of Operations within the Bounds of a Memory Buffer

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Stack-based Buffer Overflow

Heap-based Buffer Overflow

Write-what-where Condition

Buffer Underwrite ('Buffer Underflow')

Out-of-bounds Read

Buffer Over-read

Buffer Under-read

Wrap-around Error

Improper Validation of Array Index

Improper Handling of Length Parameter Inconsistency

Incorrect Calculation of Buffer Size

DEPRECATED: Miscalculated Null Termination

Use of Externally-Controlled Format String

Incorrect Calculation of Multi-Byte String Length

Improper Neutralization of Special Elements

Improper Neutralization of Delimiters

Improper Neutralization of Parameter/Argument Delimiters

Improper Neutralization of Value Delimiters

Improper Neutralization of Record Delimiters

Improper Neutralization of Line Delimiters

Improper Neutralization of Section Delimiters

Improper Neutralization of Expression/Command Delimiters

Improper Neutralization of Input Terminators

Improper Neutralization of Input Leaders

Improper Neutralization of Quoting Syntax

Improper Neutralization of Escape, Meta, or Control Sequences

Improper Neutralization of Comment Delimiters

Improper Neutralization of Macro Symbols

Improper Neutralization of Substitution Characters

Improper Neutralization of Variable Name Delimiters

Improper Neutralization of Wildcards or Matching Symbols

Improper Neutralization of Whitespace

Failure to Sanitize Paired Delimiters

Improper Neutralization of Null Byte or NUL Character

Improper Handling of Invalid Use of Special Elements

Improper Neutralization of Leading Special Elements

Improper Neutralization of Multiple Leading Special Elements

Improper Neutralization of Trailing Special Elements

Improper Neutralization of Multiple Trailing Special Elements

Improper Neutralization of Internal Special Elements

Improper Neutralization of Multiple Internal Special Elements

Improper Handling of Missing Special Element

Improper Handling of Additional Special Element

Improper Handling of Inconsistent Special Elements

Improper Null Termination

Encoding Error

Improper Handling of Alternate Encoding

Double Decoding of the Same Data

Improper Handling of Mixed Encoding

Improper Handling of Unicode Encoding

Improper Handling of URL Encoding (Hex Encoding)

Improper Handling of Case Sensitivity

Incorrect Behavior Order: Early Validation

Incorrect Behavior Order: Validate Before Canonicalize

Incorrect Behavior Order: Validate Before Filter

Collapse of Data into Unsafe Value

Permissive List of Allowed Inputs

Incomplete List of Disallowed Inputs

Incorrect Regular Expression

Overly Restrictive Regular Expression

Partial String Comparison

Reliance on Data/Memory Layout

Integer Overflow or Wraparound

Integer Underflow (Wrap or Wraparound)

Integer Coercion Error

Off-by-one Error

Unexpected Sign Extension

Signed to Unsigned Conversion Error

Unsigned to Signed Conversion Error

Numeric Truncation Error

Use of Incorrect Byte Ordering

Exposure of Sensitive Information to an Unauthorized Actor

Insertion of Sensitive Information Into Sent Data

Exposure of Sensitive Information Through Data Queries

Observable Discrepancy

Observable Response Discrepancy

Observable Behavioral Discrepancy

Observable Internal Behavioral Discrepancy

Observable Behavioral Discrepancy With Equivalent Products

Observable Timing Discrepancy

Generation of Error Message Containing Sensitive Information

Self-generated Error Message Containing Sensitive Information

Externally-Generated Error Message Containing Sensitive Information

Improper Removal of Sensitive Information Before Storage or Transfer

Exposure of Sensitive Information Due to Incompatible Policies

Invocation of Process Using Visible Sensitive Information

Insertion of Sensitive Information Into Debugging Code

DEPRECATED: Containment Errors (Container Errors)

DEPRECATED: Failure to Protect Stored Data from Modification

DEPRECATED: Failure to provide confidentiality for stored data

Storage of File with Sensitive Data Under Web Root

Storage of File With Sensitive Data Under FTP Root

Information Loss or Omission

Truncation of Security-relevant Information

Omission of Security-relevant Information

Obscured Security-relevant Information by Alternate Name

DEPRECATED: General Information Management Problems

Sensitive Information in Resource Not Removed Before Reuse

Improper Handling of Syntactically Invalid Structure

Improper Handling of Values

Improper Handling of Missing Values

Improper Handling of Extra Values

Improper Handling of Undefined Values

Improper Handling of Parameters

Failure to Handle Missing Parameter

Improper Handling of Extra Parameters

Improper Handling of Undefined Parameters

Improper Handling of Structural Elements

Improper Handling of Incomplete Structural Elements

Failure to Handle Incomplete Element

Improper Handling of Inconsistent Structural Elements

Improper Handling of Unexpected Data Type

Use of Inherently Dangerous Function

Creation of chroot Jail Without Changing Working Directory

Improper Clearing of Heap Memory Before Release ('Heap Inspection')

J2EE Bad Practices: Direct Management of Connections

J2EE Bad Practices: Direct Use of Sockets

DEPRECATED: Reliance on DNS Lookups in a Security Decision

Uncaught Exception

DEPRECATED: Often Misused: Path Manipulation

Execution with Unnecessary Privileges

Unchecked Return Value

Incorrect Check of Function Return Value

Plaintext Storage of a Password

Storing Passwords in a Recoverable Format

Empty Password in Configuration File

Use of Hard-coded Password

Password in Configuration File

Weak Encoding for Password

Not Using Password Aging

Password Aging with Long Expiration

Incorrect Privilege Assignment

Privilege Defined With Unsafe Actions

Privilege Chaining

Improper Privilege Management

Privilege Context Switching Error

Privilege Dropping / Lowering Errors

Least Privilege Violation

Improper Check for Dropped Privileges

Improper Handling of Insufficient Privileges

Incorrect Default Permissions

Insecure Inherited Permissions

Insecure Preserved Inherited Permissions

Incorrect Execution-Assigned Permissions

Improper Handling of Insufficient Permissions or Privileges

Improper Preservation of Permissions

Improper Ownership Management

Unverified Ownership

Improper Access Control

Improper Authorization

Incorrect User Management

Improper Authentication

Authentication Bypass Using an Alternate Path or Channel

Authentication Bypass by Alternate Name

Authentication Bypass by Spoofing

Reliance on IP Address for Authentication

DEPRECATED: Trusting Self-reported DNS Name

Using Referer Field for Authentication

Authentication Bypass by Capture-replay

Improper Certificate Validation

Improper Following of a Certificate's Chain of Trust

Improper Validation of Certificate with Host Mismatch

Improper Validation of Certificate Expiration

Improper Check for Certificate Revocation

Channel Accessible by Non-Endpoint

Reflection Attack in an Authentication Protocol

Authentication Bypass by Assumed-Immutable Data

Incorrect Implementation of Authentication Algorithm

Missing Critical Step in Authentication

Authentication Bypass by Primary Weakness

Missing Authentication for Critical Function

Improper Restriction of Excessive Authentication Attempts

Use of Single-factor Authentication

Use of Password System for Primary Authentication

Missing Encryption of Sensitive Data

Cleartext Storage of Sensitive Information

Cleartext Storage in a File or on Disk

Cleartext Storage in the Registry

Cleartext Storage of Sensitive Information in a Cookie

Cleartext Storage of Sensitive Information in Memory

Cleartext Storage of Sensitive Information in GUI

Cleartext Storage of Sensitive Information in Executable

Cleartext Transmission of Sensitive Information

Use of Hard-coded Cryptographic Key

Key Exchange without Entity Authentication

Reusing a Nonce, Key Pair in Encryption

Use of a Key Past its Expiration Date

Missing Cryptographic Step

Inadequate Encryption Strength

Use of a Broken or Risky Cryptographic Algorithm

Use of Weak Hash

Generation of Predictable IV with CBC Mode

Use of Insufficiently Random Values

Insufficient Entropy

Insufficient Entropy in PRNG

Improper Handling of Insufficient Entropy in TRNG

Small Space of Random Values

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Same Seed in Pseudo-Random Number Generator (PRNG)

Predictable Seed in Pseudo-Random Number Generator (PRNG)

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Small Seed Space in PRNG

Generation of Predictable Numbers or Identifiers

Predictable from Observable State

Predictable Exact Value from Previous Values

Predictable Value Range from Previous Values

Use of Invariant Value in Dynamically Changing Context

Insufficient Verification of Data Authenticity

Origin Validation Error

Improper Verification of Cryptographic Signature

Use of Less Trusted Source

Acceptance of Extraneous Untrusted Data With Trusted Data

Reliance on Reverse DNS Resolution for a Security-Critical Action

Insufficient Type Distinction

Cross-Site Request Forgery (CSRF)

Missing Support for Integrity Check

Improper Validation of Integrity Check Value

Product UI does not Warn User of Unsafe Actions

Insufficient UI Warning of Dangerous Operations

Improperly Implemented Security Check for Standard

Exposure of Private Personal Information to an Unauthorized Actor

Trust of System Event Data

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Race Condition Enabling Link Following

Signal Handler Race Condition

DEPRECATED: Race Condition in Switch

Race Condition within a Thread

Time-of-check Time-of-use (TOCTOU) Race Condition

Context Switching Race Condition

Divide By Zero

Missing Check for Certificate Revocation after Initial Check

Incomplete Internal State Distinction

DEPRECATED: State Synchronization Error

Passing Mutable Objects to an Untrusted Method

Returning a Mutable Object to an Untrusted Caller

Insecure Temporary File

Creation of Temporary File With Insecure Permissions

Creation of Temporary File in Directory with Insecure Permissions

J2EE Bad Practices: Use of System.exit()

J2EE Bad Practices: Direct Use of Threads

Session Fixation

Covert Timing Channel

Symbolic Name not Mapping to Correct Object

Detection of Error Condition Without Action

Unchecked Error Condition

Missing Report of Error Condition

Return of Wrong Status Code

Unexpected Status Code or Return Value

Use of NullPointerException Catch to Detect NULL Pointer Dereference

Declaration of Catch for Generic Exception

Declaration of Throws for Generic Exception

Uncontrolled Resource Consumption

Missing Release of Memory after Effective Lifetime

Transmission of Private Resources into a New Sphere ('Resource Leak')

Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')

Improper Resource Shutdown or Release

Asymmetric Resource Consumption (Amplification)

Insufficient Control of Network Message Volume (Network Amplification)

Inefficient Algorithmic Complexity

Incorrect Behavior Order: Early Amplification

Improper Handling of Highly Compressed Data (Data Amplification)

Insufficient Resource Pool

Unrestricted Externally Accessible Lock

Improper Resource Locking

Missing Lock Check

Double Free

Use After Free

Unprotected Primary Channel

Unprotected Alternate Channel

Race Condition During Access to Alternate Channel

Unprotected Windows Messaging Channel ('Shatter')

DEPRECATED: Proxied Trusted Channel

Improper Protection of Alternate Path

Direct Request ('Forced Browsing')

Untrusted Search Path

Uncontrolled Search Path Element

Unquoted Search Path or Element

Deployment of Wrong Handler

Missing Handler

Dangerous Signal Handler not Disabled During Sensitive Operations

Unparsed Raw Web Content Delivery

Unrestricted Upload of File with Dangerous Type

Improper Interaction Between Multiple Correctly-Behaving Entities

Interpretation Conflict

Incomplete Model of Endpoint Features

Behavioral Change in New Version or Environment

Expected Behavior Violation

Unintended Proxy or Intermediary ('Confused Deputy')

DEPRECATED: HTTP response splitting

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

UI Discrepancy for Security Feature

Unimplemented or Unsupported Feature in UI

Obsolete Feature in UI

The UI Performs the Wrong Action

Multiple Interpretations of UI Input

User Interface (UI) Misrepresentation of Critical Information

Insecure Default Variable Initialization

External Initialization of Trusted Variables or Data Stores

Non-exit on Failed Initialization

Missing Initialization of a Variable

Use of Uninitialized Variable

DEPRECATED: Incorrect Initialization

Incomplete Cleanup

Improper Cleanup on Thrown Exception

Duplicate Key in Associative List (Alist)

Deletion of Data Structure Sentinel

Addition of Data Structure Sentinel

Return of Pointer Value Outside of Expected Range

Use of sizeof() on a Pointer Type

Incorrect Pointer Scaling

Use of Pointer Subtraction to Determine Size

Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Modification of Assumed-Immutable Data (MAID)

External Control of Assumed-Immutable Web Parameter

PHP External Variable Modification

Use of Function with Inconsistent Implementations

Undefined Behavior for Input to API

NULL Pointer Dereference

Use of Obsolete Function

Missing Default Case in Multiple Condition Expression

Signal Handler Use of a Non-reentrant Function

Use of Incorrect Operator

Assigning instead of Comparing

Comparing instead of Assigning

Incorrect Block Delimitation

Omitted Break Statement in Switch

Comparison of Classes by Name

Reliance on Package-level Scope

Exposure of Data Element to Wrong Session

Active Debug Code

Public cloneable() Method Without Final ('Object Hijack')

Use of Inner Class Containing Sensitive Data

Critical Public Variable Without Final Modifier

Download of Code Without Integrity Check

Private Data Structure Returned From A Public Method

Public Data Assigned to Private Array-Typed Field

Exposure of Sensitive System Information to an Unauthorized Control Sphere

Cloneable Class Containing Sensitive Information

Serializable Class Containing Sensitive Data

Public Static Field Not Marked Final

Trust Boundary Violation

Deserialization of Untrusted Data

Embedded Malicious Code

Trojan Horse

Non-Replicating Malicious Code

Replicating Malicious Code (Virus or Worm)

Trapdoor

Logic/Time Bomb

Spyware

Covert Channel

Covert Storage Channel

DEPRECATED: Covert Timing Channel

.NET Misconfiguration: Use of Impersonation

Weak Password Requirements

Insufficiently Protected Credentials

Unprotected Transport of Credentials

Use of Cache Containing Sensitive Information

Use of Web Browser Cache Containing Sensitive Information

Cleartext Storage of Sensitive Information in an Environment Variable

Exposure of Version-Control Repository to an Unauthorized Control Sphere

Exposure of Core Dump File to an Unauthorized Control Sphere

Exposure of Access Control List Files to an Unauthorized Control Sphere

Exposure of Backup File to an Unauthorized Control Sphere

Inclusion of Sensitive Information in Test Code

Insertion of Sensitive Information into Log File

DEPRECATED: Information Exposure Through Server Log Files

DEPRECATED: Information Exposure Through Debug Log Files

Exposure of Information Through Shell Error Message

Servlet Runtime Error Message Containing Sensitive Information

Java Runtime Error Message Containing Sensitive Information

Insertion of Sensitive Information into Externally-Accessible File or Directory

Use of Persistent Cookies Containing Sensitive Information

Inclusion of Sensitive Information in Source Code

Inclusion of Sensitive Information in an Include File

DEPRECATED: Information Exposure Through Cleanup Log Files

Use of Singleton Pattern Without Synchronization in a Multithreaded Context

Missing Standardized Error Handling Mechanism

DEPRECATED: Use of Dynamic Class Loading

Suspicious Comment

Use of Hard-coded, Security-relevant Constants

Exposure of Information Through Directory Listing

Missing Password Field Masking

Server-generated Error Message Containing Sensitive Information

Incorrect Behavior Order: Authorization Before Parsing and Canonicalization

Files or Directories Accessible to External Parties

Command Shell in Externally Accessible Directory

ASP.NET Misconfiguration: Not Using Input Validation Framework

J2EE Misconfiguration: Plaintext Password in Configuration File

ASP.NET Misconfiguration: Use of Identity Impersonation

Use of getlogin() in Multithreaded Application

Use of umask() with chmod-style Argument

Dead Code

Return of Stack Variable Address

Assignment to Variable without Use

SQL Injection: Hibernate

Reliance on Cookies without Validation and Integrity Checking

Authorization Bypass Through User-Controlled SQL Primary Key

Unsynchronized Access to Shared Data in a Multithreaded Context

finalize() Method Without super.finalize()

Expression is Always False

Expression is Always True

Call to Thread run() instead of start()

Improper Following of Specification by Caller

EJB Bad Practices: Use of Synchronization Primitives

EJB Bad Practices: Use of AWT Swing

EJB Bad Practices: Use of Java I/O

EJB Bad Practices: Use of Sockets

EJB Bad Practices: Use of Class Loader

J2EE Bad Practices: Non-serializable Object Stored in Session

clone() Method Without super.clone()

Object Model Violation: Just One of Equals and Hashcode Defined

Array Declared Public, Final, and Static

finalize() Method Declared Public

Return Inside Finally Block

Empty Synchronized Block

Explicit Call to Finalize()

Assignment of a Fixed Address to a Pointer

Attempt to Access Child of a Non-structure Pointer

Call to Non-ubiquitous API

Free of Memory not on the Heap

Sensitive Data Storage in Improperly Locked Memory

DEPRECATED: Authentication Bypass Issues

Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created

J2EE Framework: Saving Unserializable Objects to Disk

Comparison of Object References Instead of Object Contents

DEPRECATED: Incorrect Semantic Object Comparison

Use of Wrong Operator in String Comparison

Use of HTTP Request With Sensitive Query String

Missing Validation of OpenSSL Certificate

Uncaught Exception in Servlet

URL Redirection to Untrusted Site ('Open Redirect')

Client-Side Enforcement of Server-Side Security

Use of Client-Side Authentication

Multiple Binds to the Same Port

Unchecked Input for Loop Condition

Public Static Final Field References Mutable Object

Struts: Non-private Field in ActionForm Class

Double-Checked Locking

Externally Controlled Reference to a Resource in Another Sphere

Improper Restriction of XML External Entity Reference

Improper Authorization of Index Containing Sensitive Information

Insufficient Session Expiration

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Inclusion of Sensitive Information in Source Code Comments

Incomplete Identification of Uploaded File Variables (PHP)

Reachable Assertion

Exposed Unsafe ActiveX Method

Dangling Database Cursor ('Cursor Injection')

Unverified Password Change

Variable Extraction Error

Improper Validation of Function Hook Arguments

Unsafe ActiveX Control Marked Safe For Scripting

Executable Regular Expression Error

Permissive Regular Expression

Null Byte Interaction Error (Poison Null Byte)

Dynamic Variable Evaluation

Function Call with Incorrectly Specified Arguments

Not Failing Securely ('Failing Open')

Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')

Not Using Complete Mediation

Authorization Bypass Through User-Controlled Key

Weak Password Recovery Mechanism for Forgotten Password

Improper Restriction of Names for Files and Other Resources

External Control of Critical State Data

Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Improper Neutralization of HTTP Headers for Scripting Syntax

Overly Restrictive Account Lockout Mechanism

Reliance on File Name or Extension of Externally-Supplied File

Use of Non-Canonical URL Paths for Authorization Decisions

Incorrect Use of Privileged APIs

Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking

Trusting HTTP Permission Methods on the Server Side

Exposure of WSDL File Containing Sensitive Information

Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')

Improper Isolation or Compartmentalization

Reliance on a Single Factor in a Security Decision

Insufficient Psychological Acceptability

Reliance on Security Through Obscurity

Violation of Secure Design Principles

Improper Synchronization

Use of a Non-reentrant Function in a Concurrent Context

Improper Control of a Resource Through its Lifetime

Improper Initialization

Operation on Resource in Wrong Phase of Lifetime

Improper Locking

Exposure of Resource to Wrong Sphere

Incorrect Resource Transfer Between Spheres

Always-Incorrect Control Flow Implementation

Lack of Administrator Control over Security

Operation on a Resource after Expiration or Release

External Influence of Sphere Definition

Uncontrolled Recursion

Multiple Operations on Resource in Single-Operation Context

Use of Potentially Dangerous Function

Integer Overflow to Buffer Overflow

Incorrect Conversion between Numeric Types

Incorrect Calculation

Function Call With Incorrect Order of Arguments

Incorrect Provision of Specified Functionality

Function Call With Incorrect Number of Arguments

Function Call With Incorrect Argument Type

Function Call With Incorrectly Specified Argument Value

Function Call With Incorrect Variable or Reference as Argument

Permission Race Condition During Resource Copy

Unchecked Return Value to NULL Pointer Dereference

Insufficient Control Flow Management

Incomplete Denylist to Cross-Site Scripting

Protection Mechanism Failure

Use of Multiple Resources with Duplicate Identifier

Use of Low-Level Functionality

Incorrect Behavior Order

Incorrect Comparison

Execution After Redirect (EAR)

Improper Check or Handling of Exceptional Conditions

Incorrect Type Conversion or Cast

Incorrect Control Flow Scoping

Use of Incorrectly-Resolved Name or Reference

Improper Neutralization

Incorrect Ownership Assignment

Improper Adherence to Coding Standards

Incorrect Permission Assignment for Critical Resource

Compiler Optimization Removal or Modification of Security-critical Code

Exposed Dangerous Method or Function

Improper Check for Unusual or Exceptional Conditions

Improper Handling of Exceptional Conditions

Missing Custom Error Page

Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Use of a One-Way Hash without a Salt

Use of a One-Way Hash with a Predictable Salt

Free of Pointer not at Start of Buffer

Mismatched Memory Management Routines

Release of Invalid Pointer or Reference

Multiple Locks of a Critical Resource

Multiple Unlocks of a Critical Resource

Critical Data Element Declared Public

Access to Critical Private Variable via Public Method

Incorrect Short Circuit Evaluation

DEPRECATED: Uncontrolled File Descriptor Consumption

Allocation of Resources Without Limits or Throttling

Missing Reference to Active Allocated Resource

Missing Release of Resource after Effective Lifetime

Missing Reference to Active File Descriptor or Handle

Allocation of File Descriptors or Handles Without Limits or Throttling

Missing Release of File Descriptor or Handle after Effective Lifetime

Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')

Regular Expression without Anchors

Insufficient Logging

Logging of Excessive Data

Use of RSA Algorithm without OAEP

Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code

Exposed IOCTL with Insufficient Access Control

Operator Precedence Logic Error

Reliance on Cookies without Validation and Integrity Checking in a Security Decision

Use of Path Manipulation Function without Maximum-sized Buffer

Access of Memory Location Before Start of Buffer

Out-of-bounds Write

Access of Memory Location After End of Buffer

Memory Allocation with Excessive Size Value

Improper Filtering of Special Elements

Incomplete Filtering of Special Elements

Incomplete Filtering of One or More Instances of Special Elements

Only Filtering One Instance of a Special Element

Incomplete Filtering of Multiple Instances of Special Elements

Only Filtering Special Elements at a Specified Location

Only Filtering Special Elements Relative to a Marker

Only Filtering Special Elements at an Absolute Position

Use of Hard-coded Credentials

Improper Control of Interaction Frequency

Guessable CAPTCHA

Buffer Access with Incorrect Length Value

Buffer Access Using Size of Source Buffer

Reliance on Untrusted Inputs in a Security Decision

Missing Synchronization

Incorrect Synchronization

Untrusted Pointer Dereference

Use of Out-of-range Pointer Offset

Access of Uninitialized Pointer

Expired Pointer Dereference

Premature Release of Resource During Expected Lifetime

Improper Control of Document Type Definition

Signal Handler with Functionality that is not Asynchronous-Safe

Inclusion of Functionality from Untrusted Control Sphere

Inclusion of Web Functionality from an Untrusted Source

Signal Handler Function Associated with Multiple Signals

Unlock of a Resource that is not Locked

Deadlock

Excessive Iteration

Loop with Unreachable Exit Condition ('Infinite Loop')

Use of Password Hash Instead of Password for Authentication

Improper Enforcement of a Single, Unique Action

Inappropriate Encoding for Output Context

Numeric Range Comparison Without Minimum Check

Improper Enforcement of Behavioral Workflow

Placement of User into Incorrect Group

Access of Resource Using Incompatible Type ('Type Confusion')

Missing Authorization

Incorrect Authorization

Use of Uninitialized Resource

Missing Initialization of Resource

Use of Expired File Descriptor

Improper Update of Reference Count

Hidden Functionality

Improper Control of Dynamically-Managed Code Resources

Improper Control of Dynamically-Identified Variables

Improperly Controlled Modification of Dynamically-Determined Object Attributes

Use of Password Hash With Insufficient Computational Effort

Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Server-Side Request Forgery (SSRF)

Improper Restriction of Power Consumption

Storage of Sensitive Data in a Mechanism without Access Control

Insecure Storage of Sensitive Information

Improper Restriction of Communication Channel to Intended Endpoints

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Improper Verification of Intent by Broadcast Receiver

Improper Export of Android Application Components

Use of Implicit Intent for Sensitive Communication

Improper Authorization in Handler for Custom URL Scheme

Improper Verification of Source of a Communication Channel

Incorrectly Specified Destination in a Communication Channel

Permissive Cross-domain Security Policy with Untrusted Domains

Improper Neutralization of Special Elements in Data Query Logic

Sensitive Cookie Without 'HttpOnly' Flag

Insufficient Visual Distinction of Homoglyphs Presented to User

Improper Restriction of Rendered UI Layers or Frames

Use of Web Link to Untrusted Target with window.opener Access

Incomplete Comparison with Missing Factors

Comparison of Incompatible Types

Comparison Using Wrong Factors

Processor Optimization Removal or Modification of Security-critical Code

Insecure Automated Optimizations

Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism

Use of Redundant Code

Static Member Data Element outside of a Singleton Class Element

Data Element Aggregating an Excessively Large Number of Non-Primitive Elements

Architecture with Number of Horizontal Layers Outside of Expected Range

Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor

Creation of Immutable Text Using String Concatenation

Modules with Circular Dependencies

Invokable Control Element with Large Number of Outward Calls

Excessive Data Query Operations in a Large Data Table

Excessive Platform Resource Consumption within a Loop

Initialization with Hard-Coded Network Resource Configuration Data

Excessive Use of Hard-Coded Literals in Initialization

Missing Documentation for Design

Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer

Multiple Inheritance from Concrete Classes

Invokable Control Element with Variadic Parameters

Data Access Operations Outside of Expected Data Manager Component

Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element

Insufficient Technical Documentation

Excessive Number of Inefficient Server-Side Data Accesses

Insufficient Encapsulation

Parent Class with References to Child Class

Creation of Class Instance within a Static Code Block

Invokable Control Element with Signature Containing an Excessive Number of Parameters

Runtime Resource Management Control Element in a Component Built to Run on Application Servers

Missing Serialization Control Element

Excessive Execution of Sequential Searches of Data Resource

Inconsistency Between Implementation and Documented Design

Empty Exception Block

Serializable Data Element Containing non-Serializable Item Elements

Empty Code Block

Data Resource Access without Use of Connection Pooling

Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses

Class with Excessively Deep Inheritance

Unconditional Control Flow Transfer outside of Switch Block

Insufficient Adherence to Expected Conventions

Floating Point Comparison with Incorrect Operator

Inappropriate Source Code Style or Formatting

Parent Class without Virtual Destructor Method

Source Code File with Excessive Number of Lines of Code

Class Instance Self Destruction Control Element

Data Access from Outside Expected Data Manager Component

Invokable Control Element with Excessive File or Data Access Operations

Invokable Control Element with Excessive Volume of Commented-out Code

Class with Excessive Number of Child Classes

Class with Virtual Method without a Virtual Destructor

Synchronous Access of Remote Resource without Timeout

Large Data Table with Excessive Number of Indices

Method Containing Access of a Member Element from Another Class

Use of Object without Invoking Destructor Method

Use of Same Invokable Control Element in Multiple Architectural Layers

Excessively Complex Data Representation

Excessive Index Range Scan for a Data Resource

Loop Condition Value Update within the Loop

Singleton Class Instance Creation without Proper Locking or Synchronization

Persistent Storable Data Element without Associated Comparison Control Element

Data Element containing Pointer Item without Proper Copy Control Element

Inconsistent Naming Conventions for Identifiers

Insufficient Isolation of System-Dependent Functions

Reliance on Runtime Component in Generated Code

Reliance on Machine-Dependent Data Representation

Use of Platform-Dependent Third Party Components

Use of Unmaintained Third Party Components

Insufficient Encapsulation of Machine-Dependent Functionality

Insufficient Use of Symbolic Constants

Insufficient Isolation of Symbolic Constant Definitions

Excessive Reliance on Global Variables

Use of Same Variable for Multiple Purposes

Incomplete Design Documentation

Incomplete I/O Documentation

Incomplete Documentation of Program Execution

Inappropriate Comment Style

Inappropriate Whitespace Style

Source Code Element without Standard Prologue

Inaccurate Source Code Comments

Callable with Insufficient Behavioral Summary

Insufficient Documentation of Error Handling Techniques

Excessive Use of Unconditional Branching

Excessive Code Complexity

Excessive McCabe Cyclomatic Complexity

Excessive Halstead Complexity

Excessive Use of Self-Modifying Code

Excessively Deep Nesting

Excessive Attack Surface

Declaration of Variable with Unnecessarily Wide Scope

Compilation with Insufficient Warnings or Errors

Irrelevant Code

Improper Use of Validation Framework

ASP.NET Misconfiguration: Improper Model Validation

Inefficient CPU Computation

Use of Prohibited Code

DEPRECATED: Use of Uninitialized Resource

Initialization of a Resource with an Insecure Default

Improper Isolation of Shared Resources on System-on-a-Chip (SoC)

DMA Device Enabled Too Early in Boot Phase

On-Chip Debug and Test Interface With Improper Access Control

Improper Identifier for IP Block used in System-On-Chip (SOC)

Power-On of Untrusted Execution Core Before Enabling Fabric Access Control

Generation of Weak Initialization Vector (IV)

Failure to Disable Reserved Bits

Insufficient Granularity of Access Control

Incorrect Register Defaults or Module Parameters

Insufficient Granularity of Address Regions Protected by Register Locks

Race Condition for Write-Once Attributes

Improper Restriction of Write-Once Bit Fields

Creation of Emergent Resource

Exposure of Sensitive Information Through Metadata

Improper Prevention of Lock Bit Modification

Improper Lock Behavior After Power State Transition

Security-Sensitive Hardware Controls with Missing Lock Bit Protection

Hardware Internal or Debug Modes Allow Override of Locks

Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations

Improper Neutralization of Formula Elements in a CSV File

Improper Zeroization of Hardware Register

Use of a Cryptographic Primitive with a Risky Implementation

Use of Predictable Algorithm in Random Number Generator

Inclusion of Undocumented Features or Chicken Bits

Sensitive Non-Volatile Information Not Protected During Debug

Internal Asset Exposed to Unsafe Debug Access Level or State

Improper Finite State Machines (FSMs) in Hardware Logic

Improper Write Handling in Limited-write Non-Volatile Memories

Improper Protection Against Voltage and Clock Glitches

Semiconductor Defects in Hardware Logic with Security-Sensitive Implications

Application-Level Admin Tool with Inconsistent View of Underlying Operating System

Improper Preservation of Consistency Between Independent Representations of Shared State

Mirrored Regions with Different Values

CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations

Incorrect Selection of Fuse Values

Incorrect Comparison Logic Granularity

Comparison Logic is Vulnerable to Power Side-Channel Attacks

Improper Restriction of Software Interfaces to Hardware Features

Improper Access Control Applied to Mirrored or Aliased Memory Regions

Exposure of Sensitive System Information Due to Uncleared Debug Information

Improper Restriction of Security Token Assignment

Improper Handling of Overlap Between Protected Memory Ranges

Improper Handling of Single Event Upsets

Improper Access Control for Register Interface

Improper Physical Access Control

Hardware Logic with Insecure De-Synchronization between Control and Data Channels

Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls

Improper Scrubbing of Sensitive Data from Decommissioned Device

Policy Uses Obsolete Encoding

Policy Privileges are not Assigned Consistently Between Control and Data Agents

Product Released in Non-Release Configuration

Generation of Incorrect Security Tokens

Uninitialized Value on Reset for Registers Holding Security Settings

Sensitive Information Uncleared Before Debug/Power State Transition

Device Unlock Credential Sharing

Improper Access Control for Volatile Memory Containing Boot Code

Sensitive Cookie with Improper SameSite Attribute

Hardware Child Block Incorrectly Connected to Parent System