CWE IDs Detected by CodeSonar in C and C++ Code

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.0p0 Hot Tips

CONFIDENTIAL

CodeSecure Inc

CWE IDs Detected by CodeSonar in C and C++ Code

This table contains close and broad CWE mappings for CodeSonar C/C++ warning classes, organized by CWE ID.

CWE mappings organized by CodeSonar C/C++ warning class: close mapping, broad mapping.
CWE mappings for CodeSonar warning classes, all languages: close mapping, broad mapping.
CWE mapping information for CodeSonar in CSV format: CWE-mapping-broad.csv (broad mapping); CWE-mapping.csv (close mapping).

This version of CodeSonar (9.0p0) uses CWE 4.16, published November 19, 2024.

Close Mapping
Broad Mapping

Close Mapping

CWE	Entity Type	C/C++ Warning Classes
CWE:14 Compiler Removal of Code to Clear Buffers	Weakness	Use of memset
CWE:15 External Control of System or Configuration Setting	Weakness	Tainted Configuration Setting
CWE:20 Improper Input Validation	Weakness	Cast Alters Value Coercion Alters Value Tainted Buffer Access
CWE:22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	Weakness	Tainted Filename
CWE:73 External Control of File Name or Path	Weakness	Tainted Filename
CWE:78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	Weakness	Command Injection Untrusted Process Creation
CWE:88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')	Weakness	Command Injection
CWE:89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Weakness	SQL Injection
CWE:90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')	Weakness	LDAP Injection
CWE:99 Improper Control of Resource Identifiers ('Resource Injection')	Weakness	Tainted Filename Tainted Network Address Untrusted Network Host Untrusted Network Port
CWE:114 Process Control	Weakness	Command Injection Library Injection Untrusted Library Load
CWE:119 Improper Restriction of Operations within the Bounds of a Memory Buffer	Weakness	High Risk Loop Tainted Buffer Access Type Overrun Type Underrun
CWE:120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	Weakness	Buffer Overrun Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of getopt Use of getpass Use of gets Use of getwd Use of recvmsg Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog
CWE:128 Wrap-around Error	Weakness	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size
CWE:131 Incorrect Calculation of Buffer Size	Weakness	Addition Overflow of Allocation Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Subtraction Underflow of Allocation Size Tainted Allocation Size Truncation of Allocation Size
CWE:134 Use of Externally-Controlled Format String	Weakness	Format String Format String Injection Use of FormatMessage
CWE:170 Improper Null Termination	Weakness	No Space For Null Terminator Unterminated C String
CWE:190 Integer Overflow or Wraparound	Weakness	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size
CWE:191 Integer Underflow (Wrap or Wraparound)	Weakness	Subtraction Underflow of Allocation Size Subtraction Underflow of Size
CWE:192 Integer Coercion Error	Weakness	Cast Alters Value Coercion Alters Value Truncation of Allocation Size Truncation of Size
CWE:197 Numeric Truncation Error	Weakness	Truncation of Allocation Size Truncation of Size
CWE:200 Exposure of Sensitive Information to an Unauthorized Actor	Weakness	Tainted Write
CWE:242 Use of Inherently Dangerous Function	Weakness	Use of chroot Use of crypt Use of drem Use of gamma Use of gets Use of getwd Use of longjmp Use of mktemp Use of setjmp Use of tmpfile Use of tmpnam Use of vfork
CWE:243 Creation of chroot Jail Without Changing Working Directory	Weakness	Use of chroot chroot without chdir
CWE:252 Unchecked Return Value	Weakness	Ignored Return Value
CWE:256 Plaintext Storage of a Password	Weakness	Plaintext Storage of Password
CWE:259 Use of Hard-coded Password	Weakness	Hardcoded Authentication
CWE:269 Improper Privilege Management	Weakness	Use of AddAccessAllowedAce Use of AddAccessDeniedAce
CWE:281 Improper Preservation of Permissions	Weakness	Use of AddAccessAllowedAce Use of AddAccessDeniedAce
CWE:284 Improper Access Control	Weakness	Null Security Descriptor
CWE:311 Missing Encryption of Sensitive Data	Weakness	Plaintext Storage of Password Plaintext Transmission of Password
CWE:313 Cleartext Storage in a File or on Disk	Weakness	Plaintext Storage of Password
CWE:316 Cleartext Storage of Sensitive Information in Memory	Weakness	Plaintext Storage of Password
CWE:318 Cleartext Storage of Sensitive Information in Executable	Weakness	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password
CWE:319 Cleartext Transmission of Sensitive Information	Weakness	Plaintext Transmission of Password
CWE:321 Use of Hard-coded Cryptographic Key	Weakness	Hardcoded Crypto Key
CWE:325 Missing Cryptographic Step	Weakness	Encryption without Padding
CWE:326 Inadequate Encryption Strength	Weakness	Use of crypt Weak Cryptography
CWE:327 Use of a Broken or Risky Cryptographic Algorithm	Weakness	Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography
CWE:328 Use of Weak Hash	Weakness	Use of crypt
CWE:330 Use of Insufficiently Random Values	Weakness	Use of crypt Weak Cryptography
CWE:331 Insufficient Entropy	Weakness	Encryption without Padding
CWE:332 Insufficient Entropy in PRNG	Weakness	Use of rand Use of rand48 Function Use of random
CWE:334 Small Space of Random Values	Weakness	Use of rand Use of rand48 Function Use of random
CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)	Weakness	Hardcoded Seed in PRNG
CWE:337 Predictable Seed in Pseudo-Random Number Generator (PRNG)	Weakness	Predictable Seed in PRNG
CWE:338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	Weakness	Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography
CWE:362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')	Weakness	Data Race
CWE:364 Signal Handler Race Condition	Weakness	Data Race
CWE:366 Race Condition within a Thread	Weakness	Data Race
CWE:367 Time-of-check Time-of-use (TOCTOU) Race Condition	Weakness	File System Race Condition
CWE:369 Divide By Zero	Weakness	Division By Zero Float Division By Zero
CWE:377 Insecure Temporary File	Weakness	Use of GetTempFileName Use of mkstemp Use of mktemp Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s
CWE:390 Detection of Error Condition Without Action	Weakness	Empty if Statement
CWE:391 Unchecked Error Condition	Weakness	Ignored Return Value
CWE:394 Unexpected Status Code or Return Value	Weakness	Ignored Return Value
CWE:396 Declaration of Catch for Generic Exception	Weakness	Use of catch
CWE:397 Declaration of Throws for Generic Exception	Weakness	Use of throw
CWE:400 Uncontrolled Resource Consumption	Weakness	Excessive Stack Depth Potential Unbounded Loop
CWE:401 Missing Release of Memory after Effective Lifetime	Weakness	Leak
CWE:410 Insufficient Resource Pool	Weakness	Excessive Stack Depth
CWE:413 Improper Resource Locking	Weakness	Conflicting Lock Order Data Race Missing Lock Acquisition Nested Locks Try-lock that will never succeed Unknown Lock
CWE:415 Double Free	Weakness	Double Free
CWE:416 Use After Free	Weakness	Use After Free
CWE:427 Uncontrolled Search Path Element	Weakness	Tainted Environment Variable
CWE:457 Use of Uninitialized Variable	Weakness	Uninitialized Variable
CWE:459 Incomplete Cleanup	Weakness	Leak
CWE:465 Pointer Issues	Category	Pointer Before Beginning of Object Pointer Past End of Object
CWE:467 Use of sizeof() on a Pointer Type	Weakness	sizeof Array Parameter
CWE:469 Use of Pointer Subtraction to Determine Size	Weakness	Subtraction of Unrelated Pointers
CWE:474 Use of Function with Inconsistent Implementations	Weakness	Use of gamma
CWE:475 Undefined Behavior for Input to API	Weakness	Overlapping Memory Regions
CWE:476 NULL Pointer Dereference	Weakness	Null Pointer Dereference Unchecked Parameter Dereference
CWE:477 Use of Obsolete Function	Weakness	Use of LoadModule Use of MoveFile Use of WinExec Use of cuserid Use of drem Use of gamma
CWE:478 Missing Default Case in Multiple Condition Expression	Weakness	Missing default
CWE:481 Assigning instead of Comparing	Weakness	Assignment Result in Expression Assignment in Conditional
CWE:482 Comparing instead of Assigning	Weakness	Redundant Condition
CWE:484 Omitted Break Statement in Switch	Weakness	Missing break
CWE:489 Active Debug Code	Weakness	Leftover Debug Code
CWE:506 Embedded Malicious Code	Weakness	Hardcoded DNS Name Untrusted Network Host
CWE:511 Logic/Time Bomb	Weakness	Potential Timebomb
CWE:540 Inclusion of Sensitive Information in Source Code	Weakness	Hardcoded Authentication Hardcoded Crypto Key
CWE:546 Suspicious Comment	Weakness	Comment Suggests Code Unfinished
CWE:547 Use of Hard-coded, Security-relevant Constants	Weakness	Hardcoded Authentication Hardcoded Crypto Key
CWE:558 Use of getlogin() in Multithreaded Application	Weakness	Use of getlogin
CWE:561 Dead Code	Weakness	Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Catch Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow Unused Label Unused Macro Unused Parameter Unused Tag Unused Type
CWE:562 Return of Stack Variable Address	Weakness	Return Pointer to Local
CWE:563 Assignment to Variable without Use	Weakness	Unused Value
CWE:567 Unsynchronized Access to Shared Data in a Multithreaded Context	Weakness	Data Race
CWE:570 Expression is Always False	Weakness	Redundant Condition
CWE:571 Expression is Always True	Weakness	Redundant Condition
CWE:573 Improper Following of Specification by Caller	Weakness	Division By Zero Null Pointer Dereference Use After Free
CWE:587 Assignment of a Fixed Address to a Pointer	Weakness	Coercion: Integer Constant to Pointer
CWE:589 Call to Non-ubiquitous API	Weakness	Use of drem
CWE:590 Free of Memory not on the Heap	Weakness	Free Null Pointer Type Mismatch
CWE:605 Multiple Binds to the Same Port	Weakness	Use of SO_REUSEADDR
CWE:610 Externally Controlled Reference to a Resource in Another Sphere	Weakness	Tainted Filename Tainted Network Address Untrusted Network Host Untrusted Network Port
CWE:615 Inclusion of Sensitive Information in Source Code Comments	Weakness	Commented-out Code
CWE:628 Function Call with Incorrectly Specified Arguments	Weakness	Arctangent Domain Error Argument Too High Argument Too Low Floating Point Domain Error Floating Point Range Error Format String Type Error Gamma on Zero Logarithm on Negative Value Logarithm on Zero Raises FE_INVALID Undefined Power of Zero cosh on High Number cosh on Low Number sqrt on Negative Value
CWE:641 Improper Restriction of Names for Files and Other Resources	Weakness	Tainted Filename Tainted Network Address
CWE:657 Violation of Secure Design Principles	Weakness	Library Function Override
CWE:662 Improper Synchronization	Weakness	Blocking in Critical Section Inappropriate Storage Duration Lock/Unlock Mismatch
CWE:664 Improper Control of a Resource Through its Lifetime	Weakness	Misaligned Object
CWE:665 Improper Initialization	Weakness	Inappropriate C Atomic Initialization Inconsistent Chained Designator Initialization Inconsistent Enumerator Initialization Missing Braces in Initialization Over-initialized Element
CWE:666 Operation on Resource in Wrong Phase of Lifetime	Weakness	Socket In Wrong State Thread is not Joinable Use After Close
CWE:667 Improper Locking	Weakness	Missing Lock Release
CWE:672 Operation on a Resource after Expiration or Release	Weakness	Double Close Use After Close Use After Free
CWE:674 Uncontrolled Recursion	Weakness	Recursion
CWE:675 Multiple Operations on Resource in Single-Operation Context	Weakness	Double Initialization
CWE:676 Use of Potentially Dangerous Function	Weakness	Use of <fenv.h> Exception Handling Function Use of <signal.h> Use of <stdio.h> Input/Output Use of <stdio.h> Input/Output Macro Use of <tgmath.h> Use of <time.h> Time/Date Function Use of <wchar.h> Input/Output Use of <wchar.h> Input/Output Macro Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of AfxLoadLibrary Use of AfxParseURL Use of CoLoadLibrary Use of Condition Variable Signal Use of CreateFile Use of CreateProcess Use of CreateThread Use of FormatMessage Use of GetTempFileName Use of LoadLibrary Use of LoadModule Use of MoveFile Use of OemToAnsi Use of OemToChar Use of SHCreateProcessAsUserW Use of ShellExecute Use of StrCatChainW Use of WinExec Use of _exec Use of _spawn Use of abort Use of atof Use of atoi Use of atol Use of atoll Use of bsearch Use of catopen Use of chroot Use of crypt Use of cuserid Use of execlp Use of execvp Use of exit Use of getenv Use of getlogin Use of getopt Use of getpass Use of longjmp Use of memset Use of mkstemp Use of mktemp Use of popen Use of pthread_kill Use of putenv Use of qsort Use of rand Use of rand48 Function Use of random Use of realloc Use of realpath Use of recvmsg Use of setjmp Use of setuid Use of signal Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog Use of system Use of t_open Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s Use of ttyname Use of vfork Weak Cryptography chroot without chdir
CWE:680 Integer Overflow to Buffer Overflow	Weakness	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size Truncation of Allocation Size Truncation of Size
CWE:681 Incorrect Conversion between Numeric Types	Weakness	Negative Character Value
CWE:682 Incorrect Calculation	Weakness	Float Multiplication Overflow
CWE:686 Function Call With Incorrect Argument Type	Weakness	Array Parameter Mismatch GlobalHandle on GMEM_FIXED Memory GlobalLock on GMEM_FIXED Memory GlobalUnlock on GMEM_FIXED Memory Implicit Function Declaration LocalHandle on LMEM_FIXED Memory LocalLock on LMEM_FIXED Memory LocalUnlock on LMEM_FIXED Memory Negative Character Value Type Mismatch
CWE:687 Function Call With Incorrectly Specified Argument Value	Weakness	Arctangent Domain Error Argument Too High Argument Too Low Array Parameter Mismatch Floating Point Domain Error Floating Point Range Error Format String Type Error Function Call Has No Effect Gamma on Zero Logarithm on Negative Value Logarithm on Zero MAX_PATH Exceeded Negative file descriptor Raises FE_INVALID Undefined Power of Zero Unreasonable Size Argument cosh on High Number cosh on Low Number sqrt on Negative Value
CWE:688 Function Call With Incorrect Variable or Reference as Argument	Weakness	Arctangent Domain Error Argument Too High Argument Too Low Array Parameter Mismatch Floating Point Domain Error Floating Point Range Error Format String Type Error Function Call Has No Effect Gamma on Zero Logarithm on Negative Value Logarithm on Zero Raises FE_INVALID Undefined Power of Zero Unreasonable Size Argument cosh on High Number cosh on Low Number sqrt on Negative Value
CWE:690 Unchecked Return Value to NULL Pointer Dereference	Weakness	Null Pointer Dereference Null Test After Dereference
CWE:691 Insufficient Control Flow Management	Weakness	Use of longjmp Use of setjmp
CWE:696 Incorrect Behavior Order	Weakness	Conflicting Lock Order Null Test After Dereference Socket In Wrong State Thread is not Joinable Use After Close Use After Free
CWE:703 Improper Check or Handling of Exceptional Conditions	Weakness	Unreachable Catch
CWE:704 Incorrect Type Conversion or Cast	Weakness	Cast Alters Value Cast Removes const Qualifier Cast Removes volatile Qualifier Cast: Arithmetic Type/Void Pointer Cast: Non-integer Arithmetic Type/Object Pointer Cast: Object Pointers Cast: Virtual Base to Derived Coercion Alters Value Conversion from Function Pointer Conversion to Function Pointer Conversion: Pointer to Incomplete Conversion: Pointer/Integer Conversion: Void Pointer to Object Pointer Dangerous Function Cast Expression Value Widened by Assignment Expression Value Widened by Other Operand Float Pointer Conversion Inappropriate Cast Type Inappropriate Cast Type: Expression Risky Integer Promotion Varargs Function Cast
CWE:710 Improper Adherence to Coding Standards	Weakness	## Follows # Operator Basic Numerical Type Used Code Before #include Condition Contains Side Effects Conditional Compilation Confusing Literal Suffix Dynamic Allocation After Initialization Dynamic Thread Creation Float Pointer Conversion Function Pointer Function Pointer Conversion Function Too Long Global Variable Declared with Different Types Goto Statement Inconsistent Enumerator Initialization Library Function Override Lock/Unlock Mismatch Macro Argument is both Mixed and Expanded Macro Defined in Function Body Macro Does Not End With } or ) Macro Does Not Start With { or ( Macro Name is C Keyword Macro Undefined in Function Body Macro Uses # Operator Macro Uses ## Operator Macro Uses -> Operator Macro Uses Unary * Operator Macro Uses [] Operator Missing Parentheses Multiple Declarations of a Global Nested Function Declaration No Matching #endif No Matching #if Non-distinct Identifiers: External Names Non-distinct Identifiers: Macro/Macro Non-distinct Identifiers: Macro/Other Non-distinct Identifiers: Nested Scope Non-distinct Identifiers: Same Scope Non-unique Identifiers: External Name Non-unique Identifiers: Internal Name Non-unique Identifiers: Tag Non-unique Identifiers: Typedef Not Enough Assertions Pointer Type Inside Typedef Recursion Recursive Macro Task Delay Function Too Many Dereferences Too Many Parameters Too Much Indirection in Declaration Unbalanced Parenthesis Use of #define Use of #endif Use of #ifndef Use of #include Use of #undef Use of <stdlib.h> Allocator/Deallocator Use of <stdlib.h> Allocator/Deallocator Macro Use of longjmp Use of setjmp Variable Could Be const Variadic Macro
CWE:758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior	Weakness	Inappropriate Comparison of Virtual Member Function Indeterminate Order of Evaluation Missing Return Statement Missing Return Value Negative Shift Amount Shift Amount Exceeds Bit Width Uninitialized Variable Use of <signal.h> Use of <stdio.h> Input/Output Use of <stdio.h> Input/Output Macro Use of <tgmath.h> Use of <time.h> Time/Date Function Use of <wchar.h> Input/Output Use of <wchar.h> Input/Output Macro Use of abort Use of atof Use of atoi Use of atol Use of atoll Use of bsearch Use of exit Use of getenv Use of putenv
CWE:760 Use of a One-Way Hash with a Predictable Salt	Weakness	Hardcoded Crypto Salt
CWE:761 Free of Pointer not at Start of Buffer	Weakness	Misaligned Object Type Mismatch
CWE:762 Mismatched Memory Management Routines	Weakness	Pool Mismatch Type Mismatch
CWE:763 Release of Invalid Pointer or Reference	Weakness	Double Free Misaligned Object
CWE:764 Multiple Locks of a Critical Resource	Weakness	Double Lock Locked Twice
CWE:765 Multiple Unlocks of a Critical Resource	Weakness	Double Unlock
CWE:771 Missing Reference to Active Allocated Resource	Weakness	Leak
CWE:772 Missing Release of Resource after Effective Lifetime	Weakness	Leak
CWE:773 Missing Reference to Active File Descriptor or Handle	Weakness	Leak
CWE:775 Missing Release of File Descriptor or Handle after Effective Lifetime	Weakness	Leak
CWE:780 Use of RSA Algorithm without OAEP	Weakness	Encryption without Padding
CWE:783 Operator Precedence Logic Error	Weakness	Confusing Operator Overload
CWE:785 Use of Path Manipulation Function without Maximum-sized Buffer	Weakness	Use of realpath
CWE:786 Access of Memory Location Before Start of Buffer	Weakness	Buffer Underrun
CWE:788 Access of Memory Location After End of Buffer	Weakness	Buffer Overrun
CWE:789 Memory Allocation with Excessive Size Value	Weakness	Tainted Allocation Size
CWE:798 Use of Hard-coded Credentials	Weakness	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt
CWE:821 Incorrect Synchronization	Weakness	Risky Atomic Memory Order
CWE:822 Untrusted Pointer Dereference	Weakness	Unchecked Parameter Dereference
CWE:823 Use of Out-of-range Pointer Offset	Weakness	Misaligned Object Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object
CWE:832 Unlock of a Resource that is not Locked	Weakness	Double Unlock Missing Lock Acquisition
CWE:833 Deadlock	Weakness	Deadlock
CWE:835 Loop with Unreachable Exit Condition ('Infinite Loop')	Weakness	Potential Unbounded Loop
CWE:843 Access of Resource Using Incompatible Type ('Type Confusion')	Weakness	GlobalHandle on GMEM_FIXED Memory GlobalLock on GMEM_FIXED Memory GlobalUnlock on GMEM_FIXED Memory LocalHandle on LMEM_FIXED Memory LocalLock on LMEM_FIXED Memory LocalUnlock on LMEM_FIXED Memory Type Mismatch
CWE:863 Incorrect Authorization	Weakness	Use of cuserid Use of getlogin
CWE:908 Use of Uninitialized Resource	Weakness	Inappropriate C Atomic Initialization Uninitialized Variable
CWE:910 Use of Expired File Descriptor	Weakness	Use After Close
CWE:1007 Insufficient Visual Distinction of Homoglyphs Presented to User	Weakness	Typographically Ambiguous Identifiers
CWE:1025 Comparison Using Wrong Factors	Weakness	Read Past Null Terminator
CWE:1037 Processor Optimization Removal or Modification of Security-critical Code	Weakness	Use of memset
CWE:1041 Use of Redundant Code	Weakness	Copy-Paste Error
CWE:1055 Multiple Inheritance from Concrete Classes	Weakness	Multiple Inheritance with Public Base Class Multiple Inheritance with Too Many Protected Base Classes
CWE:1056 Invokable Control Element with Variadic Parameters	Weakness	Ellipsis
CWE:1064 Invokable Control Element with Signature Containing an Excessive Number of Parameters	Weakness	Too Many Parameters
CWE:1076 Insufficient Adherence to Expected Conventions	Weakness	Declaration of Reserved Name Implicit Constructor Shadowing Library Function Override Macro Defines Constant Missing Return Statement Missing User-defined Operations Non-const String Literal Not All Warnings Are Enabled Override of Non-Virtual Method Unneeded Implicitly Generated Operations Use of #elif Use of #elifdef Use of #elifndef Use of #else Use of #error Use of #if Use of #ifdef Use of #import Use of #include_next Use of #line Use of #pragma Use of #using Use of #warning Use of NULL Warnings Not Treated As Errors
CWE:1077 Floating Point Comparison with Incorrect Operator	Weakness	Floating Point Equality
CWE:1078 Inappropriate Source Code Style or Formatting	Weakness	Multiple Declarations On Line Multiple Statements On Line Octal Constant
CWE:1079 Parent Class without Virtual Destructor Method	Weakness	delete with Non-Virtual Destructor
CWE:1080 Source Code File with Excessive Number of Lines of Code	Weakness	Function Too Long
CWE:1085 Invokable Control Element with Excessive Volume of Commented-out Code	Weakness	Commented-out Code
CWE:1087 Class with Virtual Method without a Virtual Destructor	Weakness	delete with Non-Virtual Destructor
CWE:1091 Use of Object without Invoking Destructor Method	Weakness	Leak
CWE:1106 Insufficient Use of Symbolic Constants	Weakness	switch With Non-enum Expression
CWE:1120 Excessive Code Complexity	Weakness	Missing Return Statement Multiple Abnormal Loop Exits
CWE:1121 Excessive McCabe Cyclomatic Complexity	Weakness	High Cyclomatic Complexity (Procedure)
CWE:1126 Declaration of Variable with Unnecessarily Wide Scope	Weakness	Scope Could Be File Static Scope Could Be Local Static
CWE:1127 Compilation with Insufficient Warnings or Errors	Weakness	Not All Warnings Are Enabled Warnings Not Treated As Errors
CWE:1164 Irrelevant Code	Weakness	Explicit Zero Alignment Function Call Has No Effect Over-initialized Element Redundant Condition Unused Value Useless Assignment
CWE:1295 Debug Messages Revealing Unnecessary Information	Weakness	Leftover Debug Code
CWE:1335 Incorrect Bitwise Shift of Integer	Weakness	Negative Shift Amount Shift Amount Exceeds Bit Width
CWE:1341 Multiple Releases of Same Resource or Handle	Weakness	Double Close
CWE:1389 Incorrect Parsing of Numbers with Different Radices	Weakness	Octal Constant
CWE:1419 Incorrect Initialization of Resource	Weakness	Initialization Cycle Partially Uninitialized Aggregate Partially Uninitialized Array Uninitialized Variable Unordered Initialization Unspecified Array Size with Designator Initialization Virtual Call in Constructor

Broad Mapping

CWE

Entity Type

C/C++ Warning Classes

CWE:2 7PK - Environment

Category

hierarchy ancestor	Unused Value Use of memset

CWE:14 Compiler Removal of Code to Clear Buffers

Weakness

closely mapped	Use of memset
also related	Unused Value

CWE:15 External Control of System or Configuration Setting

Weakness

closely mapped	Tainted Configuration Setting

CWE:19 Data Processing Errors

Category

hierarchy ancestor

CWE:20 Improper Input Validation

Weakness

closely mapped

hierarchy ancestor

CWE:22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Weakness

closely mapped	Tainted Filename

CWE:23 Relative Path Traversal

Weakness

hierarchy descendant	Tainted Filename

CWE:24 Path Traversal: '../filedir'

Weakness

hierarchy descendant	Tainted Filename

CWE:25 Path Traversal: '/../filedir'

Weakness

hierarchy descendant	Tainted Filename

CWE:26 Path Traversal: '/dir/../filename'

Weakness

hierarchy descendant	Tainted Filename

CWE:27 Path Traversal: 'dir/../../filename'

Weakness

hierarchy descendant	Tainted Filename

CWE:28 Path Traversal: '..\filedir'

Weakness

hierarchy descendant	Tainted Filename

CWE:29 Path Traversal: '\..\filename'

Weakness

hierarchy descendant	Tainted Filename

CWE:30 Path Traversal: '\dir\..\filename'

Weakness

hierarchy descendant	Tainted Filename

CWE:31 Path Traversal: 'dir\..\..\filename'

Weakness

hierarchy descendant	Tainted Filename

CWE:32 Path Traversal: '...' (Triple Dot)

Weakness

hierarchy descendant	Tainted Filename

CWE:33 Path Traversal: '....' (Multiple Dot)

Weakness

hierarchy descendant	Tainted Filename

CWE:34 Path Traversal: '....//'

Weakness

hierarchy descendant	Tainted Filename

CWE:35 Path Traversal: '.../...//'

Weakness

hierarchy descendant	Tainted Filename

CWE:36 Absolute Path Traversal

Weakness

hierarchy descendant	Tainted Filename

CWE:37 Path Traversal: '/absolute/pathname/here'

Weakness

hierarchy descendant	Tainted Filename

CWE:38 Path Traversal: '\absolute\pathname\here'

Weakness

hierarchy descendant	Tainted Filename

CWE:39 Path Traversal: 'C:dirname'

Weakness

hierarchy descendant	Tainted Filename

CWE:40 Path Traversal: '\\UNC\share\name\' (Windows UNC Share)

Weakness

hierarchy descendant	Tainted Filename

CWE:73 External Control of File Name or Path

Weakness

closely mapped	Tainted Filename
hierarchy ancestor	Command Injection Library Injection Untrusted Library Load

CWE:74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Weakness

hierarchy ancestor	Command Injection LDAP Injection SQL Injection Tainted Filename Tainted Network Address Tainted Write Untrusted Network Host Untrusted Network Port Untrusted Process Creation Use of system

CWE:77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Weakness

hierarchy ancestor	Command Injection Untrusted Process Creation Use of system

CWE:78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Weakness

closely mapped	Command Injection Untrusted Process Creation
also related	Use of system

CWE:79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Weakness

also related	Tainted Write

CWE:88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Weakness

closely mapped	Command Injection

CWE:89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Weakness

closely mapped	SQL Injection

CWE:90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Weakness

closely mapped	LDAP Injection

CWE:99 Improper Control of Resource Identifiers ('Resource Injection')

Weakness

closely mapped	Tainted Filename Tainted Network Address Untrusted Network Host Untrusted Network Port

CWE:114 Process Control

Weakness

closely mapped	Command Injection Library Injection Untrusted Library Load

CWE:116 Improper Encoding or Escaping of Output

Weakness

hierarchy ancestor	Tainted Write

CWE:117 Improper Output Neutralization for Logs

Weakness

also related	Tainted Write

CWE:118 Incorrect Access of Indexable Resource ('Range Error')

Weakness

also related

Misaligned Object

hierarchy ancestor

CWE:119 Improper Restriction of Operations within the Bounds of a Memory Buffer

Weakness

closely mapped	High Risk Loop Tainted Buffer Access Type Overrun Type Underrun
also related	Negative Character Value Tainted Allocation Size
hierarchy ancestor	Addition Overflow of Size Array Parameter Mismatch Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Double Free Misaligned Object Multiplication Overflow of Size No Space For Null Terminator Null Pointer Dereference Null Test After Dereference Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Return Pointer to Freed Subtraction Underflow of Size Truncation of Size Unchecked Parameter Dereference Uninitialized Variable Unreasonable Size Argument Unterminated C String Use After Free Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of getopt Use of getpass Use of gets Use of getwd Use of realpath Use of recvmsg Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog

CWE:120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Weakness

closely mapped	Buffer Overrun Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of getopt Use of getpass Use of gets Use of getwd Use of recvmsg Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog
also related	Array Parameter Mismatch Buffer Underrun No Space For Null Terminator Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unterminated C String
hierarchy ancestor	Use of realpath

CWE:121 Stack-based Buffer Overflow

Weakness

hierarchy descendant

CWE:122 Heap-based Buffer Overflow

Weakness

hierarchy descendant

CWE:123 Write-what-where Condition

Weakness

also related	Buffer Overrun Buffer Underrun Null Pointer Dereference Null Test After Dereference Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun
hierarchy descendant	Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of getopt Use of getpass Use of gets Use of getwd Use of recvmsg Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog

CWE:124 Buffer Underwrite ('Buffer Underflow')

Weakness

also related

hierarchy descendant

CWE:125 Out-of-bounds Read

Weakness

also related	Addition Overflow of Size Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Multiplication Overflow of Size Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Subtraction Underflow of Size Tainted Buffer Access Truncation of Size Type Overrun Type Underrun
hierarchy ancestor	Negative Character Value

CWE:126 Buffer Over-read

Weakness

hierarchy descendant	Addition Overflow of Size Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Multiplication Overflow of Size Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Subtraction Underflow of Size Tainted Buffer Access Truncation of Size Type Overrun Type Underrun

CWE:127 Buffer Under-read

Weakness

also related	Negative Character Value
hierarchy descendant	Addition Overflow of Size Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Multiplication Overflow of Size Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Subtraction Underflow of Size Tainted Buffer Access Truncation of Size Type Overrun Type Underrun

CWE:128 Wrap-around Error

Weakness

closely mapped	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size
also related	Cast Alters Value Coercion Alters Value Tainted Buffer Access Truncation of Allocation Size Truncation of Size

CWE:129 Improper Validation of Array Index

Weakness

also related	Array Parameter Mismatch Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:130 Improper Handling of Length Parameter Inconsistency

Weakness

also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Allocation Size Tainted Buffer Access Type Overrun Type Underrun Unreasonable Size Argument Use of StrCatChainW Use of getopt Use of recvmsg

CWE:131 Incorrect Calculation of Buffer Size

Weakness

closely mapped	Addition Overflow of Allocation Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Subtraction Underflow of Allocation Size Tainted Allocation Size Truncation of Allocation Size
also related	Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value No Space For Null Terminator Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unreasonable Size Argument Unterminated C String Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of getopt Use of getpass Use of gets Use of getwd Use of recvmsg Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog
hierarchy ancestor	sizeof Array Parameter

CWE:133 String Errors

Category

hierarchy ancestor

CWE:134 Use of Externally-Controlled Format String

Weakness

closely mapped	Format String Format String Injection Use of FormatMessage

CWE:135 Incorrect Calculation of Multi-Byte String Length

Weakness

also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:136 Type Errors

Category

hierarchy ancestor

CWE:137 Data Neutralization Issues

Category

hierarchy ancestor	Buffer Overrun Command Injection LDAP Injection No Space For Null Terminator SQL Injection Tainted Filename Tainted Network Address Tainted Write Unterminated C String Untrusted Process Creation Use of system

CWE:138 Improper Neutralization of Special Elements

Weakness

hierarchy ancestor	No Space For Null Terminator Unterminated C String

CWE:147 Improper Neutralization of Input Terminators

Weakness

hierarchy ancestor	No Space For Null Terminator Unterminated C String

CWE:170 Improper Null Termination

Weakness

closely mapped	No Space For Null Terminator Unterminated C String
also related	Buffer Overrun

CWE:188 Reliance on Data/Memory Layout

Weakness

also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:189 Numeric Errors

Category

hierarchy ancestor

CWE:190 Integer Overflow or Wraparound

Weakness

closely mapped	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size
also related	Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Truncation of Allocation Size Truncation of Size Type Overrun Type Underrun Unreasonable Size Argument

CWE:191 Integer Underflow (Wrap or Wraparound)

Weakness

closely mapped	Subtraction Underflow of Allocation Size Subtraction Underflow of Size
also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Truncation of Allocation Size Truncation of Size Type Overrun Type Underrun Unreasonable Size Argument

CWE:192 Integer Coercion Error

Weakness

closely mapped	Cast Alters Value Coercion Alters Value Truncation of Allocation Size Truncation of Size
also related	Buffer Overrun Buffer Underrun Implicit Function Declaration Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unreasonable Size Argument

CWE:193 Off-by-one Error

Weakness

also related

CWE:194 Unexpected Sign Extension

Weakness

also related

CWE:195 Signed to Unsigned Conversion Error

Weakness

also related	Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value No Space For Null Terminator Pointer Before Beginning of Object Pointer Past End of Object Truncation of Allocation Size Truncation of Size Type Overrun Type Underrun Unreasonable Size Argument Unterminated C String

CWE:196 Unsigned to Signed Conversion Error

Weakness

also related	Buffer Underrun Cast Alters Value Coercion Alters Value Pointer Before Beginning of Object Truncation of Allocation Size Truncation of Size Type Underrun Unreasonable Size Argument

CWE:197 Numeric Truncation Error

Weakness

closely mapped	Truncation of Allocation Size Truncation of Size
also related	Buffer Overrun Cast Alters Value Coercion Alters Value Pointer Past End of Object Type Overrun

CWE:199 Information Management Errors

Category

hierarchy ancestor	Commented-out Code File System Race Condition Function Call Has No Effect Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Tainted Filename Tainted Write Unused Value Use After Close Use of memset sizeof Array Parameter

CWE:200 Exposure of Sensitive Information to an Unauthorized Actor

Weakness

closely mapped	Tainted Write
hierarchy ancestor	Commented-out Code File System Race Condition Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Leftover Debug Code Tainted Filename Use After Close

CWE:201 Insertion of Sensitive Information Into Sent Data

Weakness

also related	Tainted Filename Tainted Write

CWE:203 Observable Discrepancy

Weakness

also related	Tainted Write

CWE:212 Improper Removal of Sensitive Information Before Storage or Transfer

Weakness

hierarchy ancestor	Function Call Has No Effect Unused Value Use of memset sizeof Array Parameter

CWE:221 Information Loss or Omission

Weakness

hierarchy ancestor	Typographically Ambiguous Identifiers Use of catch Use of throw

CWE:226 Sensitive Information in Resource Not Removed Before Reuse

Weakness

also related	Function Call Has No Effect Unused Value Use of memset sizeof Array Parameter

CWE:227 7PK - API Abuse

Category

also related

hierarchy ancestor

CWE:228 Improper Handling of Syntactically Invalid Structure

Weakness

hierarchy ancestor

CWE:229 Improper Handling of Values

Weakness

hierarchy ancestor	Ignored Return Value Inappropriate C Atomic Initialization Null Pointer Dereference Uninitialized Variable

CWE:230 Improper Handling of Missing Values

Weakness

also related	Ignored Return Value Null Pointer Dereference Uninitialized Variable

CWE:231 Improper Handling of Extra Values

Weakness

also related	Ignored Return Value Null Pointer Dereference Uninitialized Variable

CWE:232 Improper Handling of Undefined Values

Weakness

also related	Ignored Return Value Inappropriate C Atomic Initialization Null Pointer Dereference Uninitialized Variable

CWE:237 Improper Handling of Structural Elements

Weakness

hierarchy ancestor	Buffer Overrun Buffer Underrun Ignored Return Value Inappropriate C Atomic Initialization Null Pointer Dereference Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Allocation Size Tainted Buffer Access Type Overrun Type Underrun Uninitialized Variable Unreasonable Size Argument Use of StrCatChainW Use of getopt Use of recvmsg

CWE:238 Improper Handling of Incomplete Structural Elements

Weakness

also related	Ignored Return Value Inappropriate C Atomic Initialization Null Pointer Dereference Uninitialized Variable

CWE:239 Failure to Handle Incomplete Element

Weakness

also related	Ignored Return Value Inappropriate C Atomic Initialization Null Pointer Dereference Uninitialized Variable

CWE:240 Improper Handling of Inconsistent Structural Elements

Weakness

hierarchy ancestor	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Allocation Size Tainted Buffer Access Type Overrun Type Underrun Unreasonable Size Argument Use of StrCatChainW Use of getopt Use of recvmsg

CWE:241 Improper Handling of Unexpected Data Type

Weakness

also related	Coercion Alters Value Negative Character Value

CWE:242 Use of Inherently Dangerous Function

Weakness

closely mapped	Use of chroot Use of crypt Use of drem Use of gamma Use of gets Use of getwd Use of longjmp Use of mktemp Use of setjmp Use of tmpfile Use of tmpnam Use of vfork
also related	Use of <stdlib.h> Allocator/Deallocator

CWE:243 Creation of chroot Jail Without Changing Working Directory

Weakness

closely mapped	Use of chroot chroot without chdir

CWE:244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')

Weakness

also related	Function Call Has No Effect Unused Value Use of memset

CWE:248 Uncaught Exception

Weakness

also related	Use of throw

CWE:251 Often Misused: String Management

Category

also related	Buffer Overrun No Space For Null Terminator Type Overrun Unterminated C String Use of StrCatChainW Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns

CWE:252 Unchecked Return Value

Weakness

closely mapped	Ignored Return Value
also related	Buffer Overrun Buffer Underrun Division By Zero Free Null Pointer Null Pointer Dereference Null Security Descriptor Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Use After Free
hierarchy ancestor	Null Test After Dereference

CWE:253 Incorrect Check of Function Return Value

Weakness

also related	Buffer Overrun Buffer Underrun Division By Zero Free Null Pointer Null Pointer Dereference Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Redundant Condition Tainted Buffer Access Type Overrun Type Underrun Use After Free

CWE:254 7PK - Security Features

Category

hierarchy ancestor

CWE:255 Credentials Management Errors

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:256 Plaintext Storage of a Password

Weakness

closely mapped	Plaintext Storage of Password

CWE:259 Use of Hard-coded Password

Weakness

closely mapped	Hardcoded Authentication

CWE:265 Privilege Issues

Category

hierarchy ancestor	Ignored Return Value Null Security Descriptor Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of chroot chroot without chdir

CWE:266 Incorrect Privilege Assignment

Weakness

also related	Null Security Descriptor Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:269 Improper Privilege Management

Weakness

closely mapped	Use of AddAccessAllowedAce Use of AddAccessDeniedAce
hierarchy ancestor	Ignored Return Value Null Security Descriptor

CWE:274 Improper Handling of Insufficient Privileges

Weakness

also related	Ignored Return Value

CWE:275 Permission Issues

Category

also related	Write to Read Only File
hierarchy ancestor	Ignored Return Value Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:280 Improper Handling of Insufficient Permissions or Privileges

Weakness

also related	Ignored Return Value

CWE:281 Improper Preservation of Permissions

Weakness

closely mapped	Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:284 Improper Access Control

Weakness

closely mapped	Null Security Descriptor
hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Ignored Return Value Plaintext Storage of Password Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of crypt Use of cuserid Use of getlogin Weak Cryptography

CWE:285 Improper Authorization

Weakness

hierarchy ancestor	Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of cuserid Use of getlogin

CWE:287 Improper Authentication

Weakness

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:290 Authentication Bypass by Spoofing

Weakness

hierarchy ancestor	Hardcoded DNS Name

CWE:310 Cryptographic Issues

Category

hierarchy ancestor	Encryption without Padding Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded Seed in PRNG Predictable Seed in PRNG Redundant Condition Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:311 Missing Encryption of Sensitive Data

Weakness

closely mapped	Plaintext Storage of Password Plaintext Transmission of Password
also related	Tainted Write
hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt

CWE:312 Cleartext Storage of Sensitive Information

Weakness

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password

CWE:313 Cleartext Storage in a File or on Disk

Weakness

closely mapped	Plaintext Storage of Password

CWE:316 Cleartext Storage of Sensitive Information in Memory

Weakness

closely mapped	Plaintext Storage of Password

CWE:318 Cleartext Storage of Sensitive Information in Executable

Weakness

closely mapped	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password

CWE:319 Cleartext Transmission of Sensitive Information

Weakness

closely mapped	Plaintext Transmission of Password

CWE:320 Key Management Errors

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Use of crypt Weak Cryptography

CWE:321 Use of Hard-coded Cryptographic Key

Weakness

closely mapped	Hardcoded Crypto Key
also related	Hardcoded Authentication Hardcoded Crypto Salt Use of crypt Weak Cryptography

CWE:323 Reusing a Nonce, Key Pair in Encryption

Weakness

also related	Hardcoded Crypto Key Hardcoded Crypto Salt

CWE:325 Missing Cryptographic Step

Weakness

closely mapped	Encryption without Padding
also related	Redundant Condition

CWE:326 Inadequate Encryption Strength

Weakness

closely mapped	Use of crypt Weak Cryptography
hierarchy ancestor	Hardcoded Crypto Salt

CWE:327 Use of a Broken or Risky Cryptographic Algorithm

Weakness

closely mapped	Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography
hierarchy ancestor	Encryption without Padding Hardcoded Crypto Salt

CWE:328 Use of Weak Hash

Weakness

closely mapped	Use of crypt
also related	Weak Cryptography
hierarchy ancestor	Hardcoded Crypto Salt

CWE:330 Use of Insufficiently Random Values

Weakness

closely mapped

hierarchy ancestor

CWE:331 Insufficient Entropy

Weakness

closely mapped	Encryption without Padding
also related	Hardcoded Crypto Key
hierarchy ancestor	Use of Weak Cryptographic Algorithm Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:332 Insufficient Entropy in PRNG

Weakness

closely mapped	Use of rand Use of rand48 Function Use of random
also related	Use of Weak Cryptographic Algorithm Weak Cryptography

CWE:334 Small Space of Random Values

Weakness

closely mapped	Use of rand Use of rand48 Function Use of random

CWE:335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Weakness

hierarchy ancestor	Hardcoded Seed in PRNG Predictable Seed in PRNG Use of rand Use of rand48 Function Use of random

CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)

Weakness

closely mapped	Hardcoded Seed in PRNG

CWE:337 Predictable Seed in Pseudo-Random Number Generator (PRNG)

Weakness

closely mapped	Predictable Seed in PRNG

CWE:338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Weakness

closely mapped	Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:339 Small Seed Space in PRNG

Weakness

also related	Use of rand Use of rand48 Function Use of random

CWE:340 Generation of Predictable Numbers or Identifiers

Weakness

also related	Use of rand Use of rand48 Function Use of random

CWE:341 Predictable from Observable State

Weakness

hierarchy descendant	Use of rand Use of rand48 Function Use of random

CWE:342 Predictable Exact Value from Previous Values

Weakness

hierarchy descendant	Use of rand Use of rand48 Function Use of random

CWE:343 Predictable Value Range from Previous Values

Weakness

hierarchy descendant	Use of rand Use of rand48 Function Use of random

CWE:344 Use of Invariant Value in Dynamically Changing Context

Weakness

also related

hierarchy ancestor

CWE:350 Reliance on Reverse DNS Resolution for a Security-Critical Action

Weakness

also related	Hardcoded DNS Name

CWE:355 User Interface Security Issues

Category

hierarchy ancestor	Typographically Ambiguous Identifiers

CWE:359 Exposure of Private Personal Information to an Unauthorized Actor

Weakness

also related	Tainted Write

CWE:361 7PK - Time and State

Category

hierarchy ancestor	Data Race File System Race Condition Use of GetTempFileName Use of mkstemp Use of mktemp Use of signal Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CWE:362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Weakness

closely mapped	Data Race
also related	Multiple Accesses of Atomic Risky Atomic Memory Order
hierarchy ancestor	File System Race Condition Use of signal

CWE:363 Race Condition Enabling Link Following

Weakness

hierarchy descendant	File System Race Condition

CWE:364 Signal Handler Race Condition

Weakness

closely mapped	Data Race
hierarchy ancestor	Use of signal

CWE:366 Race Condition within a Thread

Weakness

closely mapped	Data Race
also related	Multiple Accesses of Atomic

CWE:367 Time-of-check Time-of-use (TOCTOU) Race Condition

Weakness

closely mapped	File System Race Condition

CWE:368 Context Switching Race Condition

Weakness

also related	Data Race Multiple Accesses of Atomic

CWE:369 Divide By Zero

Weakness

closely mapped	Division By Zero Float Division By Zero

CWE:371 State Issues

Category

hierarchy ancestor	Tainted Configuration Setting

CWE:377 Insecure Temporary File

Weakness

closely mapped	Use of GetTempFileName Use of mkstemp Use of mktemp Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CWE:378 Creation of Temporary File With Insecure Permissions

Weakness

also related	Use of GetTempFileName Use of mkstemp Use of mktemp Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CWE:379 Creation of Temporary File in Directory with Insecure Permissions

Weakness

also related	Use of GetTempFileName Use of mkstemp Use of mktemp Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CWE:386 Symbolic Name not Mapping to Correct Object

Weakness

also related	File System Race Condition

CWE:387 Signal Errors

Category

hierarchy ancestor	Data Race Use of signal

CWE:388 7PK - Errors

Category

hierarchy ancestor	Ignored Return Value Use of catch Use of throw

CWE:389 Error Conditions, Return Values, Status Codes

Category

also related

hierarchy ancestor

CWE:390 Detection of Error Condition Without Action

Weakness

closely mapped	Empty if Statement
also related	Null Pointer Dereference Null Test After Dereference

CWE:391 Unchecked Error Condition

Weakness

closely mapped	Ignored Return Value

CWE:392 Missing Report of Error Condition

Weakness

also related	Ignored Return Value Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow

CWE:394 Unexpected Status Code or Return Value

Weakness

closely mapped	Ignored Return Value
also related	Free Null Pointer Inappropriate Assignment Operator Return

CWE:396 Declaration of Catch for Generic Exception

Weakness

closely mapped	Use of catch

CWE:397 Declaration of Throws for Generic Exception

Weakness

closely mapped	Use of throw

CWE:398 7PK - Code Quality

Category

also related

Free Null Pointer

hierarchy ancestor

CWE:399 Resource Management Errors

Category

hierarchy ancestor

CWE:400 Uncontrolled Resource Consumption

Weakness

closely mapped	Excessive Stack Depth Potential Unbounded Loop
also related	Use of qsort
hierarchy ancestor	Leak Tainted Allocation Size Unreasonable Size Argument

CWE:401 Missing Release of Memory after Effective Lifetime

Weakness

closely mapped	Leak

CWE:404 Improper Resource Shutdown or Release

Weakness

also related	Double Close Type Mismatch
hierarchy ancestor	Double Free Free Null Pointer Function Call Has No Effect Leak Misaligned Object Pool Mismatch Unused Value Use of memset sizeof Array Parameter

CWE:410 Insufficient Resource Pool

Weakness

closely mapped	Excessive Stack Depth

CWE:411 Resource Locking Problems

Category

also related	Try-lock that will never succeed
hierarchy ancestor	Conflicting Lock Order Data Race Deadlock Double Lock Double Unlock Locked Twice Missing Lock Acquisition Multiple Accesses of Atomic Nested Locks Task Delay Function Unknown Lock

CWE:413 Improper Resource Locking

Weakness

closely mapped	Conflicting Lock Order Data Race Missing Lock Acquisition Nested Locks Try-lock that will never succeed Unknown Lock
also related	Multiple Accesses of Atomic Task Delay Function

CWE:414 Missing Lock Check

Weakness

also related	Data Race

CWE:415 Double Free

Weakness

closely mapped	Double Free

CWE:416 Use After Free

Weakness

closely mapped	Use After Free
also related	Return Pointer to Freed

CWE:417 Communication Channel Errors

Category

hierarchy ancestor	File System Race Condition Tainted Filename Tainted Write Untrusted Network Host

CWE:426 Untrusted Search Path

Weakness

also related	Tainted Environment Variable Use of AfxLoadLibrary Use of CoLoadLibrary Use of LoadLibrary Use of SHCreateProcessAsUserW Use of ShellExecute Use of _exec Use of _spawn Use of execlp Use of execvp Use of popen Use of system

CWE:427 Uncontrolled Search Path Element

Weakness

closely mapped	Tainted Environment Variable

CWE:435 Improper Interaction Between Multiple Correctly-Behaving Entities

Weakness

hierarchy ancestor	Buffer Overrun Buffer Underrun No Space For Null Terminator Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unterminated C String Unused Value Use of memset

CWE:436 Interpretation Conflict

Weakness

hierarchy ancestor	No Space For Null Terminator Unterminated C String

CWE:438 Behavioral Problems

Category

hierarchy ancestor

CWE:451 User Interface (UI) Misrepresentation of Critical Information

Weakness

hierarchy ancestor	Typographically Ambiguous Identifiers

CWE:452 Initialization and Cleanup Errors

Category

also related	Double Initialization
hierarchy ancestor	Command Injection Format String Injection Function Call Has No Effect Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Hardcoded Seed in PRNG LDAP Injection Leak Library Injection SQL Injection Uninitialized Variable Unused Value Use of memset sizeof Array Parameter

CWE:453 Insecure Default Variable Initialization

Weakness

also related	Uninitialized Variable

CWE:454 External Initialization of Trusted Variables or Data Stores

Weakness

also related	Command Injection Format String Injection LDAP Injection Library Injection SQL Injection

CWE:456 Missing Initialization of a Variable

Weakness

also related	Inappropriate C Atomic Initialization Partially Uninitialized Aggregate Partially Uninitialized Array Uninitialized Variable

CWE:457 Use of Uninitialized Variable

Weakness

closely mapped	Uninitialized Variable
also related	Inappropriate C Atomic Initialization

CWE:459 Incomplete Cleanup

Weakness

closely mapped	Leak
hierarchy ancestor	Function Call Has No Effect Unused Value Use of memset sizeof Array Parameter

CWE:465 Pointer Issues

Category

closely mapped	Pointer Before Beginning of Object Pointer Past End of Object
also related	High Risk Loop Misaligned Object Return Pointer to Freed
hierarchy ancestor	Buffer Overrun Buffer Underrun Cast: Arithmetic Type/Void Pointer Coercion: Integer Constant to Pointer Conversion: Pointer/Integer Double Free Free Null Pointer Null Pointer Dereference Null Test After Dereference Pointer Arithmetic Pool Mismatch Subtraction of Unrelated Pointers Tainted Buffer Access Type Mismatch Type Overrun Type Underrun Unchecked Parameter Dereference Uninitialized Variable Use After Free Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of getopt Use of getpass Use of gets Use of getwd Use of recvmsg Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog

CWE:466 Return of Pointer Value Outside of Expected Range

Weakness

also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:467 Use of sizeof() on a Pointer Type

Weakness

closely mapped	sizeof Array Parameter

CWE:468 Incorrect Pointer Scaling

Weakness

also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:469 Use of Pointer Subtraction to Determine Size

Weakness

closely mapped	Subtraction of Unrelated Pointers

CWE:471 Modification of Assumed-Immutable Data (MAID)

Weakness

also related	Copy Operation Parameter Is Not const

CWE:474 Use of Function with Inconsistent Implementations

Weakness

closely mapped	Use of gamma
hierarchy ancestor	Use of drem

CWE:475 Undefined Behavior for Input to API

Weakness

closely mapped	Overlapping Memory Regions

CWE:476 NULL Pointer Dereference

Weakness

closely mapped	Null Pointer Dereference Unchecked Parameter Dereference
also related	Null Test After Dereference

CWE:477 Use of Obsolete Function

Weakness

closely mapped	Use of LoadModule Use of MoveFile Use of WinExec Use of cuserid Use of drem Use of gamma

CWE:478 Missing Default Case in Multiple Condition Expression

Weakness

closely mapped	Missing default

CWE:479 Signal Handler Use of a Non-reentrant Function

Weakness

also related	Use of signal

CWE:480 Use of Incorrect Operator

Weakness

also related	Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow
hierarchy ancestor	Assignment Result in Expression Assignment in Conditional Unused Value

CWE:481 Assigning instead of Comparing

Weakness

closely mapped	Assignment Result in Expression Assignment in Conditional
also related	Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow Unused Value

CWE:482 Comparing instead of Assigning

Weakness

closely mapped	Redundant Condition
also related	Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow

CWE:483 Incorrect Block Delimitation

Weakness

also related

CWE:484 Omitted Break Statement in Switch

Weakness

closely mapped	Missing break
also related	Malformed switch Statement

CWE:485 7PK - Encapsulation

Category

also related	Scope Could Be File Static Scope Could Be Local Static
hierarchy ancestor	File System Race Condition Leftover Debug Code Tainted Filename Use After Close

CWE:489 Active Debug Code

Weakness

closely mapped	Leftover Debug Code

CWE:497 Exposure of Sensitive System Information to an Unauthorized Control Sphere

Weakness

also related	File System Race Condition Tainted Filename Use After Close

CWE:506 Embedded Malicious Code

Weakness

closely mapped	Hardcoded DNS Name Untrusted Network Host
also related	Potential Timebomb Untrusted Library Load Untrusted Network Port Untrusted Process Creation Use of system
hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt

CWE:507 Trojan Horse

Weakness

also related	Potential Timebomb

CWE:508 Non-Replicating Malicious Code

Weakness

also related	Potential Timebomb

CWE:510 Trapdoor

Weakness

also related	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt

CWE:511 Logic/Time Bomb

Weakness

closely mapped	Potential Timebomb

CWE:514 Covert Channel

Weakness

also related	File System Race Condition Tainted Filename Tainted Write Untrusted Network Host

CWE:515 Covert Storage Channel

Weakness

also related	File System Race Condition Tainted Filename Tainted Write Untrusted Network Host

CWE:522 Insufficiently Protected Credentials

Weakness

also related	Null Security Descriptor
hierarchy ancestor	Plaintext Storage of Password

CWE:523 Unprotected Transport of Credentials

Weakness

also related	Plaintext Storage of Password

CWE:529 Exposure of Access Control List Files to an Unauthorized Control Sphere

Weakness

also related	Tainted Filename

CWE:530 Exposure of Backup File to an Unauthorized Control Sphere

Weakness

also related	Tainted Filename

CWE:532 Insertion of Sensitive Information into Log File

Weakness

also related	Tainted Write

CWE:538 Insertion of Sensitive Information into Externally-Accessible File or Directory

Weakness

also related	Tainted Write
hierarchy ancestor	Commented-out Code Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Tainted Filename

CWE:540 Inclusion of Sensitive Information in Source Code

Weakness

closely mapped	Hardcoded Authentication Hardcoded Crypto Key
also related	Hardcoded Crypto Salt
hierarchy ancestor	Commented-out Code

CWE:543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context

Weakness

also related	Data Race

CWE:546 Suspicious Comment

Weakness

closely mapped	Comment Suggests Code Unfinished

CWE:547 Use of Hard-coded, Security-relevant Constants

Weakness

closely mapped	Hardcoded Authentication Hardcoded Crypto Key
also related	Hardcoded Crypto Salt

CWE:552 Files or Directories Accessible to External Parties

Weakness

hierarchy ancestor	Tainted Filename

CWE:557 Concurrency Issues

Category

also related	Blocking in Critical Section Deadlock
hierarchy ancestor	Data Race File System Race Condition Multiple Accesses of Atomic Risky Atomic Memory Order Use of getlogin Use of signal

CWE:558 Use of getlogin() in Multithreaded Application

Weakness

closely mapped	Use of getlogin

CWE:561 Dead Code

Weakness

closely mapped	Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Catch Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow Unused Label Unused Macro Unused Parameter Unused Tag Unused Type
also related	Redundant Condition Unused Variable

CWE:562 Return of Stack Variable Address

Weakness

closely mapped	Return Pointer to Local

CWE:563 Assignment to Variable without Use

Weakness

closely mapped	Unused Value
also related	Unused Variable

CWE:567 Unsynchronized Access to Shared Data in a Multithreaded Context

Weakness

closely mapped	Data Race
also related	Multiple Accesses of Atomic Risky Atomic Memory Order

CWE:569 Expression Issues

Category

hierarchy ancestor	Assignment Result in Expression Assignment in Conditional Confusing Operator Overload Null Test After Dereference Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow Unused Value

CWE:570 Expression is Always False

Weakness

closely mapped	Redundant Condition
also related	Null Test After Dereference

CWE:571 Expression is Always True

Weakness

closely mapped	Redundant Condition
also related	Null Test After Dereference

CWE:573 Improper Following of Specification by Caller

Weakness

closely mapped	Division By Zero Null Pointer Dereference Use After Free
also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun
hierarchy ancestor	Arctangent Domain Error Argument Too High Argument Too Low Array Parameter Mismatch Basic Numerical Type Used Copy-Paste Error Dangerous Function Cast Double Close Double Free Double Initialization Double Lock Double Unlock Encryption without Padding Floating Point Domain Error Floating Point Range Error Format String Type Error Free Null Pointer Function Call Has No Effect Gamma on Zero GlobalHandle on GMEM_FIXED Memory GlobalLock on GMEM_FIXED Memory GlobalUnlock on GMEM_FIXED Memory Implicit Function Declaration Inline Assembly Code LocalHandle on LMEM_FIXED Memory LocalLock on LMEM_FIXED Memory LocalUnlock on LMEM_FIXED Memory Lock/Unlock Mismatch Locked Twice Logarithm on Negative Value Logarithm on Zero MAX_PATH Exceeded Negative Character Value Negative file descriptor Null Test After Dereference Overlapping Memory Regions Raises FE_INVALID Redundant Condition Type Mismatch Undefined Power of Zero Uninitialized Variable Unreasonable Size Argument Use of SO_REUSEADDR Use of chroot Use of longjmp Use of setjmp Varargs Function Cast chroot without chdir cosh on High Number cosh on Low Number sqrt on Negative Value

CWE:587 Assignment of a Fixed Address to a Pointer

Weakness

closely mapped	Coercion: Integer Constant to Pointer
also related	Cast: Arithmetic Type/Void Pointer Conversion: Pointer/Integer

CWE:588 Attempt to Access Child of a Non-structure Pointer

Weakness

also related	Cast: Object Pointers

CWE:589 Call to Non-ubiquitous API

Weakness

closely mapped	Use of drem

CWE:590 Free of Memory not on the Heap

Weakness

closely mapped	Free Null Pointer Type Mismatch

CWE:605 Multiple Binds to the Same Port

Weakness

closely mapped	Use of SO_REUSEADDR

CWE:606 Unchecked Input for Loop Condition

Weakness

also related	Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unreasonable Size Argument

CWE:609 Double-Checked Locking

Weakness

also related	Data Race

CWE:610 Externally Controlled Reference to a Resource in Another Sphere

Weakness

closely mapped	Tainted Filename Tainted Network Address Untrusted Network Host Untrusted Network Port
hierarchy ancestor	Command Injection Library Injection Tainted Configuration Setting Untrusted Library Load

CWE:615 Inclusion of Sensitive Information in Source Code Comments

Weakness

closely mapped	Commented-out Code

CWE:626 Null Byte Interaction Error (Poison Null Byte)

Weakness

also related	No Space For Null Terminator Unterminated C String

CWE:628 Function Call with Incorrectly Specified Arguments

Weakness

closely mapped	Arctangent Domain Error Argument Too High Argument Too Low Floating Point Domain Error Floating Point Range Error Format String Type Error Gamma on Zero Logarithm on Negative Value Logarithm on Zero Raises FE_INVALID Undefined Power of Zero cosh on High Number cosh on Low Number sqrt on Negative Value
also related	Dangerous Function Cast Varargs Function Cast
hierarchy ancestor	Array Parameter Mismatch Copy-Paste Error Function Call Has No Effect GlobalHandle on GMEM_FIXED Memory GlobalLock on GMEM_FIXED Memory GlobalUnlock on GMEM_FIXED Memory Implicit Function Declaration LocalHandle on LMEM_FIXED Memory LocalLock on LMEM_FIXED Memory LocalUnlock on LMEM_FIXED Memory Lock/Unlock Mismatch MAX_PATH Exceeded Negative Character Value Negative file descriptor Null Pointer Dereference Null Test After Dereference Tainted Buffer Access Type Mismatch Uninitialized Variable Unreasonable Size Argument

CWE:629 Weaknesses in OWASP Top Ten (2007)

View

hierarchy ancestor

CWE:635 Weaknesses Originally Used by NVD from 2008 to 2016

View

hierarchy ancestor

CWE:641 Improper Restriction of Names for Files and Other Resources

Weakness

closely mapped	Tainted Filename Tainted Network Address

CWE:642 External Control of Critical State Data

Weakness

also related	File System Race Condition Tainted Filename Tainted Write
hierarchy ancestor	Command Injection Library Injection Tainted Configuration Setting Tainted Environment Variable Untrusted Library Load Use of AfxLoadLibrary Use of CoLoadLibrary Use of LoadLibrary Use of SHCreateProcessAsUserW Use of ShellExecute Use of _exec Use of _spawn Use of execlp Use of execvp Use of popen Use of system

CWE:651 Exposure of WSDL File Containing Sensitive Information

Weakness

also related	Tainted Filename

CWE:657 Violation of Secure Design Principles

Weakness

closely mapped	Library Function Override
hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Use of crypt Weak Cryptography

CWE:658 Weaknesses in Software Written in C

View

hierarchy ancestor

CWE:659 Weaknesses in Software Written in C++

View

hierarchy ancestor

CWE:660 Weaknesses in Software Written in Java

View

hierarchy ancestor

CWE:661 Weaknesses in Software Written in PHP

View

hierarchy ancestor	Command Injection Format String Injection Inappropriate C Atomic Initialization LDAP Injection Library Injection Malformed switch Statement Missing break No Space For Null Terminator SQL Injection Uninitialized Variable Unterminated C String Use of drem Use of gamma

CWE:662 Improper Synchronization

Weakness

closely mapped	Blocking in Critical Section Inappropriate Storage Duration Lock/Unlock Mismatch
also related	Deadlock
hierarchy ancestor	Conflicting Lock Order Data Race Double Lock Double Unlock Locked Twice Missing Lock Acquisition Missing Lock Release Multiple Accesses of Atomic Nested Locks Risky Atomic Memory Order Task Delay Function Try-lock that will never succeed Unknown Lock Use of getlogin Use of signal

CWE:663 Use of a Non-reentrant Function in a Concurrent Context

Weakness

also related	Data Race
hierarchy ancestor	Use of getlogin Use of signal

CWE:664 Improper Control of a Resource Through its Lifetime

Weakness

closely mapped

Misaligned Object

hierarchy ancestor

CWE:665 Improper Initialization

Weakness

closely mapped

hierarchy ancestor

CWE:666 Operation on Resource in Wrong Phase of Lifetime

Weakness

closely mapped	Socket In Wrong State Thread is not Joinable Use After Close
hierarchy ancestor	Double Close Double Free Return Pointer to Freed Use After Free Use of SO_REUSEADDR

CWE:667 Improper Locking

Weakness

closely mapped	Missing Lock Release
hierarchy ancestor	Conflicting Lock Order Data Race Deadlock Double Lock Double Unlock Locked Twice Missing Lock Acquisition Multiple Accesses of Atomic Nested Locks Task Delay Function Try-lock that will never succeed Unknown Lock

CWE:668 Exposure of Resource to Wrong Sphere

Weakness

also related

File System Race Condition

hierarchy ancestor

CWE:669 Incorrect Resource Transfer Between Spheres

Weakness

also related	Command Injection Format String Injection SQL Injection
hierarchy ancestor	Function Call Has No Effect Unused Value Use of chroot Use of memset chroot without chdir sizeof Array Parameter

CWE:670 Always-Incorrect Control Flow Implementation

Weakness

hierarchy ancestor

CWE:671 Lack of Administrator Control over Security

Weakness

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Use of crypt Weak Cryptography

CWE:672 Operation on a Resource after Expiration or Release

Weakness

closely mapped	Double Close Use After Close Use After Free
hierarchy ancestor	Double Free Return Pointer to Freed

CWE:673 External Influence of Sphere Definition

Weakness

hierarchy ancestor	Tainted Environment Variable Use of AfxLoadLibrary Use of CoLoadLibrary Use of LoadLibrary Use of SHCreateProcessAsUserW Use of ShellExecute Use of _exec Use of _spawn Use of execlp Use of execvp Use of popen Use of system

CWE:674 Uncontrolled Recursion

Weakness

closely mapped	Recursion

CWE:675 Multiple Operations on Resource in Single-Operation Context

Weakness

closely mapped	Double Initialization
hierarchy ancestor	Double Close Double Free Double Lock Double Unlock Locked Twice Use of SO_REUSEADDR

CWE:676 Use of Potentially Dangerous Function

Weakness

closely mapped	Use of <fenv.h> Exception Handling Function Use of <signal.h> Use of <stdio.h> Input/Output Use of <stdio.h> Input/Output Macro Use of <tgmath.h> Use of <time.h> Time/Date Function Use of <wchar.h> Input/Output Use of <wchar.h> Input/Output Macro Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of AfxLoadLibrary Use of AfxParseURL Use of CoLoadLibrary Use of Condition Variable Signal Use of CreateFile Use of CreateProcess Use of CreateThread Use of FormatMessage Use of GetTempFileName Use of LoadLibrary Use of LoadModule Use of MoveFile Use of OemToAnsi Use of OemToChar Use of SHCreateProcessAsUserW Use of ShellExecute Use of StrCatChainW Use of WinExec Use of _exec Use of _spawn Use of abort Use of atof Use of atoi Use of atol Use of atoll Use of bsearch Use of catopen Use of chroot Use of crypt Use of cuserid Use of execlp Use of execvp Use of exit Use of getenv Use of getlogin Use of getopt Use of getpass Use of longjmp Use of memset Use of mkstemp Use of mktemp Use of popen Use of pthread_kill Use of putenv Use of qsort Use of rand Use of rand48 Function Use of random Use of realloc Use of realpath Use of recvmsg Use of setjmp Use of setuid Use of signal Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog Use of system Use of t_open Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s Use of ttyname Use of vfork Weak Cryptography chroot without chdir
also related	Buffer Overrun Buffer Underrun No Space For Null Terminator Pointer Before Beginning of Object Pointer Past End of Object Type Overrun Type Underrun Unreasonable Size Argument Unterminated C String
hierarchy ancestor	Tainted Buffer Access

CWE:677 Weakness Base Elements

View

hierarchy ancestor

CWE:680 Integer Overflow to Buffer Overflow

Weakness

closely mapped	Addition Overflow of Allocation Size Addition Overflow of Size Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Subtraction Underflow of Allocation Size Subtraction Underflow of Size Truncation of Allocation Size Truncation of Size
also related	Buffer Overrun Cast Alters Value Coercion Alters Value Tainted Buffer Access Unreasonable Size Argument

CWE:681 Incorrect Conversion between Numeric Types

Weakness

closely mapped	Negative Character Value
also related	Inappropriate Assignment Type Inappropriate Cast Type Inappropriate Cast Type: Expression Inappropriate Character Arithmetic Inappropriate Operand Type Mismatched Operand Types
hierarchy ancestor	Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Expression Value Widened by Assignment Expression Value Widened by Other Operand Implicit Function Declaration No Space For Null Terminator Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Risky Integer Promotion Tainted Buffer Access Truncation of Allocation Size Truncation of Size Type Overrun Type Underrun Unreasonable Size Argument Unterminated C String

CWE:682 Incorrect Calculation

Weakness

closely mapped	Float Multiplication Overflow
also related	Arctangent Domain Error Argument Too High Argument Too Low Cast Alters Value Cast: Arithmetic Type/Void Pointer Coercion Alters Value Coercion: Integer Constant to Pointer Floating Point Domain Error Floating Point Range Error Gamma on Zero Logarithm on Negative Value Logarithm on Zero Negative Character Value Raises FE_INVALID Redundant Condition Tainted Allocation Size Undefined Power of Zero Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow cosh on High Number cosh on Low Number sqrt on Negative Value
hierarchy ancestor	Addition Overflow of Allocation Size Addition Overflow of Size Buffer Overrun Buffer Underrun Division By Zero Float Division By Zero Integer Overflow of Allocation Size Multiplication Overflow of Allocation Size Multiplication Overflow of Size Negative Shift Amount No Space For Null Terminator Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Shift Amount Exceeds Bit Width Subtraction Underflow of Allocation Size Subtraction Underflow of Size Subtraction of Unrelated Pointers Tainted Buffer Access Truncation of Allocation Size Truncation of Size Type Overrun Type Underrun Unreasonable Size Argument Unterminated C String Use of OemToAnsi Use of OemToChar Use of StrCatChainW Use of getopt Use of getpass Use of gets Use of getwd Use of recvmsg Use of strcat Use of strchr Use of strcmp Use of strcoll Use of strcpy Use of strcspn Use of strlen Use of strpbrk Use of strrchr Use of strspn Use of strstr Use of strtok Use of strtrns Use of syslog sizeof Array Parameter

CWE:683 Function Call With Incorrect Order of Arguments

Weakness

also related	Copy-Paste Error Floating Point Domain Error Function Call Has No Effect Raises FE_INVALID Undefined Power of Zero

CWE:684 Incorrect Provision of Specified Functionality

Weakness

hierarchy ancestor

CWE:685 Function Call With Incorrect Number of Arguments

Weakness

also related	Copy-Paste Error Format String Type Error

CWE:686 Function Call With Incorrect Argument Type

Weakness

closely mapped	Array Parameter Mismatch GlobalHandle on GMEM_FIXED Memory GlobalLock on GMEM_FIXED Memory GlobalUnlock on GMEM_FIXED Memory Implicit Function Declaration LocalHandle on LMEM_FIXED Memory LocalLock on LMEM_FIXED Memory LocalUnlock on LMEM_FIXED Memory Negative Character Value Type Mismatch

CWE:687 Function Call With Incorrectly Specified Argument Value

Weakness

closely mapped

also related

CWE:688 Function Call With Incorrect Variable or Reference as Argument

Weakness

closely mapped	Arctangent Domain Error Argument Too High Argument Too Low Array Parameter Mismatch Floating Point Domain Error Floating Point Range Error Format String Type Error Function Call Has No Effect Gamma on Zero Logarithm on Negative Value Logarithm on Zero Raises FE_INVALID Undefined Power of Zero Unreasonable Size Argument cosh on High Number cosh on Low Number sqrt on Negative Value
also related	Copy-Paste Error Lock/Unlock Mismatch Null Pointer Dereference Null Test After Dereference Tainted Buffer Access Uninitialized Variable

CWE:690 Unchecked Return Value to NULL Pointer Dereference

Weakness

closely mapped	Null Pointer Dereference Null Test After Dereference

CWE:691 Insufficient Control Flow Management

Weakness

closely mapped

hierarchy ancestor

CWE:693 Protection Mechanism Failure

Weakness

hierarchy ancestor

CWE:695 Use of Low-Level Functionality

Weakness

also related	Basic Numerical Type Used Inline Assembly Code Use of longjmp Use of setjmp

CWE:696 Incorrect Behavior Order

Weakness

closely mapped	Conflicting Lock Order Null Test After Dereference Socket In Wrong State Thread is not Joinable Use After Close Use After Free
also related	chroot without chdir

CWE:697 Incorrect Comparison

Weakness

hierarchy ancestor	Buffer Underrun Cast Alters Value Coercion Alters Value Float-typed Loop Counter Floating Point Equality Mismatched Argument Types Missing default Read Past Null Terminator Type Underrun Unreasonable Size Argument

CWE:699 Software Development

View

hierarchy ancestor

CWE:700 Seven Pernicious Kingdoms

View

hierarchy ancestor

CWE:701 Weaknesses Introduced During Design

View

hierarchy ancestor

CWE:702 Weaknesses Introduced During Implementation

View

hierarchy ancestor

CWE:703 Improper Check or Handling of Exceptional Conditions

Weakness

closely mapped

Unreachable Catch

hierarchy ancestor

CWE:704 Incorrect Type Conversion or Cast

Weakness

closely mapped

hierarchy ancestor

CWE:705 Incorrect Control Flow Scoping

Weakness

hierarchy ancestor	Use of catch Use of throw

CWE:706 Use of Incorrectly-Resolved Name or Reference

Weakness

hierarchy ancestor	File System Race Condition Tainted Filename

CWE:707 Improper Neutralization

Weakness

hierarchy ancestor

CWE:709 Named Chains

View

hierarchy ancestor

CWE:710 Improper Adherence to Coding Standards

Weakness

closely mapped

hierarchy ancestor

CWE:711 Weaknesses in OWASP Top Ten (2004)

View

hierarchy ancestor

CWE:712 OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)

Category

hierarchy ancestor	Tainted Write

CWE:713 OWASP Top Ten 2007 Category A2 - Injection Flaws

Category

hierarchy ancestor	Command Injection LDAP Injection SQL Injection Untrusted Process Creation Use of system

CWE:714 OWASP Top Ten 2007 Category A3 - Malicious File Execution

Category

hierarchy ancestor	Command Injection Untrusted Process Creation Use of system

CWE:715 OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference

Category

hierarchy ancestor	Tainted Filename

CWE:717 OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling

Category

hierarchy ancestor	Commented-out Code File System Race Condition Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Leftover Debug Code Tainted Filename Tainted Write Use After Close

CWE:718 OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:719 OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Redundant Condition Tainted Write Use of crypt Weak Cryptography

CWE:720 OWASP Top Ten 2007 Category A9 - Insecure Communications

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Redundant Condition Tainted Write Use of crypt Weak Cryptography

CWE:721 OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access

Category

hierarchy ancestor	Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of cuserid Use of getlogin

CWE:722 OWASP Top Ten 2004 Category A1 - Unvalidated Input

Category

hierarchy ancestor

CWE:723 OWASP Top Ten 2004 Category A2 - Broken Access Control

Category

hierarchy ancestor

CWE:724 OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:725 OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws

Category

hierarchy ancestor	Tainted Write

CWE:726 OWASP Top Ten 2004 Category A5 - Buffer Overflows

Category

hierarchy ancestor

CWE:727 OWASP Top Ten 2004 Category A6 - Injection Flaws

Category

hierarchy ancestor	Command Injection LDAP Injection SQL Injection Tainted Filename Tainted Network Address Tainted Write Untrusted Network Host Untrusted Network Port Untrusted Process Creation Use of system

CWE:728 OWASP Top Ten 2004 Category A7 - Improper Error Handling

Category

hierarchy ancestor

CWE:729 OWASP Top Ten 2004 Category A8 - Insecure Storage

Category

hierarchy ancestor	Encryption without Padding Function Call Has No Effect Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Tainted Write Unused Value Use of Weak Cryptographic Algorithm Use of crypt Use of memset Use of rand Use of rand48 Function Use of random Weak Cryptography sizeof Array Parameter

CWE:730 OWASP Top Ten 2004 Category A9 - Denial of Service

Category

hierarchy ancestor

CWE:731 OWASP Top Ten 2004 Category A10 - Insecure Configuration Management

Category

hierarchy ancestor	Commented-out Code Function Call Has No Effect Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Ignored Return Value Leak Leftover Debug Code Tainted Filename Tainted Write Unused Value Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of memset Write to Read Only File sizeof Array Parameter

CWE:732 Incorrect Permission Assignment for Critical Resource

Weakness

hierarchy ancestor	Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:733 Compiler Optimization Removal or Modification of Security-critical Code

Weakness

hierarchy ancestor	Unused Value Use of memset

CWE:734 Weaknesses Addressed by the CERT C Secure Coding Standard (2008)

View

hierarchy ancestor

CWE:735 CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE)

Category

hierarchy ancestor

CWE:736 CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL)

Category

hierarchy ancestor

CWE:737 CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)

Category

hierarchy ancestor

CWE:738 CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT)

Category

hierarchy ancestor

CWE:739 CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP)

Category

hierarchy ancestor

CWE:740 CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)

Category

hierarchy ancestor

CWE:741 CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)

Category

hierarchy ancestor

CWE:742 CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)

Category

hierarchy ancestor

CWE:743 CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)

Category

hierarchy ancestor

CWE:744 CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)

Category

hierarchy ancestor

CWE:745 CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)

Category

hierarchy ancestor

CWE:746 CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR)

Category

hierarchy ancestor

CWE:747 CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:748 CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)

Category

hierarchy ancestor

CWE:750 Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors

View

hierarchy ancestor

CWE:751 2009 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor

CWE:752 2009 Top 25 - Risky Resource Management

Category

hierarchy ancestor

CWE:753 2009 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:754 Improper Check for Unusual or Exceptional Conditions

Weakness

hierarchy ancestor

CWE:755 Improper Handling of Exceptional Conditions

Weakness

hierarchy ancestor	Empty if Statement Ignored Return Value Null Pointer Dereference Null Test After Dereference Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow Use of catch Use of throw

CWE:758 Reliance on Undefined, Unspecified, or Implementation-Defined Behavior

Weakness

closely mapped	Inappropriate Comparison of Virtual Member Function Indeterminate Order of Evaluation Missing Return Statement Missing Return Value Negative Shift Amount Shift Amount Exceeds Bit Width Uninitialized Variable Use of <signal.h> Use of <stdio.h> Input/Output Use of <stdio.h> Input/Output Macro Use of <tgmath.h> Use of <time.h> Time/Date Function Use of <wchar.h> Input/Output Use of <wchar.h> Input/Output Macro Use of abort Use of atof Use of atoi Use of atol Use of atoll Use of bsearch Use of exit Use of getenv Use of putenv
also related	Array to Pointer Conversion on Temporary Object Return from Computational Exception Signal Handler
hierarchy ancestor	Buffer Overrun Buffer Underrun Cast: Arithmetic Type/Void Pointer Cast: Object Pointers Coercion: Integer Constant to Pointer Conversion: Pointer/Integer Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Return Pointer to Local Tainted Buffer Access Type Overrun Type Underrun Unused Value Use of drem Use of gamma Use of memset

CWE:760 Use of a One-Way Hash with a Predictable Salt

Weakness

closely mapped	Hardcoded Crypto Salt

CWE:761 Free of Pointer not at Start of Buffer

Weakness

closely mapped	Misaligned Object Type Mismatch

CWE:762 Mismatched Memory Management Routines

Weakness

closely mapped	Pool Mismatch Type Mismatch
hierarchy ancestor	Free Null Pointer

CWE:763 Release of Invalid Pointer or Reference

Weakness

closely mapped	Double Free Misaligned Object
hierarchy ancestor	Free Null Pointer Pool Mismatch Type Mismatch

CWE:764 Multiple Locks of a Critical Resource

Weakness

closely mapped	Double Lock Locked Twice

CWE:765 Multiple Unlocks of a Critical Resource

Weakness

closely mapped	Double Unlock

CWE:770 Allocation of Resources Without Limits or Throttling

Weakness

hierarchy ancestor	Tainted Allocation Size Unreasonable Size Argument

CWE:771 Missing Reference to Active Allocated Resource

Weakness

closely mapped	Leak

CWE:772 Missing Release of Resource after Effective Lifetime

Weakness

closely mapped	Leak

CWE:773 Missing Reference to Active File Descriptor or Handle

Weakness

closely mapped	Leak

CWE:775 Missing Release of File Descriptor or Handle after Effective Lifetime

Weakness

closely mapped	Leak

CWE:780 Use of RSA Algorithm without OAEP

Weakness

closely mapped	Encryption without Padding

CWE:783 Operator Precedence Logic Error

Weakness

closely mapped	Confusing Operator Overload

CWE:785 Use of Path Manipulation Function without Maximum-sized Buffer

Weakness

closely mapped	Use of realpath
also related	Buffer Overrun Tainted Buffer Access Unterminated C String

CWE:786 Access of Memory Location Before Start of Buffer

Weakness

closely mapped	Buffer Underrun
also related	Pointer Before Beginning of Object Tainted Buffer Access Type Underrun
hierarchy ancestor	Addition Overflow of Size Cast Alters Value Coercion Alters Value Multiplication Overflow of Size Negative Character Value Pointer Arithmetic Subtraction Underflow of Size Truncation of Size

CWE:787 Out-of-bounds Write

Weakness

also related

hierarchy ancestor

CWE:788 Access of Memory Location After End of Buffer

Weakness

closely mapped	Buffer Overrun
also related	Array Parameter Mismatch Pointer Past End of Object Tainted Buffer Access Type Overrun

CWE:789 Memory Allocation with Excessive Size Value

Weakness

closely mapped	Tainted Allocation Size
also related	Unreasonable Size Argument

CWE:798 Use of Hard-coded Credentials

Weakness

closely mapped	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt
hierarchy ancestor	Use of crypt Weak Cryptography

CWE:800 Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors

View

hierarchy ancestor

CWE:801 2010 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor	Command Injection Data Race File System Race Condition Multiple Accesses of Atomic Risky Atomic Memory Order SQL Injection Tainted Write Untrusted Process Creation Use of signal Use of system

CWE:802 2010 Top 25 - Risky Resource Management

Category

hierarchy ancestor

CWE:803 2010 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:805 Buffer Access with Incorrect Length Value

Weakness

also related

hierarchy ancestor

Tainted Allocation Size

CWE:806 Buffer Access Using Size of Source Buffer

Weakness

also related

hierarchy descendant

CWE:807 Reliance on Untrusted Inputs in a Security Decision

Weakness

also related	Command Injection Format String Injection Library Injection Tainted Configuration Setting
hierarchy ancestor	Hardcoded DNS Name

CWE:808 2010 Top 25 - Weaknesses On the Cusp

Category

hierarchy ancestor

CWE:809 Weaknesses in OWASP Top Ten (2010)

View

hierarchy ancestor

CWE:810 OWASP Top Ten 2010 Category A1 - Injection

Category

hierarchy ancestor	Command Injection LDAP Injection SQL Injection Untrusted Process Creation Use of system

CWE:811 OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Tainted Write

CWE:812 OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:813 OWASP Top Ten 2010 Category A4 - Insecure Direct Object References

Category

hierarchy ancestor	Tainted Filename Tainted Network Address Untrusted Network Host Untrusted Network Port Use of cuserid Use of getlogin

CWE:815 OWASP Top Ten 2010 Category A6 - Security Misconfiguration

Category

hierarchy ancestor	Commented-out Code Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:816 OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Tainted Write Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:817 OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access

Category

hierarchy ancestor	Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of cuserid Use of getlogin

CWE:818 OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Tainted Write

CWE:820 Missing Synchronization

Weakness

hierarchy ancestor	Data Race Multiple Accesses of Atomic Risky Atomic Memory Order

CWE:821 Incorrect Synchronization

Weakness

closely mapped	Risky Atomic Memory Order
also related	Data Race Multiple Accesses of Atomic

CWE:822 Untrusted Pointer Dereference

Weakness

closely mapped	Unchecked Parameter Dereference
also related	Null Pointer Dereference Tainted Buffer Access

CWE:823 Use of Out-of-range Pointer Offset

Weakness

closely mapped

also related

CWE:824 Access of Uninitialized Pointer

Weakness

also related	Uninitialized Variable

CWE:825 Expired Pointer Dereference

Weakness

hierarchy ancestor	Double Free Return Pointer to Freed Use After Free

CWE:826 Premature Release of Resource During Expected Lifetime

Weakness

also related	Double Close Use After Free

CWE:828 Signal Handler with Functionality that is not Asynchronous-Safe

Weakness

hierarchy ancestor	Use of signal

CWE:832 Unlock of a Resource that is not Locked

Weakness

closely mapped	Double Unlock Missing Lock Acquisition

CWE:833 Deadlock

Weakness

closely mapped	Deadlock
also related	Conflicting Lock Order Double Lock Locked Twice

CWE:834 Excessive Iteration

Weakness

hierarchy ancestor	Float-typed Loop Counter Missing for-loop Termination Potential Unbounded Loop Recursion Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow

CWE:835 Loop with Unreachable Exit Condition ('Infinite Loop')

Weakness

closely mapped	Potential Unbounded Loop
also related	Float-typed Loop Counter Missing for-loop Termination Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow

CWE:839 Numeric Range Comparison Without Minimum Check

Weakness

also related	Buffer Underrun Cast Alters Value Coercion Alters Value Type Underrun Unreasonable Size Argument

CWE:840 Business Logic Errors

Category

hierarchy ancestor	Double Close Tainted Allocation Size Unreasonable Size Argument Use After Free

CWE:843 Access of Resource Using Incompatible Type ('Type Confusion')

Weakness

closely mapped	GlobalHandle on GMEM_FIXED Memory GlobalLock on GMEM_FIXED Memory GlobalUnlock on GMEM_FIXED Memory LocalHandle on LMEM_FIXED Memory LocalLock on LMEM_FIXED Memory LocalUnlock on LMEM_FIXED Memory Type Mismatch
also related	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:844 Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011)

View

hierarchy ancestor

CWE:845 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor	Command Injection Format String Format String Injection Tainted Write Untrusted Process Creation Use of FormatMessage Use of system

CWE:846 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL)

Category

hierarchy ancestor

CWE:847 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP)

Category

hierarchy ancestor	Buffer Overrun Buffer Underrun Division By Zero Free Null Pointer Ignored Return Value Null Pointer Dereference Null Security Descriptor Null Test After Dereference Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Use After Free Use of signal

CWE:848 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM)

Category

hierarchy ancestor

CWE:850 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)

Category

hierarchy ancestor

CWE:851 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)

Category

hierarchy ancestor

CWE:852 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA)

Category

hierarchy ancestor

CWE:853 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK)

Category

hierarchy ancestor	Conflicting Lock Order Data Race Deadlock Double Lock Double Unlock Locked Twice Missing Lock Acquisition Missing Lock Release Multiple Accesses of Atomic Nested Locks Risky Atomic Memory Order Task Delay Function Try-lock that will never succeed Unknown Lock

CWE:854 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI)

Category

hierarchy ancestor	Use of catch Use of throw

CWE:855 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)

Category

hierarchy ancestor	Excessive Stack Depth Ignored Return Value Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow

CWE:857 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO)

Category

hierarchy ancestor

CWE:858 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER)

Category

hierarchy ancestor	Excessive Stack Depth Leak Plaintext Transmission of Password Potential Unbounded Loop Tainted Allocation Size Unreasonable Size Argument Use of drem Use of qsort

CWE:859 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC)

Category

hierarchy ancestor	Command Injection Format String Injection Hardcoded DNS Name Library Injection Null Security Descriptor Plaintext Transmission of Password Tainted Configuration Setting Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:860 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV)

Category

hierarchy ancestor	Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:861 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:863 Incorrect Authorization

Weakness

closely mapped	Use of cuserid Use of getlogin

CWE:864 2011 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor	Command Injection SQL Injection Tainted Write Untrusted Process Creation Use of system

CWE:865 2011 Top 25 - Risky Resource Management

Category

hierarchy ancestor

CWE:866 2011 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:867 2011 Top 25 - Weaknesses On the Cusp

Category

hierarchy ancestor

CWE:868 Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)

View

hierarchy ancestor

CWE:870 CERT C++ Secure Coding Section 02 - Declarations and Initialization (DCL)

Category

hierarchy ancestor

CWE:871 CERT C++ Secure Coding Section 03 - Expressions (EXP)

Category

hierarchy ancestor

CWE:872 CERT C++ Secure Coding Section 04 - Integers (INT)

Category

hierarchy ancestor

CWE:873 CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)

Category

hierarchy ancestor

CWE:874 CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)

Category

hierarchy ancestor

CWE:875 CERT C++ Secure Coding Section 07 - Characters and Strings (STR)

Category

hierarchy ancestor

CWE:876 CERT C++ Secure Coding Section 08 - Memory Management (MEM)

Category

hierarchy ancestor

CWE:877 CERT C++ Secure Coding Section 09 - Input Output (FIO)

Category

hierarchy ancestor

CWE:878 CERT C++ Secure Coding Section 10 - Environment (ENV)

Category

hierarchy ancestor

CWE:879 CERT C++ Secure Coding Section 11 - Signals (SIG)

Category

hierarchy ancestor	Blocking in Critical Section Conflicting Lock Order Data Race Deadlock Double Lock Double Unlock Inappropriate Storage Duration Lock/Unlock Mismatch Locked Twice Missing Lock Acquisition Missing Lock Release Multiple Accesses of Atomic Nested Locks Risky Atomic Memory Order Task Delay Function Try-lock that will never succeed Unknown Lock Use of getlogin Use of signal

CWE:880 CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)

Category

hierarchy ancestor

CWE:881 CERT C++ Secure Coding Section 13 - Object Oriented Programming (OOP)

Category

hierarchy ancestor	Copy Operation Parameter Is Not const Double Close Double Free Leak Null Pointer Dereference Object Slicing Out of Order Member Initializers Redundant Condition Uninitialized Variable Use After Close Use After Free Use of memcmp Use of memset delete with Non-Virtual Destructor

CWE:882 CERT C++ Secure Coding Section 14 - Concurrency (CON)

Category

hierarchy ancestor	Data Race Double Close Double Free File System Race Condition Free Null Pointer Function Call Has No Effect Leak Misaligned Object Multiple Accesses of Atomic Pool Mismatch Risky Atomic Memory Order Type Mismatch Unused Value Use of memset Use of signal sizeof Array Parameter

CWE:883 CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:884 CWE Cross-section

View

hierarchy ancestor

CWE:885 SFP Primary Cluster: Risky Values

Category

hierarchy ancestor

CWE:886 SFP Primary Cluster: Unused entities

Category

hierarchy ancestor	Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Catch Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow Unused Label Unused Macro Unused Parameter Unused Tag Unused Type Unused Value Unused Variable

CWE:887 SFP Primary Cluster: API

Category

hierarchy ancestor

CWE:888 Software Fault Pattern (SFP) Clusters

View

hierarchy ancestor

CWE:889 SFP Primary Cluster: Exception Management

Category

hierarchy ancestor

CWE:890 SFP Primary Cluster: Memory Access

Category

hierarchy ancestor

CWE:891 SFP Primary Cluster: Memory Management

Category

hierarchy ancestor	Double Free Free Null Pointer Misaligned Object Pool Mismatch Type Mismatch

CWE:892 SFP Primary Cluster: Resource Management

Category

hierarchy ancestor

CWE:893 SFP Primary Cluster: Path Resolution

Category

hierarchy ancestor	Command Injection File System Race Condition Library Injection Tainted Configuration Setting Tainted Filename Tainted Network Address Untrusted Library Load Untrusted Network Host Untrusted Network Port Use of chroot chroot without chdir

CWE:894 SFP Primary Cluster: Synchronization

Category

hierarchy ancestor

CWE:895 SFP Primary Cluster: Information Leak

Category

hierarchy ancestor

CWE:896 SFP Primary Cluster: Tainted Input

Category

hierarchy ancestor

CWE:897 SFP Primary Cluster: Entry Points

Category

hierarchy ancestor	Leftover Debug Code

CWE:898 SFP Primary Cluster: Authentication

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of SO_REUSEADDR Use of crypt Weak Cryptography

CWE:899 SFP Primary Cluster: Access Control

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Ignored Return Value Null Security Descriptor Plaintext Storage of Password Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of crypt Use of cuserid Use of getlogin Weak Cryptography

CWE:900 Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors

View

hierarchy ancestor

CWE:901 SFP Primary Cluster: Privilege

Category

hierarchy ancestor	Ignored Return Value Null Security Descriptor Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:902 SFP Primary Cluster: Channel

Category

hierarchy ancestor	Buffer Overrun Buffer Underrun Hardcoded DNS Name No Space For Null Terminator Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unterminated C String Unused Value Use of memset

CWE:903 SFP Primary Cluster: Cryptography

Category

hierarchy ancestor	Encryption without Padding Hardcoded Crypto Key Hardcoded Crypto Salt Redundant Condition Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:904 SFP Primary Cluster: Malware

Category

hierarchy ancestor	File System Race Condition Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Potential Timebomb Tainted Filename Tainted Write Untrusted Library Load Untrusted Network Host Untrusted Network Port Untrusted Process Creation Use of system

CWE:905 SFP Primary Cluster: Predictability

Category

hierarchy ancestor

CWE:906 SFP Primary Cluster: UI

Category

hierarchy ancestor	Typographically Ambiguous Identifiers Use of catch Use of throw

CWE:907 SFP Primary Cluster: Other

Category

hierarchy ancestor

CWE:908 Use of Uninitialized Resource

Weakness

closely mapped	Inappropriate C Atomic Initialization Uninitialized Variable

CWE:909 Missing Initialization of Resource

Weakness

hierarchy ancestor	Inappropriate C Atomic Initialization Partially Uninitialized Aggregate Partially Uninitialized Array Uninitialized Variable

CWE:910 Use of Expired File Descriptor

Weakness

closely mapped	Use After Close

CWE:912 Hidden Functionality

Weakness

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Potential Timebomb Untrusted Library Load Untrusted Network Host Untrusted Network Port Untrusted Process Creation Use of system

CWE:916 Use of Password Hash With Insufficient Computational Effort

Weakness

hierarchy ancestor	Hardcoded Crypto Salt

CWE:919 Weaknesses in Mobile Applications

View

hierarchy ancestor

CWE:922 Insecure Storage of Sensitive Information

Weakness

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password

CWE:928 Weaknesses in OWASP Top Ten (2013)

View

hierarchy ancestor

CWE:929 OWASP Top Ten 2013 Category A1 - Injection

Category

hierarchy ancestor	Command Injection LDAP Injection SQL Injection Tainted Filename Tainted Network Address Tainted Write Untrusted Network Host Untrusted Network Port Untrusted Process Creation Use of system

CWE:930 OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Plaintext Transmission of Password Tainted Write Use of crypt Weak Cryptography

CWE:931 OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Tainted Write

CWE:932 OWASP Top Ten 2013 Category A4 - Insecure Direct Object References

Category

hierarchy ancestor	File System Race Condition Tainted Filename Tainted Network Address Untrusted Network Host Untrusted Network Port

CWE:933 OWASP Top Ten 2013 Category A5 - Security Misconfiguration

Category

hierarchy ancestor	Unused Value Use of memset

CWE:934 OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Redundant Condition Tainted Write Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:935 OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control

Category

hierarchy ancestor	Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of cuserid Use of getlogin

CWE:943 Improper Neutralization of Special Elements in Data Query Logic

Weakness

hierarchy ancestor	LDAP Injection SQL Injection

CWE:944 SFP Secondary Cluster: Access Management

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Ignored Return Value Null Security Descriptor Plaintext Storage of Password Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of crypt Use of cuserid Use of getlogin Weak Cryptography

CWE:945 SFP Secondary Cluster: Insecure Resource Access

Category

hierarchy ancestor	Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of cuserid Use of getlogin

CWE:946 SFP Secondary Cluster: Insecure Resource Permissions

Category

hierarchy ancestor	Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:947 SFP Secondary Cluster: Authentication Bypass

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:949 SFP Secondary Cluster: Faulty Endpoint Authentication

Category

hierarchy ancestor	Hardcoded DNS Name

CWE:950 SFP Secondary Cluster: Hardcoded Sensitive Data

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Use of crypt Weak Cryptography

CWE:954 SFP Secondary Cluster: Multiple Binds to the Same Port

Category

hierarchy ancestor	Use of SO_REUSEADDR

CWE:956 SFP Secondary Cluster: Channel Attack

Category

hierarchy ancestor	Hardcoded DNS Name

CWE:957 SFP Secondary Cluster: Protocol Error

Category

hierarchy ancestor	Buffer Overrun Buffer Underrun No Space For Null Terminator Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unterminated C String Unused Value Use of memset

CWE:958 SFP Secondary Cluster: Broken Cryptography

Category

hierarchy ancestor	Encryption without Padding Hardcoded Crypto Salt Redundant Condition Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:959 SFP Secondary Cluster: Weak Cryptography

Category

hierarchy ancestor	Hardcoded Crypto Key Hardcoded Crypto Salt Use of crypt Weak Cryptography

CWE:960 SFP Secondary Cluster: Ambiguous Exception Type

Category

hierarchy ancestor	Use of catch Use of throw

CWE:961 SFP Secondary Cluster: Incorrect Exception Behavior

Category

hierarchy ancestor

CWE:962 SFP Secondary Cluster: Unchecked Status Condition

Category

hierarchy ancestor

CWE:963 SFP Secondary Cluster: Exposed Data

Category

hierarchy ancestor

CWE:964 SFP Secondary Cluster: Exposure Temporary File

Category

hierarchy ancestor	Use of GetTempFileName Use of mkstemp Use of mktemp Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CWE:966 SFP Secondary Cluster: Other Exposures

Category

hierarchy ancestor	Tainted Filename Uninitialized Variable

CWE:967 SFP Secondary Cluster: State Disclosure

Category

hierarchy ancestor	Tainted Write

CWE:968 SFP Secondary Cluster: Covert Channel

Category

hierarchy ancestor	File System Race Condition Tainted Filename Tainted Write Untrusted Network Host

CWE:969 SFP Secondary Cluster: Faulty Memory Release

Category

hierarchy ancestor	Double Free Free Null Pointer Misaligned Object Pool Mismatch Type Mismatch

CWE:970 SFP Secondary Cluster: Faulty Buffer Access

Category

hierarchy ancestor

CWE:971 SFP Secondary Cluster: Faulty Pointer Use

Category

hierarchy ancestor	Cast: Object Pointers Null Pointer Dereference Null Test After Dereference Subtraction of Unrelated Pointers Unchecked Parameter Dereference

CWE:972 SFP Secondary Cluster: Faulty String Expansion

Category

hierarchy ancestor	Buffer Overrun Tainted Buffer Access Unterminated C String Use of realpath

CWE:973 SFP Secondary Cluster: Improper NULL Termination

Category

hierarchy ancestor	Buffer Overrun No Space For Null Terminator Unterminated C String

CWE:974 SFP Secondary Cluster: Incorrect Buffer Length Computation

Category

hierarchy ancestor

CWE:975 SFP Secondary Cluster: Architecture

Category

hierarchy ancestor

CWE:976 SFP Secondary Cluster: Compiler

Category

hierarchy ancestor	Unused Value Use of memset

CWE:977 SFP Secondary Cluster: Design

Category

hierarchy ancestor

CWE:978 SFP Secondary Cluster: Implementation

Category

hierarchy ancestor

CWE:979 SFP Secondary Cluster: Failed Chroot Jail

Category

hierarchy ancestor	Use of chroot chroot without chdir

CWE:980 SFP Secondary Cluster: Link in Resource Name Resolution

Category

hierarchy ancestor	Command Injection File System Race Condition Library Injection Tainted Configuration Setting Tainted Filename Tainted Network Address Untrusted Library Load Untrusted Network Host Untrusted Network Port

CWE:981 SFP Secondary Cluster: Path Traversal

Category

hierarchy ancestor	Command Injection File System Race Condition Library Injection Tainted Filename Untrusted Library Load

CWE:982 SFP Secondary Cluster: Failure to Release Resource

Category

hierarchy ancestor	Double Close Double Free Free Null Pointer Function Call Has No Effect Leak Misaligned Object Pool Mismatch Type Mismatch Unused Value Use of memset sizeof Array Parameter

CWE:983 SFP Secondary Cluster: Faulty Resource Use

Category

hierarchy ancestor	Double Close Double Free Return Pointer to Freed Use After Close Use After Free

CWE:984 SFP Secondary Cluster: Life Cycle

Category

hierarchy ancestor

CWE:985 SFP Secondary Cluster: Unrestricted Consumption

Category

hierarchy ancestor	Excessive Stack Depth Leak Potential Unbounded Loop Recursion Tainted Allocation Size Unreasonable Size Argument Use of qsort

CWE:986 SFP Secondary Cluster: Missing Lock

Category

hierarchy ancestor	Blocking in Critical Section Conflicting Lock Order Data Race Deadlock Double Lock Double Unlock Inappropriate Storage Duration Lock/Unlock Mismatch Locked Twice Missing Lock Acquisition Missing Lock Release Multiple Accesses of Atomic Nested Locks Risky Atomic Memory Order Task Delay Function Try-lock that will never succeed Unknown Lock Use of getlogin Use of signal

CWE:987 SFP Secondary Cluster: Multiple Locks/Unlocks

Category

hierarchy ancestor	Double Lock Double Unlock Locked Twice

CWE:988 SFP Secondary Cluster: Race Condition Window

Category

hierarchy ancestor	Data Race File System Race Condition Multiple Accesses of Atomic Risky Atomic Memory Order Use of signal

CWE:990 SFP Secondary Cluster: Tainted Input to Command

Category

hierarchy ancestor

CWE:991 SFP Secondary Cluster: Tainted Input to Environment

Category

hierarchy ancestor	Command Injection Copy Operation Parameter Is Not const Library Injection Tainted Environment Variable Untrusted Library Load Use of AfxLoadLibrary Use of CoLoadLibrary Use of LoadLibrary Use of SHCreateProcessAsUserW Use of ShellExecute Use of _exec Use of _spawn Use of execlp Use of execvp Use of popen Use of system

CWE:992 SFP Secondary Cluster: Faulty Input Transformation

Category

hierarchy ancestor	Tainted Write

CWE:993 SFP Secondary Cluster: Incorrect Input Handling

Category

hierarchy ancestor

CWE:994 SFP Secondary Cluster: Tainted Input to Variable

Category

hierarchy ancestor

CWE:995 SFP Secondary Cluster: Feature

Category

hierarchy ancestor	Typographically Ambiguous Identifiers

CWE:997 SFP Secondary Cluster: Information Loss

Category

hierarchy ancestor	Typographically Ambiguous Identifiers Use of catch Use of throw

CWE:998 SFP Secondary Cluster: Glitch in Computation

Category

hierarchy ancestor

CWE:1000 Research Concepts

View

hierarchy ancestor

CWE:1001 SFP Secondary Cluster: Use of an Improper API

Category

hierarchy ancestor

CWE:1002 SFP Secondary Cluster: Unexpected Entry Points

Category

hierarchy ancestor	Leftover Debug Code

CWE:1003 Weaknesses for Simplified Mapping of Published Vulnerabilities

View

hierarchy ancestor

CWE:1005 7PK - Input Validation and Representation

Category

hierarchy ancestor

CWE:1006 Bad Coding Practices

Category

hierarchy ancestor

CWE:1007 Insufficient Visual Distinction of Homoglyphs Presented to User

Weakness

closely mapped	Typographically Ambiguous Identifiers

CWE:1008 Architectural Concepts

View

hierarchy ancestor

CWE:1009 Audit

Category

hierarchy ancestor	Tainted Write

CWE:1010 Authenticate Actors

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:1011 Authorize Actors

Category

hierarchy ancestor

CWE:1012 Cross Cutting

Category

hierarchy ancestor

CWE:1013 Encrypt Data

Category

hierarchy ancestor

CWE:1015 Limit Access

Category

hierarchy ancestor	Command Injection Function Call Has No Effect Library Injection Tainted Configuration Setting Tainted Filename Tainted Network Address Tainted Write Untrusted Library Load Untrusted Network Host Untrusted Network Port Unused Value Use of chroot Use of memset chroot without chdir sizeof Array Parameter

CWE:1019 Validate Inputs

Category

hierarchy ancestor

CWE:1020 Verify Message Integrity

Category

hierarchy ancestor

CWE:1023 Incomplete Comparison with Missing Factors

Weakness

hierarchy ancestor	Buffer Underrun Cast Alters Value Coercion Alters Value Missing default Type Underrun Unreasonable Size Argument

CWE:1025 Comparison Using Wrong Factors

Weakness

closely mapped	Read Past Null Terminator
also related	Mismatched Argument Types

CWE:1026 Weaknesses in OWASP Top Ten (2017)

View

hierarchy ancestor

CWE:1027 OWASP Top Ten 2017 Category A1 - Injection

Category

hierarchy ancestor	Command Injection LDAP Injection SQL Injection Untrusted Process Creation Use of system

CWE:1028 OWASP Top Ten 2017 Category A2 - Broken Authentication

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:1029 OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded Seed in PRNG Plaintext Storage of Password Plaintext Transmission of Password Predictable Seed in PRNG Redundant Condition Tainted Write Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:1030 OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)

Category

hierarchy ancestor	Use of XML_ExternalEntityParserCreate

CWE:1031 OWASP Top Ten 2017 Category A5 - Broken Access Control

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Ignored Return Value Null Security Descriptor Plaintext Storage of Password Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of crypt Use of cuserid Use of getlogin Weak Cryptography

CWE:1032 OWASP Top Ten 2017 Category A6 - Security Misconfiguration

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Hardcoded Seed in PRNG Ignored Return Value Memory Protection Removal Unused Value Use of catch Use of memset Use of throw

CWE:1033 OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Tainted Write

CWE:1034 OWASP Top Ten 2017 Category A8 - Insecure Deserialization

Category

hierarchy ancestor

CWE:1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Category

hierarchy ancestor

CWE:1036 OWASP Top Ten 2017 Category A10 - Insufficient Logging & Monitoring

Category

hierarchy ancestor	Not Enough Assertions

CWE:1037 Processor Optimization Removal or Modification of Security-critical Code

Weakness

closely mapped	Use of memset

CWE:1038 Insecure Automated Optimizations

Weakness

hierarchy ancestor	Unused Value Use of memset

CWE:1040 Quality Weaknesses with Indirect Security Impacts

View

hierarchy ancestor

CWE:1041 Use of Redundant Code

Weakness

closely mapped	Copy-Paste Error

CWE:1055 Multiple Inheritance from Concrete Classes

Weakness

closely mapped	Multiple Inheritance with Public Base Class Multiple Inheritance with Too Many Protected Base Classes

CWE:1056 Invokable Control Element with Variadic Parameters

Weakness

closely mapped	Ellipsis

CWE:1061 Insufficient Encapsulation

Weakness

hierarchy ancestor	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:1064 Invokable Control Element with Signature Containing an Excessive Number of Parameters

Weakness

closely mapped	Too Many Parameters

CWE:1071 Empty Code Block

Weakness

also related	Empty Branch Statement Empty for Statement Empty if Statement Empty switch Statement Empty while Statement

CWE:1075 Unconditional Control Flow Transfer outside of Switch Block

Weakness

also related	Backwards goto Goto Statement Use of longjmp

CWE:1076 Insufficient Adherence to Expected Conventions

Weakness

closely mapped

hierarchy ancestor

CWE:1077 Floating Point Comparison with Incorrect Operator

Weakness

closely mapped	Floating Point Equality
also related	Float-typed Loop Counter

CWE:1078 Inappropriate Source Code Style or Formatting

Weakness

closely mapped	Multiple Declarations On Line Multiple Statements On Line Octal Constant
hierarchy ancestor	Comment Suggests Code Unfinished Commented-out Code Declaration of Reserved Name Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Library Function Override switch With Non-enum Expression

CWE:1079 Parent Class without Virtual Destructor Method

Weakness

closely mapped	delete with Non-Virtual Destructor

CWE:1080 Source Code File with Excessive Number of Lines of Code

Weakness

closely mapped	Function Too Long

CWE:1081 Entries with Maintenance Notes

View

hierarchy ancestor

CWE:1085 Invokable Control Element with Excessive Volume of Commented-out Code

Weakness

closely mapped	Commented-out Code

CWE:1087 Class with Virtual Method without a Virtual Destructor

Weakness

closely mapped	delete with Non-Virtual Destructor

CWE:1091 Use of Object without Invoking Destructor Method

Weakness

closely mapped	Leak

CWE:1093 Excessively Complex Data Representation

Weakness

hierarchy ancestor	Multiple Inheritance with Public Base Class Multiple Inheritance with Too Many Protected Base Classes

CWE:1099 Inconsistent Naming Conventions for Identifiers

Weakness

also related	Declaration of Reserved Name Library Function Override

CWE:1105 Insufficient Encapsulation of Machine-Dependent Functionality

Weakness

hierarchy ancestor	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:1106 Insufficient Use of Symbolic Constants

Weakness

closely mapped	switch With Non-enum Expression

CWE:1120 Excessive Code Complexity

Weakness

closely mapped	Missing Return Statement Multiple Abnormal Loop Exits
hierarchy ancestor	Backwards goto Ellipsis Function Too Long Goto Statement High Cyclomatic Complexity (Procedure) Too Many Parameters Use of longjmp

CWE:1121 Excessive McCabe Cyclomatic Complexity

Weakness

closely mapped	High Cyclomatic Complexity (Procedure)

CWE:1126 Declaration of Variable with Unnecessarily Wide Scope

Weakness

closely mapped	Scope Could Be File Static Scope Could Be Local Static

CWE:1127 Compilation with Insufficient Warnings or Errors

Weakness

closely mapped	Not All Warnings Are Enabled Warnings Not Treated As Errors

CWE:1128 CISQ Quality Measures (2016)

View

hierarchy ancestor

CWE:1129 CISQ Quality Measures (2016) - Reliability

Category

hierarchy ancestor

CWE:1130 CISQ Quality Measures (2016) - Maintainability

Category

hierarchy ancestor

CWE:1131 CISQ Quality Measures (2016) - Security

Category

hierarchy ancestor

CWE:1132 CISQ Quality Measures (2016) - Performance Efficiency

Category

hierarchy ancestor	Leak

CWE:1133 Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java

View

hierarchy ancestor

CWE:1134 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor	Command Injection Format String Format String Injection Tainted Write Untrusted Process Creation Use of FormatMessage Use of system

CWE:1135 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL)

Category

hierarchy ancestor

CWE:1136 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)

Category

hierarchy ancestor	Buffer Overrun Buffer Underrun Division By Zero Free Null Pointer Ignored Return Value Null Pointer Dereference Null Security Descriptor Null Test After Dereference Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unchecked Parameter Dereference Use After Free

CWE:1137 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM)

Category

hierarchy ancestor

CWE:1140 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)

Category

hierarchy ancestor

CWE:1141 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR)

Category

hierarchy ancestor

CWE:1142 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA)

Category

hierarchy ancestor

CWE:1143 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK)

Category

hierarchy ancestor	Conflicting Lock Order Data Race Deadlock Double Lock Double Unlock Locked Twice Missing Lock Acquisition Missing Lock Release Multiple Accesses of Atomic Nested Locks Risky Atomic Memory Order Task Delay Function Try-lock that will never succeed Unknown Lock

CWE:1145 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)

Category

hierarchy ancestor	Excessive Stack Depth Ignored Return Value Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow

CWE:1147 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO)

Category

hierarchy ancestor

CWE:1148 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER)

Category

hierarchy ancestor	Excessive Stack Depth Leak Plaintext Transmission of Password Potential Unbounded Loop Tainted Allocation Size Unreasonable Size Argument Use of qsort

CWE:1149 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC)

Category

hierarchy ancestor	Null Security Descriptor Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:1150 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV)

Category

hierarchy ancestor	Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:1152 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:1154 Weaknesses Addressed by the SEI CERT C Coding Standard

View

hierarchy ancestor

CWE:1155 SEI CERT C Coding Standard - Guidelines 01. Preprocessor (PRE)

Category

hierarchy ancestor

CWE:1156 SEI CERT C Coding Standard - Guidelines 02. Declarations and Initialization (DCL)

Category

hierarchy ancestor

CWE:1157 SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)

Category

hierarchy ancestor

CWE:1158 SEI CERT C Coding Standard - Guidelines 04. Integers (INT)

Category

hierarchy ancestor

CWE:1159 SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)

Category

hierarchy ancestor

CWE:1160 SEI CERT C Coding Standard - Guidelines 06. Arrays (ARR)

Category

hierarchy ancestor

CWE:1161 SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR)

Category

hierarchy ancestor

CWE:1162 SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)

Category

hierarchy ancestor

CWE:1163 SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)

Category

hierarchy ancestor

CWE:1164 Irrelevant Code

Weakness

closely mapped

hierarchy ancestor

CWE:1165 SEI CERT C Coding Standard - Guidelines 10. Environment (ENV)

Category

hierarchy ancestor

CWE:1166 SEI CERT C Coding Standard - Guidelines 11. Signals (SIG)

Category

hierarchy ancestor

CWE:1167 SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)

Category

hierarchy ancestor

CWE:1168 SEI CERT C Coding Standard - Guidelines 13. Application Programming Interfaces (API)

Category

hierarchy ancestor

CWE:1169 SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON)

Category

hierarchy ancestor

CWE:1170 SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:1171 SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)

Category

hierarchy ancestor

CWE:1172 SEI CERT C Coding Standard - Guidelines 51. Microsoft Windows (WIN)

Category

hierarchy ancestor	Free Null Pointer Pool Mismatch Type Mismatch Use of AfxLoadLibrary Use of CoLoadLibrary Use of CreateProcess Use of LoadLibrary

CWE:1177 Use of Prohibited Code

Weakness

hierarchy ancestor

CWE:1178 Weaknesses Addressed by the SEI CERT Perl Coding Standard

View

hierarchy ancestor

CWE:1179 SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor

CWE:1180 SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL)

Category

hierarchy ancestor

CWE:1181 SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP)

Category

hierarchy ancestor

CWE:1182 SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT)

Category

hierarchy ancestor

CWE:1186 SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)

Category

hierarchy ancestor	Redundant Condition Unexercised Call Unexercised Computation Unexercised Conditional Unexercised Control Flow Unexercised Data Flow Unreachable Call Unreachable Catch Unreachable Computation Unreachable Conditional Unreachable Control Flow Unreachable Data Flow Unused Label Unused Macro Unused Parameter Unused Tag Unused Type Unused Value Unused Variable

CWE:1188 Initialization of a Resource with an Insecure Default

Weakness

also related	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Hardcoded Seed in PRNG
hierarchy ancestor	Uninitialized Variable

CWE:1194 Hardware Design

View

hierarchy ancestor	Encryption without Padding Function Call Has No Effect Leftover Debug Code Plaintext Transmission of Password Redundant Condition Tainted Write Unused Value Use of memset sizeof Array Parameter

CWE:1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors

View

hierarchy ancestor

CWE:1202 Memory and Storage Issues

Category

hierarchy ancestor	Function Call Has No Effect Unused Value Use of memset sizeof Array Parameter

CWE:1204 Generation of Weak Initialization Vector (IV)

Weakness

also related	Use of rand Use of rand48 Function Use of random

CWE:1205 Security Primitives and Cryptography Issues

Category

hierarchy ancestor	Encryption without Padding Redundant Condition Tainted Write

CWE:1207 Debug and Test Problems

Category

hierarchy ancestor	Leftover Debug Code Plaintext Transmission of Password

CWE:1210 Audit / Logging Errors

Category

hierarchy ancestor	Tainted Write

CWE:1211 Authentication Errors

Category

also related	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt
hierarchy ancestor	Hardcoded DNS Name

CWE:1212 Authorization Errors

Category

hierarchy ancestor	Tainted Filename Tainted Write

CWE:1213 Random Number Issues

Category

hierarchy ancestor

CWE:1215 Data Validation Issues

Category

also related

hierarchy ancestor

CWE:1218 Memory Buffer Errors

Category

hierarchy ancestor

CWE:1219 File Handling Issues

Category

also related	File System Race Condition Tainted Filename
hierarchy ancestor	Tainted Environment Variable Use of AfxLoadLibrary Use of CoLoadLibrary Use of GetTempFileName Use of LoadLibrary Use of SHCreateProcessAsUserW Use of ShellExecute Use of _exec Use of _spawn Use of execlp Use of execvp Use of mkstemp Use of mktemp Use of popen Use of system Use of tmpfile Use of tmpfile_s Use of tmpnam Use of tmpnam_s

CWE:1226 Complexity Issues

Category

also related	Too Many Dereferences Too Many Parameters Too Much Indirection in Declaration
hierarchy ancestor	Backwards goto Ellipsis Function Too Long Goto Statement High Cyclomatic Complexity (Procedure) Multiple Inheritance with Public Base Class Multiple Inheritance with Too Many Protected Base Classes Use of longjmp

CWE:1227 Encapsulation Issues

Category

hierarchy ancestor	Buffer Overrun Buffer Underrun Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:1228 API / Function Errors

Category

hierarchy ancestor

CWE:1229 Creation of Emergent Resource

Weakness

hierarchy ancestor	File System Race Condition Tainted Filename Tainted Write Untrusted Network Host

CWE:1230 Exposure of Sensitive Information Through Metadata

Weakness

also related	Tainted Write

CWE:1237 SFP Primary Cluster: Faulty Resource Release

Category

hierarchy ancestor	Double Free Free Null Pointer Misaligned Object Pool Mismatch Type Mismatch

CWE:1238 SFP Primary Cluster: Failure to Release Memory

Category

hierarchy ancestor	Leak

CWE:1284 Improper Validation of Specified Quantity in Input

Weakness

hierarchy ancestor	Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unreasonable Size Argument

CWE:1285 Improper Validation of Specified Index, Position, or Offset in Input

Weakness

hierarchy ancestor	Array Parameter Mismatch Buffer Overrun Buffer Underrun Cast Alters Value Coercion Alters Value Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun

CWE:1295 Debug Messages Revealing Unnecessary Information

Weakness

closely mapped	Leftover Debug Code

CWE:1305 CISQ Quality Measures (2020)

View

hierarchy ancestor

CWE:1306 CISQ Quality Measures - Reliability

Category

hierarchy ancestor

CWE:1307 CISQ Quality Measures - Maintainability

Category

hierarchy ancestor

CWE:1308 CISQ Quality Measures - Security

Category

hierarchy ancestor

CWE:1309 CISQ Quality Measures - Efficiency

Category

hierarchy ancestor	Double Close Double Free Free Null Pointer Function Call Has No Effect Leak Misaligned Object Pool Mismatch Type Mismatch Unused Value Use of memset sizeof Array Parameter

CWE:1335 Incorrect Bitwise Shift of Integer

Weakness

closely mapped	Negative Shift Amount Shift Amount Exceeds Bit Width

CWE:1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1340 CISQ Data Protection Measures

View

hierarchy ancestor

CWE:1341 Multiple Releases of Same Resource or Handle

Weakness

closely mapped	Double Close
hierarchy ancestor	Double Free

CWE:1344 Weaknesses in OWASP Top Ten (2021)

View

hierarchy ancestor

CWE:1345 OWASP Top Ten 2021 Category A01:2021 - Broken Access Control

Category

hierarchy ancestor

CWE:1346 OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures

Category

hierarchy ancestor

CWE:1347 OWASP Top Ten 2021 Category A03:2021 - Injection

Category

hierarchy ancestor

CWE:1348 OWASP Top Ten 2021 Category A04:2021 - Insecure Design

Category

hierarchy ancestor

CWE:1349 OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Hardcoded Seed in PRNG Ignored Return Value Memory Protection Removal Tainted Configuration Setting Unused Value Use of XML_ExternalEntityParserCreate Use of catch Use of memset Use of throw

CWE:1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1352 OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components

Category

hierarchy ancestor

CWE:1353 OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:1354 OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures

Category

hierarchy ancestor

CWE:1355 OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures

Category

hierarchy ancestor	Not Enough Assertions Tainted Write

CWE:1358 Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS

View

hierarchy ancestor

CWE:1359 ICS Communications

Category

hierarchy ancestor

CWE:1360 ICS Dependencies (& Architecture)

Category

hierarchy ancestor	Command Injection Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Library Injection Null Security Descriptor Plaintext Storage of Password Tainted Configuration Setting Tainted Filename Tainted Network Address Untrusted Library Load Untrusted Network Host Untrusted Network Port Use of crypt Weak Cryptography

CWE:1361 ICS Supply Chain

Category

hierarchy ancestor

CWE:1362 ICS Engineering (Constructions/Deployment)

Category

hierarchy ancestor

CWE:1363 ICS Operations (& Maintenance)

Category

hierarchy ancestor

CWE:1364 ICS Communications: Zone Boundary Failures

Category

hierarchy ancestor

CWE:1365 ICS Communications: Unreliability

Category

hierarchy ancestor	Command Injection Data Race File System Race Condition Format String Injection Hardcoded DNS Name Ignored Return Value Library Injection Multiple Accesses of Atomic Null Security Descriptor Risky Atomic Memory Order Tainted Configuration Setting Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of signal

CWE:1366 ICS Communications: Frail Security in Protocols

Category

hierarchy ancestor

CWE:1368 ICS Dependencies (& Architecture): External Digital Systems

Category

hierarchy ancestor	Command Injection Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Library Injection Null Security Descriptor Plaintext Storage of Password Tainted Configuration Setting Tainted Filename Tainted Network Address Untrusted Library Load Untrusted Network Host Untrusted Network Port Use of crypt Weak Cryptography

CWE:1369 ICS Supply Chain: IT/OT Convergence/Expansion

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Ignored Return Value Null Security Descriptor Plaintext Storage of Password Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of crypt Use of cuserid Use of getlogin Weak Cryptography

CWE:1370 ICS Supply Chain: Common Mode Frailties

Category

hierarchy ancestor

CWE:1371 ICS Supply Chain: Poorly Documented or Undocumented Features

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Leftover Debug Code Potential Timebomb Untrusted Library Load Untrusted Network Host Untrusted Network Port Untrusted Process Creation Use of system

CWE:1372 ICS Supply Chain: OT Counterfeit and Malicious Corruption

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Ignored Return Value Null Security Descriptor Plaintext Storage of Password Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of crypt Use of cuserid Use of getlogin Weak Cryptography

CWE:1373 ICS Engineering (Construction/Deployment): Trust Model Problems

Category

hierarchy ancestor	Command Injection Format String Injection Hardcoded DNS Name Ignored Return Value Library Injection Null Security Descriptor Tainted Configuration Setting Use of AddAccessAllowedAce Use of AddAccessDeniedAce

CWE:1375 ICS Engineering (Construction/Deployment): Gaps in Details/Data

Category

hierarchy ancestor

CWE:1376 ICS Engineering (Construction/Deployment): Security Gaps in Commissioning

Category

hierarchy ancestor	Data Race File System Race Condition Multiple Accesses of Atomic Risky Atomic Memory Order Use of signal

CWE:1379 ICS Operations (& Maintenance): Human factors in ICS environments

Category

hierarchy ancestor	Typographically Ambiguous Identifiers

CWE:1382 ICS Operations (& Maintenance): Emerging Energy Technologies

Category

hierarchy ancestor

CWE:1383 ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements

Category

hierarchy ancestor

CWE:1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1389 Incorrect Parsing of Numbers with Different Radices

Weakness

closely mapped	Octal Constant

CWE:1390 Weak Authentication

Weakness

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Null Security Descriptor Plaintext Storage of Password Use of crypt Weak Cryptography

CWE:1391 Use of Weak Credentials

Weakness

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Use of crypt Weak Cryptography

CWE:1396 Comprehensive Categorization: Access Control

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Ignored Return Value Null Security Descriptor Plaintext Storage of Password Tainted Filename Tainted Write Use of AddAccessAllowedAce Use of AddAccessDeniedAce Use of crypt Use of cuserid Use of getlogin Weak Cryptography

CWE:1397 Comprehensive Categorization: Comparison

Category

hierarchy ancestor	Buffer Underrun Cast Alters Value Coercion Alters Value Float-typed Loop Counter Floating Point Equality Mismatched Argument Types Missing default Read Past Null Terminator Type Underrun Unreasonable Size Argument

CWE:1398 Comprehensive Categorization: Component Interaction

Category

hierarchy ancestor	Buffer Overrun Buffer Underrun No Space For Null Terminator Pointer Arithmetic Pointer Before Beginning of Object Pointer Past End of Object Tainted Buffer Access Type Overrun Type Underrun Unterminated C String Unused Value Use of memset

CWE:1399 Comprehensive Categorization: Memory Safety

Category

hierarchy ancestor

CWE:1400 Comprehensive Categorization for Software Assurance Trends

View

hierarchy ancestor

CWE:1401 Comprehensive Categorization: Concurrency

Category

hierarchy ancestor	Conflicting Lock Order Data Race Deadlock Double Lock Double Unlock File System Race Condition Locked Twice Missing Lock Acquisition Missing Lock Release Multiple Accesses of Atomic Nested Locks Risky Atomic Memory Order Task Delay Function Try-lock that will never succeed Unknown Lock Use of getlogin Use of signal

CWE:1402 Comprehensive Categorization: Encryption

Category

hierarchy ancestor	Encryption without Padding Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Plaintext Storage of Password Plaintext Transmission of Password Redundant Condition Tainted Write Use of Weak Cryptographic Algorithm Use of crypt Use of rand Use of rand48 Function Use of random Weak Cryptography

CWE:1403 Comprehensive Categorization: Exposed Resource

Category

hierarchy ancestor

CWE:1404 Comprehensive Categorization: File Handling

Category

hierarchy ancestor	Tainted Filename

CWE:1405 Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions

Category

hierarchy ancestor

CWE:1406 Comprehensive Categorization: Improper Input Validation

Category

hierarchy ancestor

CWE:1407 Comprehensive Categorization: Improper Neutralization

Category

hierarchy ancestor

CWE:1408 Comprehensive Categorization: Incorrect Calculation

Category

hierarchy ancestor

CWE:1409 Comprehensive Categorization: Injection

Category

hierarchy ancestor	Command Injection LDAP Injection SQL Injection Tainted Filename Tainted Network Address Tainted Write Untrusted Network Host Untrusted Network Port Untrusted Process Creation Use of system

CWE:1410 Comprehensive Categorization: Insufficient Control Flow Management

Category

hierarchy ancestor

CWE:1412 Comprehensive Categorization: Poor Coding Practices

Category

hierarchy ancestor

CWE:1413 Comprehensive Categorization: Protection Mechanism Failure

Category

hierarchy ancestor

CWE:1414 Comprehensive Categorization: Randomness

Category

hierarchy ancestor

CWE:1415 Comprehensive Categorization: Resource Control

Category

hierarchy ancestor	Double Close Double Free File System Race Condition Return Pointer to Freed Tainted Filename Tainted Write Untrusted Network Host Use After Close Use After Free

CWE:1416 Comprehensive Categorization: Resource Lifecycle Management

Category

hierarchy ancestor

CWE:1417 Comprehensive Categorization: Sensitive Information Exposure

Category

hierarchy ancestor	Commented-out Code File System Race Condition Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Leftover Debug Code Tainted Filename Tainted Write Use After Close

CWE:1418 Comprehensive Categorization: Violation of Secure Design Principles

Category

hierarchy ancestor	Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Library Function Override Use of crypt Weak Cryptography

CWE:1419 Incorrect Initialization of Resource

Weakness

closely mapped	Initialization Cycle Partially Uninitialized Aggregate Partially Uninitialized Array Uninitialized Variable Unordered Initialization Unspecified Array Size with Designator Initialization Virtual Call in Constructor
also related	sizeof Array Parameter
hierarchy ancestor	Command Injection Format String Injection Hardcoded Authentication Hardcoded Crypto Key Hardcoded Crypto Salt Hardcoded DNS Name Hardcoded Seed in PRNG LDAP Injection Library Injection SQL Injection

CWE:1424 Weaknesses Addressed by ISA/IEC 62443 Requirements

View

hierarchy ancestor

CWE:1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1430 Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:2000 Comprehensive CWE Dictionary

View

hierarchy ancestor