Broad CWE Mapping: CWE IDs Detected by CodeSonar in C#

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.0p0 Hot Tips

CONFIDENTIAL

CodeSecure Inc

CWE IDs Detected by CodeSonar in C# Code

This table contains close and broad CWE mappings for CodeSonar C# warning classes, organized by CWE ID.

CWE mappings organized by CodeSonar C# warning class: close mapping, broad mapping.
CWE mappings for CodeSonar warning classes, all languages: close mapping, broad mapping.
CWE mapping information for CodeSonar in CSV format: CWE-mapping-broad.csv (broad mapping); CWE-mapping.csv (close mapping).

This version of CodeSonar (9.0p0) uses CWE 4.16, published November 19, 2024.

Close Mapping
Broad Mapping

Close Mapping

CWE	Entity Type	C# Warning Classes
CWE:20 Improper Input Validation	Weakness	Disabled Input Validation (C#)
CWE:22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	Weakness	Tainted Path (C#)
CWE:74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	Weakness	DLL Injection (C#) DOS Injection (C#) Tainted @Trusted Value (C#) Tainted Control (C#) Tainted Hardware Device Property (C#) Tainted Network Address (C#) Tainted Resource (C#) Tainted URL (C#) Tainted XAML (C#) Tainted XML (C#)
CWE:78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	Weakness	Command Injection (C#)
CWE:79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Weakness	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)
CWE:81 Improper Neutralization of Script in an Error Message Web Page	Weakness	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)
CWE:89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Weakness	SQL Injection (C#)
CWE:90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')	Weakness	Tainted LDAP Attribute (C#) Tainted LDAP Filter (C#)
CWE:94 Improper Control of Generation of Code ('Code Injection')	Weakness	Code Injection (C#)
CWE:95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')	Weakness	Tainted Expression Evaluation (C#)
CWE:113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')	Weakness	Tainted HTTP Response (C#)
CWE:114 Process Control	Weakness	DLL Injection (C#)
CWE:117 Improper Output Neutralization for Logs	Weakness	Tainted Log (C#)
CWE:134 Use of Externally-Controlled Format String	Weakness	Format String Injection (C#)
CWE:190 Integer Overflow or Wraparound	Weakness	Cast: int Computation to long (C#)
CWE:192 Integer Coercion Error	Weakness	Cast: Integer to Floating Point (C#)
CWE:197 Numeric Truncation Error	Weakness	Approximate e Constant (C#) Approximate pi Constant (C#)
CWE:252 Unchecked Return Value	Weakness	Call Might Return Null (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#)
CWE:253 Incorrect Check of Function Return Value	Weakness	Useless null Test of Return Value (C#)
CWE:259 Use of Hard-coded Password	Weakness	Hardcoded Password (C#)
CWE:287 Improper Authentication	Weakness	Hostname in Condition (C#) Missing Authentication Annotation (C#)
CWE:319 Cleartext Transmission of Sensitive Information	Weakness	Tainted Message (C#)
CWE:321 Use of Hard-coded Cryptographic Key	Weakness	Hardcoded Cryptographic Key (C#)
CWE:325 Missing Cryptographic Step	Weakness	Missing Required Cryptographic Step (C#)
CWE:326 Inadequate Encryption Strength	Weakness	Insecure Key Derivation (C#)
CWE:327 Use of a Broken or Risky Cryptographic Algorithm	Weakness	Cryptographic Algorithm with Risky Default Cipher (C#) Cryptographic Algorithm with Weak Cipher (C#) Deprecated Cryptography Provider (C#) Risky Cipher Algorithm (C#) Risky Cipher Field (C#) Risky Cryptographic Algorithm (C#) Risky Cryptographic Field (C#) Unsafe Base64 Encoding (C#)
CWE:328 Use of Weak Hash	Weakness	Cryptographic Algorithm with Weak Hash (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#)
CWE:330 Use of Insufficiently Random Values	Weakness	Hardcoded Random Seed (C#) Insecure Random Number Generator (C#) Legacy Random Generator (C#)
CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)	Weakness	Use of Same Seed (C#)
CWE:338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	Weakness	Weak Cryptographic Value (C#)
CWE:390 Detection of Error Condition Without Action	Weakness	Empty Exception Handler (C#)
CWE:395 Use of NullPointerException Catch to Detect NULL Pointer Dereference	Weakness	Inappropriate Exception Handler (C#)
CWE:396 Declaration of Catch for Generic Exception	Weakness	Generic Exception Handler (C#)
CWE:400 Uncontrolled Resource Consumption	Weakness	Closeable Not Stored (C#)
CWE:412 Unrestricted Externally Accessible Lock	Weakness	Synchronization on Interned String (C#)
CWE:413 Improper Resource Locking	Weakness	Impossible Client Side Locking (C#) Synchronization on static (C#)
CWE:440 Expected Behavior Violation	Weakness	toString on Array (C#)
CWE:456 Missing Initialization of a Variable	Weakness	Field Never Written (C#) Null Pointer Dereference (C#)
CWE:470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')	Weakness	Reflection Injection (C#)
CWE:476 NULL Pointer Dereference	Weakness	Actual Parameter Element may be null (C#) Field Element may be null (deep) (C#) Field may be null (deep) (C#) Method Should Not Return null (C#) Null Parameter Dereference (C#) Null Pointer Dereference (C#) Null Pointer Dereference (deep) (C#) Return Value may Contain null Element (C#) Return Value may be null (C#) Return null Array (C#) Unchecked Parameter Dereference (C#) Unchecked Parameter Dereference (deep) (C#) Unchecked Parameter Element Dereference (deep) (C#) null Passed to Method (deep) (C#)
CWE:477 Use of Obsolete Function	Weakness	Debug Warning (C#)
CWE:480 Use of Incorrect Operator	Weakness	Bitwise AND on Boolean Constant (C#) Bitwise OR on Boolean Constant (C#) Inefficient Bitwise AND (C#) Inefficient Bitwise OR (C#) Should Use == Instead of equals() (C#)
CWE:481 Assigning instead of Comparing	Weakness	Assignment in Conditional (C#)
CWE:486 Comparison of Classes by Name	Weakness	Comparison to Class Names (C#)
CWE:489 Active Debug Code	Weakness	Class Enables Debug Features (C#) Debug Call (C#) Method Enables Debug Features (C#)
CWE:491 Public cloneable() Method Without Final ('Object Hijack')	Weakness	clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)
CWE:493 Critical Public Variable Without Final Modifier	Weakness	Method Should be final (C#)
CWE:501 Trust Boundary Violation	Weakness	Tainted Bundle (C#) Tainted Session (C#)
CWE:522 Insufficiently Protected Credentials	Weakness	Password in Property File (C#)
CWE:547 Use of Hard-coded, Security-relevant Constants	Weakness	Hardcoded Filename (C#) Hardcoded IP Address (C#)
CWE:550 Server-generated Error Message Containing Sensitive Information	Weakness	Exception Information Disclosure (C#)
CWE:561 Dead Code	Weakness	Unreachable Instruction (C#) Unused Class (C#) Unused Method (C#)
CWE:563 Assignment to Variable without Use	Weakness	Unnecessary Field (C#) Unused Value: Actual Parameter (C#) Unused Value: Variable (C#) Unused Value: Write to Parameter (C#)
CWE:567 Unsynchronized Access to Shared Data in a Multithreaded Context	Weakness	Missing synchronized Statement (C#) Unguarded Field (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)
CWE:570 Expression is Always False	Weakness	Impossible reference comparison (C#) Instanceof Always False (C#) Redundant Condition (C#) equals Always Fails (C#)
CWE:571 Expression is Always True	Weakness	Instanceof Always True (C#) Redundant Condition (C#)
CWE:572 Call to Thread run() instead of start()	Weakness	Synchronous Call to Thread Body (C#)
CWE:573 Improper Following of Specification by Caller	Weakness	Missing Call to super (C#)
CWE:581 Object Model Violation: Just One of Equals and Hashcode Defined	Weakness	Defines equals but not hashCode (C#) Defines hashCode but not equals (C#)
CWE:582 Array Declared Public, Final, and Static	Weakness	Mutable Public Static Final Array (C#)
CWE:585 Empty Synchronized Block	Weakness	Useless Synchronization (C#)
CWE:595 Comparison of Object References Instead of Object Contents	Weakness	Should Use equals() Instead of == (C#) equals on Array (C#)
CWE:597 Use of Wrong Operator in String Comparison	Weakness	Comparison to Empty String (C#)
CWE:601 URL Redirection to Untrusted Site ('Open Redirect')	Weakness	Open Redirect (C#) Tainted URL (C#)
CWE:607 Public Static Final Field References Mutable Object	Weakness	Mutable Constant Field (C#) Mutable Enumeration (C#) Mutable Public Static Final Array (C#)
CWE:609 Double-Checked Locking	Weakness	Double-Checked Locking (C#)
CWE:611 Improper Restriction of XML External Entity Reference	Weakness	Insecure XSLT Execution (C#) Possible XML External Entity Reference (C#)
CWE:613 Insufficient Session Expiration	Weakness	Unsafe Session Expiration Time (C#)
CWE:614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	Weakness	Insecure Cookie (C#)
CWE:624 Executable Regular Expression Error	Weakness	Tainted Regular Expression (C#)
CWE:628 Function Call with Incorrectly Specified Arguments	Weakness	Method Names Differ Only in Case (C#)
CWE:643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')	Weakness	Tainted Xpath (C#)
CWE:662 Improper Synchronization	Weakness	Useless volatile Modifier (C#)
CWE:665 Improper Initialization	Weakness	Useless Assignment (C#) Useless Assignment to Default (C#)
CWE:674 Uncontrolled Recursion	Weakness	Potential Infinite Recursion (C#)
CWE:676 Use of Potentially Dangerous Function	Weakness	Method Disables Security Setting (C#)
CWE:682 Incorrect Calculation	Weakness	Abs on random (C#)
CWE:686 Function Call With Incorrect Argument Type	Weakness	Non-overriding Method Signature (C#)
CWE:697 Incorrect Comparison	Weakness	Asymmetric compareTo (C#) compareTo without equals (C#) compareTo/equals mismatch (C#)
CWE:698 Execution After Redirect (EAR)	Weakness	Execution After Redirect (C#)
CWE:704 Incorrect Type Conversion or Cast	Weakness	Risky Class Cast (C#) Risky array store (C#)
CWE:710 Improper Adherence to Coding Standards	Weakness	Naming Style Violation (C#)
CWE:749 Exposed Dangerous Method or Function	Weakness	Security Annotation Conflict (C#)
CWE:757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')	Weakness	Deprecated Transfer Protocol (C#)
CWE:768 Incorrect Short Circuit Evaluation	Weakness	Bitwise AND on Boolean (C#) Bitwise OR on Boolean (C#)
CWE:772 Missing Release of Resource after Effective Lifetime	Weakness	Closeable Not Closed (C#)
CWE:789 Memory Allocation with Excessive Size Value	Weakness	Tainted Allocation Size (C#)
CWE:820 Missing Synchronization	Weakness	Unguarded Method (C#)
CWE:833 Deadlock	Weakness	Blocking in Critical Section (C#)
CWE:909 Missing Initialization of Resource	Weakness	Empty zip File Archived (C#)
CWE:913 Improper Control of Dynamically-Managed Code Resources	Weakness	Deserializable Class (C#) Nonserializable Field (C#) Nonserializable Field Element (C#) Nonserializable Outer Class (C#)
CWE:915 Improperly Controlled Modification of Dynamically-Determined Object Attributes	Weakness	Reflection Bypasses Member Accessibility (C#) Reflection Modifies Member Accessibility (C#)
CWE:916 Use of Password Hash With Insufficient Computational Effort	Weakness	Inadequate Salt (C#)
CWE:922 Insecure Storage of Sensitive Information	Weakness	Certificate Added to Root Store (C#)
CWE:1023 Incomplete Comparison with Missing Factors	Weakness	Missing Equals Override (C#)
CWE:1024 Comparison of Incompatible Types	Weakness	== Always Fails Because Types Always Different (C#)
CWE:1041 Use of Redundant Code	Weakness	Copy-Paste Error
CWE:1061 Insufficient Encapsulation	Weakness	Field Too Visible (C#) Method Should be private (C#) Static Field Too Visible (C#)
CWE:1071 Empty Code Block	Weakness	Empty Branch Statement (C#)
CWE:1076 Insufficient Adherence to Expected Conventions	Weakness	Ambiguous Call from Inner Class (C#) Inappropriate Instanceof (C#) Shadowed Identifier (C#) compareTo in Non-Comparable Class (C#) equals Parameter Should Be Object (C#)
CWE:1077 Floating Point Comparison with Incorrect Operator	Weakness	Floating Point Equality (C#)
CWE:1078 Inappropriate Source Code Style or Formatting	Weakness	Approximate e Constant (C#) Approximate pi Constant (C#)
CWE:1097 Persistent Storable Data Element without Associated Comparison Control Element	Weakness	Non-Object compareTo Parameter (C#)
CWE:1126 Declaration of Variable with Unnecessarily Wide Scope	Weakness	Unnecessary Field (C#)
CWE:1164 Irrelevant Code	Weakness	Field Never Read (C#) Redundant Call for String Argument (C#) Static Field Assigned Non-Static (C#) Unused Field (C#) Unused Object (C#) Useless Class Cast (C#) Useless null Test (C#) Useless null Test of Field (C#) Useless null Test of Parameter (C#)
CWE:1176 Inefficient CPU Computation	Weakness	Single-use Random Number Generator (C#)
CWE:1204 Generation of Weak Initialization Vector (IV)	Weakness	Weak Initialization Vector Field (C#) Weak Initialization Vector Value (C#)
CWE:1339 Insufficient Precision or Accuracy of a Real Number	Weakness	Approximate e Constant (C#) Approximate pi Constant (C#)
CWE:1390 Weak Authentication	Weakness	Anonymous LDAP Authentication (C#)

Broad Mapping

CWE

Entity Type

C# Warning Classes

CWE:19 Data Processing Errors

Category

hierarchy ancestor	== Always Fails Because Types Always Different (C#) Insecure XSLT Execution (C#) Open Redirect (C#) Possible XML External Entity Reference (C#) Tainted Regular Expression (C#) Tainted URL (C#)

CWE:20 Improper Input Validation

Weakness

closely mapped	Disabled Input Validation (C#)
hierarchy ancestor	Cast: int Computation to long (C#) DLL Injection (C#) Format String Injection (C#) Reflection Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#)

CWE:22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Weakness

closely mapped	Tainted Path (C#)

CWE:73 External Control of File Name or Path

Weakness

hierarchy ancestor	DLL Injection (C#)

CWE:74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Weakness

closely mapped	DLL Injection (C#) DOS Injection (C#) Tainted @Trusted Value (C#) Tainted Control (C#) Tainted Hardware Device Property (C#) Tainted Network Address (C#) Tainted Resource (C#) Tainted URL (C#) Tainted XAML (C#) Tainted XML (C#)
hierarchy ancestor	Code Injection (C#) Command Injection (C#) Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#) SQL Injection (C#) Tainted Expression Evaluation (C#) Tainted HTTP Response (C#) Tainted LDAP Attribute (C#) Tainted LDAP Filter (C#) Tainted Regular Expression (C#) Tainted Xpath (C#)

CWE:77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Weakness

hierarchy ancestor	Command Injection (C#) Tainted Regular Expression (C#)

CWE:78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Weakness

closely mapped	Command Injection (C#)

CWE:79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Weakness

closely mapped	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)

CWE:81 Improper Neutralization of Script in an Error Message Web Page

Weakness

closely mapped	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)

CWE:89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Weakness

closely mapped	SQL Injection (C#)

CWE:90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Weakness

closely mapped	Tainted LDAP Attribute (C#) Tainted LDAP Filter (C#)

CWE:91 XML Injection (aka Blind XPath Injection)

Weakness

hierarchy ancestor	Tainted Xpath (C#)

CWE:93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Weakness

hierarchy ancestor	Tainted HTTP Response (C#)

CWE:94 Improper Control of Generation of Code ('Code Injection')

Weakness

closely mapped	Code Injection (C#)
hierarchy ancestor	Tainted Expression Evaluation (C#)

CWE:95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Weakness

closely mapped	Tainted Expression Evaluation (C#)

CWE:113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Weakness

closely mapped	Tainted HTTP Response (C#)

CWE:114 Process Control

Weakness

closely mapped	DLL Injection (C#)

CWE:116 Improper Encoding or Escaping of Output

Weakness

hierarchy ancestor	Tainted Log (C#)

CWE:117 Improper Output Neutralization for Logs

Weakness

closely mapped	Tainted Log (C#)

CWE:133 String Errors

Category

hierarchy ancestor	Assignment in Conditional (C#) Bitwise AND on Boolean Constant (C#) Bitwise OR on Boolean Constant (C#) Comparison to Empty String (C#) Format String Injection (C#) Inefficient Bitwise AND (C#) Inefficient Bitwise OR (C#) Should Use == Instead of equals() (C#)

CWE:134 Use of Externally-Controlled Format String

Weakness

closely mapped	Format String Injection (C#)

CWE:136 Type Errors

Category

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#)

CWE:137 Data Neutralization Issues

Category

hierarchy ancestor	Code Injection (C#) Command Injection (C#) Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#) SQL Injection (C#) Tainted Expression Evaluation (C#) Tainted HTTP Response (C#) Tainted LDAP Attribute (C#) Tainted LDAP Filter (C#) Tainted Log (C#) Tainted Xpath (C#)

CWE:189 Numeric Errors

Category

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#)

CWE:190 Integer Overflow or Wraparound

Weakness

closely mapped	Cast: int Computation to long (C#)

CWE:192 Integer Coercion Error

Weakness

closely mapped	Cast: Integer to Floating Point (C#)

CWE:197 Numeric Truncation Error

Weakness

closely mapped	Approximate e Constant (C#) Approximate pi Constant (C#)

CWE:199 Information Management Errors

Category

hierarchy ancestor	Exception Information Disclosure (C#) Insecure Cookie (C#) Tainted Message (C#)

CWE:200 Exposure of Sensitive Information to an Unauthorized Actor

Weakness

hierarchy ancestor	Exception Information Disclosure (C#)

CWE:209 Generation of Error Message Containing Sensitive Information

Weakness

hierarchy ancestor	Exception Information Disclosure (C#)

CWE:221 Information Loss or Omission

Weakness

hierarchy ancestor	Generic Exception Handler (C#)

CWE:227 7PK - API Abuse

Category

also related	Non-Object compareTo Parameter (C#)
hierarchy ancestor	Call Might Return Null (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#) Method Should Not Return null (C#)

CWE:252 Unchecked Return Value

Weakness

closely mapped	Call Might Return Null (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#)
hierarchy ancestor	Method Should Not Return null (C#)

CWE:253 Incorrect Check of Function Return Value

Weakness

closely mapped	Useless null Test of Return Value (C#)
also related	Null Pointer Dereference (C#)

CWE:254 7PK - Security Features

Category

hierarchy ancestor

CWE:255 Credentials Management Errors

Category

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Inadequate Salt (C#)

CWE:259 Use of Hard-coded Password

Weakness

closely mapped	Hardcoded Password (C#)

CWE:265 Privilege Issues

Category

hierarchy ancestor	Tainted Bundle (C#) Tainted Session (C#)

CWE:284 Improper Access Control

Weakness

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Security Annotation Conflict (C#)

CWE:287 Improper Authentication

Weakness

closely mapped	Hostname in Condition (C#) Missing Authentication Annotation (C#)
hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Password in Property File (C#)

CWE:310 Cryptographic Issues

Category

hierarchy ancestor	Cryptographic Algorithm with Weak Hash (C#) Inadequate Salt (C#) Missing Required Cryptographic Step (C#) Use of Same Seed (C#) Weak Cryptographic Value (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#) Weak Initialization Vector Field (C#) Weak Initialization Vector Value (C#)

CWE:311 Missing Encryption of Sensitive Data

Weakness

hierarchy ancestor	Insecure Cookie (C#) Tainted Message (C#)

CWE:319 Cleartext Transmission of Sensitive Information

Weakness

closely mapped	Tainted Message (C#)
hierarchy ancestor	Insecure Cookie (C#)

CWE:320 Key Management Errors

Category

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#)

CWE:321 Use of Hard-coded Cryptographic Key

Weakness

closely mapped	Hardcoded Cryptographic Key (C#)

CWE:325 Missing Cryptographic Step

Weakness

closely mapped	Missing Required Cryptographic Step (C#)

CWE:326 Inadequate Encryption Strength

Weakness

closely mapped	Insecure Key Derivation (C#)
hierarchy ancestor	Cryptographic Algorithm with Weak Hash (C#) Inadequate Salt (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#)

CWE:327 Use of a Broken or Risky Cryptographic Algorithm

Weakness

closely mapped	Cryptographic Algorithm with Risky Default Cipher (C#) Cryptographic Algorithm with Weak Cipher (C#) Deprecated Cryptography Provider (C#) Risky Cipher Algorithm (C#) Risky Cipher Field (C#) Risky Cryptographic Algorithm (C#) Risky Cryptographic Field (C#) Unsafe Base64 Encoding (C#)
hierarchy ancestor	Cryptographic Algorithm with Weak Hash (C#) Inadequate Salt (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#)

CWE:328 Use of Weak Hash

Weakness

closely mapped	Cryptographic Algorithm with Weak Hash (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#)
hierarchy ancestor	Inadequate Salt (C#)

CWE:330 Use of Insufficiently Random Values

Weakness

closely mapped	Hardcoded Random Seed (C#) Insecure Random Number Generator (C#) Legacy Random Generator (C#)
hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Use of Same Seed (C#) Weak Cryptographic Value (C#) Weak Initialization Vector Field (C#) Weak Initialization Vector Value (C#)

CWE:335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Weakness

hierarchy ancestor	Use of Same Seed (C#)

CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)

Weakness

closely mapped	Use of Same Seed (C#)

CWE:338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Weakness

closely mapped	Weak Cryptographic Value (C#)

CWE:344 Use of Invariant Value in Dynamically Changing Context

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#)

CWE:361 7PK - Time and State

Category

hierarchy ancestor	Synchronization on Interned String (C#)

CWE:388 7PK - Errors

Category

hierarchy ancestor	Generic Exception Handler (C#) Inappropriate Exception Handler (C#)

CWE:389 Error Conditions, Return Values, Status Codes

Category

hierarchy ancestor	Call Might Return Null (C#) Empty Exception Handler (C#) Exception Information Disclosure (C#) Generic Exception Handler (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#) Inappropriate Exception Handler (C#) Method Should Not Return null (C#) Null Pointer Dereference (C#) Unused Object (C#) Useless null Test of Return Value (C#)

CWE:390 Detection of Error Condition Without Action

Weakness

closely mapped	Empty Exception Handler (C#)

CWE:392 Missing Report of Error Condition

Weakness

also related	Unused Object (C#)

CWE:395 Use of NullPointerException Catch to Detect NULL Pointer Dereference

Weakness

closely mapped	Inappropriate Exception Handler (C#)

CWE:396 Declaration of Catch for Generic Exception

Weakness

closely mapped	Generic Exception Handler (C#)

CWE:398 7PK - Code Quality

Category

also related

hierarchy ancestor

CWE:399 Resource Management Errors

Category

hierarchy ancestor	Closeable Not Closed (C#) DLL Injection (C#) Empty zip File Archived (C#) Field Never Written (C#) Null Pointer Dereference (C#) Reflection Bypasses Member Accessibility (C#) Reflection Injection (C#) Reflection Modifies Member Accessibility (C#) Tainted Allocation Size (C#) Unused Object (C#)

CWE:400 Uncontrolled Resource Consumption

Weakness

closely mapped	Closeable Not Stored (C#)
hierarchy ancestor	Single-use Random Number Generator (C#) Tainted Allocation Size (C#) Unused Object (C#)

CWE:404 Improper Resource Shutdown or Release

Weakness

hierarchy ancestor	Closeable Not Closed (C#)

CWE:405 Asymmetric Resource Consumption (Amplification)

Weakness

hierarchy ancestor	Single-use Random Number Generator (C#)

CWE:411 Resource Locking Problems

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Synchronization on Interned String (C#) Synchronization on static (C#)

CWE:412 Unrestricted Externally Accessible Lock

Weakness

closely mapped	Synchronization on Interned String (C#)

CWE:413 Improper Resource Locking

Weakness

closely mapped	Impossible Client Side Locking (C#) Synchronization on static (C#)

CWE:435 Improper Interaction Between Multiple Correctly-Behaving Entities

Weakness

hierarchy ancestor	Tainted HTTP Response (C#)

CWE:436 Interpretation Conflict

Weakness

hierarchy ancestor	Tainted HTTP Response (C#)

CWE:438 Behavioral Problems

Category

hierarchy ancestor

CWE:440 Expected Behavior Violation

Weakness

closely mapped	toString on Array (C#)

CWE:456 Missing Initialization of a Variable

Weakness

closely mapped	Field Never Written (C#) Null Pointer Dereference (C#)

CWE:465 Pointer Issues

Category

hierarchy ancestor

CWE:470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Weakness

closely mapped	Reflection Injection (C#)

CWE:471 Modification of Assumed-Immutable Data (MAID)

Weakness

hierarchy ancestor	Mutable Constant Field (C#) Mutable Enumeration (C#) Mutable Public Static Final Array (C#)

CWE:476 NULL Pointer Dereference

Weakness

closely mapped

CWE:477 Use of Obsolete Function

Weakness

closely mapped	Debug Warning (C#)

CWE:480 Use of Incorrect Operator

Weakness

closely mapped	Bitwise AND on Boolean Constant (C#) Bitwise OR on Boolean Constant (C#) Inefficient Bitwise AND (C#) Inefficient Bitwise OR (C#) Should Use == Instead of equals() (C#)
hierarchy ancestor	Assignment in Conditional (C#) Comparison to Empty String (C#)

CWE:481 Assigning instead of Comparing

Weakness

closely mapped	Assignment in Conditional (C#)

CWE:485 7PK - Encapsulation

Category

also related	Field Too Visible (C#) Method Should be final (C#) Method Should be private (C#) Shadowed Identifier (C#) Static Field Too Visible (C#)
hierarchy ancestor	Class Enables Debug Features (C#) Comparison to Class Names (C#) Debug Call (C#) Method Enables Debug Features (C#) Tainted Bundle (C#) Tainted Session (C#) clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:486 Comparison of Classes by Name

Weakness

closely mapped	Comparison to Class Names (C#)

CWE:489 Active Debug Code

Weakness

closely mapped	Class Enables Debug Features (C#) Debug Call (C#) Method Enables Debug Features (C#)

CWE:491 Public cloneable() Method Without Final ('Object Hijack')

Weakness

closely mapped	clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:493 Critical Public Variable Without Final Modifier

Weakness

closely mapped	Method Should be final (C#)

CWE:501 Trust Boundary Violation

Weakness

closely mapped	Tainted Bundle (C#) Tainted Session (C#)

CWE:522 Insufficiently Protected Credentials

Weakness

closely mapped	Password in Property File (C#)

CWE:547 Use of Hard-coded, Security-relevant Constants

Weakness

closely mapped	Hardcoded Filename (C#) Hardcoded IP Address (C#)

CWE:550 Server-generated Error Message Containing Sensitive Information

Weakness

closely mapped	Exception Information Disclosure (C#)

CWE:557 Concurrency Issues

Category

hierarchy ancestor	Missing synchronized Statement (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:561 Dead Code

Weakness

closely mapped	Unreachable Instruction (C#) Unused Class (C#) Unused Method (C#)

CWE:563 Assignment to Variable without Use

Weakness

closely mapped	Unnecessary Field (C#) Unused Value: Actual Parameter (C#) Unused Value: Variable (C#) Unused Value: Write to Parameter (C#)

CWE:567 Unsynchronized Access to Shared Data in a Multithreaded Context

Weakness

closely mapped	Missing synchronized Statement (C#) Unguarded Field (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:569 Expression Issues

Category

hierarchy ancestor

CWE:570 Expression is Always False

Weakness

closely mapped	Impossible reference comparison (C#) Instanceof Always False (C#) Redundant Condition (C#) equals Always Fails (C#)
also related	Useless null Test (C#) Useless null Test of Field (C#) Useless null Test of Parameter (C#)

CWE:571 Expression is Always True

Weakness

closely mapped	Instanceof Always True (C#) Redundant Condition (C#)
also related	Useless null Test (C#) Useless null Test of Field (C#) Useless null Test of Parameter (C#)

CWE:572 Call to Thread run() instead of start()

Weakness

closely mapped	Synchronous Call to Thread Body (C#)

CWE:573 Improper Following of Specification by Caller

Weakness

closely mapped	Missing Call to super (C#)
hierarchy ancestor	Copy-Paste Error Defines equals but not hashCode (C#) Defines hashCode but not equals (C#) Method Names Differ Only in Case (C#) Missing Required Cryptographic Step (C#) Non-overriding Method Signature (C#) Null Pointer Dereference (C#) Useless null Test of Return Value (C#)

CWE:581 Object Model Violation: Just One of Equals and Hashcode Defined

Weakness

closely mapped	Defines equals but not hashCode (C#) Defines hashCode but not equals (C#)

CWE:582 Array Declared Public, Final, and Static

Weakness

closely mapped	Mutable Public Static Final Array (C#)

CWE:585 Empty Synchronized Block

Weakness

closely mapped	Useless Synchronization (C#)

CWE:595 Comparison of Object References Instead of Object Contents

Weakness

closely mapped	Should Use equals() Instead of == (C#) equals on Array (C#)
hierarchy ancestor	Comparison to Empty String (C#) Non-Object compareTo Parameter (C#) equals Parameter Should Be Object (C#)

CWE:597 Use of Wrong Operator in String Comparison

Weakness

closely mapped	Comparison to Empty String (C#)

CWE:601 URL Redirection to Untrusted Site ('Open Redirect')

Weakness

closely mapped	Open Redirect (C#) Tainted URL (C#)

CWE:607 Public Static Final Field References Mutable Object

Weakness

closely mapped	Mutable Constant Field (C#) Mutable Enumeration (C#) Mutable Public Static Final Array (C#)

CWE:609 Double-Checked Locking

Weakness

closely mapped	Double-Checked Locking (C#)

CWE:610 Externally Controlled Reference to a Resource in Another Sphere

Weakness

hierarchy ancestor	DLL Injection (C#) Insecure XSLT Execution (C#) Open Redirect (C#) Possible XML External Entity Reference (C#) Reflection Injection (C#) Tainted URL (C#)

CWE:611 Improper Restriction of XML External Entity Reference

Weakness

closely mapped	Insecure XSLT Execution (C#) Possible XML External Entity Reference (C#)

CWE:613 Insufficient Session Expiration

Weakness

closely mapped	Unsafe Session Expiration Time (C#)

CWE:614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Weakness

closely mapped	Insecure Cookie (C#)

CWE:624 Executable Regular Expression Error

Weakness

closely mapped	Tainted Regular Expression (C#)

CWE:628 Function Call with Incorrectly Specified Arguments

Weakness

closely mapped	Method Names Differ Only in Case (C#)
hierarchy ancestor	Copy-Paste Error Non-overriding Method Signature (C#)

CWE:629 Weaknesses in OWASP Top Ten (2007)

View

hierarchy ancestor

CWE:635 Weaknesses Originally Used by NVD from 2008 to 2016

View

hierarchy ancestor

CWE:642 External Control of Critical State Data

Weakness

hierarchy ancestor	DLL Injection (C#)

CWE:643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Weakness

closely mapped	Tainted Xpath (C#)

CWE:657 Violation of Secure Design Principles

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#)

CWE:658 Weaknesses in Software Written in C

View

hierarchy ancestor

CWE:659 Weaknesses in Software Written in C++

View

hierarchy ancestor

CWE:660 Weaknesses in Software Written in Java

View

hierarchy ancestor

CWE:661 Weaknesses in Software Written in PHP

View

hierarchy ancestor

CWE:662 Improper Synchronization

Weakness

closely mapped	Useless volatile Modifier (C#)
hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#)

CWE:664 Improper Control of a Resource Through its Lifetime

Weakness

hierarchy ancestor

CWE:665 Improper Initialization

Weakness

closely mapped	Useless Assignment (C#) Useless Assignment to Default (C#)
hierarchy ancestor	Empty zip File Archived (C#) Field Never Written (C#) Null Pointer Dereference (C#) Tainted Allocation Size (C#)

CWE:666 Operation on Resource in Wrong Phase of Lifetime

Weakness

hierarchy ancestor	Unsafe Session Expiration Time (C#)

CWE:667 Improper Locking

Weakness

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Synchronization on Interned String (C#) Synchronization on static (C#)

CWE:668 Exposure of Resource to Wrong Sphere

Weakness

hierarchy ancestor	DLL Injection (C#) Exception Information Disclosure (C#) Format String Injection (C#) Method Should be final (C#) Mutable Public Static Final Array (C#) Password in Property File (C#) Tainted Path (C#) clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:670 Always-Incorrect Control Flow Implementation

Weakness

hierarchy ancestor	Assignment in Conditional (C#) Bitwise AND on Boolean Constant (C#) Bitwise OR on Boolean Constant (C#) Comparison to Empty String (C#) Execution After Redirect (C#) Inefficient Bitwise AND (C#) Inefficient Bitwise OR (C#) Should Use == Instead of equals() (C#)

CWE:671 Lack of Administrator Control over Security

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#)

CWE:672 Operation on a Resource after Expiration or Release

Weakness

hierarchy ancestor	Unsafe Session Expiration Time (C#)

CWE:674 Uncontrolled Recursion

Weakness

closely mapped	Potential Infinite Recursion (C#)

CWE:676 Use of Potentially Dangerous Function

Weakness

closely mapped	Method Disables Security Setting (C#)

CWE:677 Weakness Base Elements

View

hierarchy ancestor

CWE:681 Incorrect Conversion between Numeric Types

Weakness

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#)

CWE:682 Incorrect Calculation

Weakness

closely mapped	Abs on random (C#)
hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: int Computation to long (C#)

CWE:683 Function Call With Incorrect Order of Arguments

Weakness

also related	Copy-Paste Error

CWE:684 Incorrect Provision of Specified Functionality

Weakness

hierarchy ancestor	Unused Object (C#) toString on Array (C#)

CWE:685 Function Call With Incorrect Number of Arguments

Weakness

also related	Copy-Paste Error

CWE:686 Function Call With Incorrect Argument Type

Weakness

closely mapped	Non-overriding Method Signature (C#)

CWE:688 Function Call With Incorrect Variable or Reference as Argument

Weakness

also related	Copy-Paste Error

CWE:690 Unchecked Return Value to NULL Pointer Dereference

Weakness

also related	Method Should Not Return null (C#)

CWE:691 Insufficient Control Flow Management

Weakness

hierarchy ancestor

CWE:693 Protection Mechanism Failure

Weakness

hierarchy ancestor

CWE:697 Incorrect Comparison

Weakness

closely mapped	Asymmetric compareTo (C#) compareTo without equals (C#) compareTo/equals mismatch (C#)
hierarchy ancestor	== Always Fails Because Types Always Different (C#) Comparison to Class Names (C#) Comparison to Empty String (C#) Defines equals but not hashCode (C#) Defines hashCode but not equals (C#) Floating Point Equality (C#) Missing Equals Override (C#) Non-Object compareTo Parameter (C#) Should Use equals() Instead of == (C#) equals Parameter Should Be Object (C#) equals on Array (C#)

CWE:698 Execution After Redirect (EAR)

Weakness

closely mapped	Execution After Redirect (C#)

CWE:699 Software Development

View

hierarchy ancestor

CWE:700 Seven Pernicious Kingdoms

View

hierarchy ancestor

CWE:701 Weaknesses Introduced During Design

View

hierarchy ancestor

CWE:702 Weaknesses Introduced During Implementation

View

hierarchy ancestor

CWE:703 Improper Check or Handling of Exceptional Conditions

Weakness

hierarchy ancestor

CWE:704 Incorrect Type Conversion or Cast

Weakness

closely mapped	Risky Class Cast (C#) Risky array store (C#)
hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#)

CWE:705 Incorrect Control Flow Scoping

Weakness

hierarchy ancestor	Execution After Redirect (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#)

CWE:706 Use of Incorrectly-Resolved Name or Reference

Weakness

hierarchy ancestor	Tainted Path (C#)

CWE:707 Improper Neutralization

Weakness

hierarchy ancestor

CWE:709 Named Chains

View

hierarchy ancestor	Method Should Not Return null (C#)

CWE:710 Improper Adherence to Coding Standards

Weakness

closely mapped

Naming Style Violation (C#)

hierarchy ancestor

CWE:711 Weaknesses in OWASP Top Ten (2004)

View

hierarchy ancestor

CWE:712 OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)

CWE:713 OWASP Top Ten 2007 Category A2 - Injection Flaws

Category

hierarchy ancestor	Command Injection (C#) SQL Injection (C#) Tainted HTTP Response (C#) Tainted LDAP Attribute (C#) Tainted LDAP Filter (C#) Tainted Regular Expression (C#) Tainted Xpath (C#)

CWE:714 OWASP Top Ten 2007 Category A3 - Malicious File Execution

Category

hierarchy ancestor	Command Injection (C#) Tainted Expression Evaluation (C#)

CWE:715 OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference

Category

hierarchy ancestor	Tainted Path (C#)

CWE:717 OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling

Category

hierarchy ancestor	Exception Information Disclosure (C#)

CWE:718 OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#)

CWE:719 OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage

Category

hierarchy ancestor	Cryptographic Algorithm with Weak Hash (C#) Hardcoded Cryptographic Key (C#) Inadequate Salt (C#) Insecure Cookie (C#) Insecure Key Derivation (C#) Missing Required Cryptographic Step (C#) Tainted Message (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#)

CWE:720 OWASP Top Ten 2007 Category A9 - Insecure Communications

Category

hierarchy ancestor	Cryptographic Algorithm with Weak Hash (C#) Hardcoded Cryptographic Key (C#) Inadequate Salt (C#) Insecure Cookie (C#) Insecure Key Derivation (C#) Missing Required Cryptographic Step (C#) Tainted Message (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#)

CWE:722 OWASP Top Ten 2004 Category A1 - Unvalidated Input

Category

hierarchy ancestor	Cast: int Computation to long (C#) Command Injection (C#) Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#) DLL Injection (C#) Disabled Input Validation (C#) Format String Injection (C#) Open Redirect (C#) Reflection Injection (C#) SQL Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#) Tainted Regular Expression (C#) Tainted URL (C#)

CWE:723 OWASP Top Ten 2004 Category A2 - Broken Access Control

Category

hierarchy ancestor

CWE:724 OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Inadequate Salt (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Unsafe Session Expiration Time (C#)

CWE:725 OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws

Category

hierarchy ancestor	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)

CWE:726 OWASP Top Ten 2004 Category A5 - Buffer Overflows

Category

hierarchy ancestor	Format String Injection (C#)

CWE:727 OWASP Top Ten 2004 Category A6 - Injection Flaws

Category

hierarchy ancestor

CWE:728 OWASP Top Ten 2004 Category A7 - Improper Error Handling

Category

hierarchy ancestor	Call Might Return Null (C#) Empty Exception Handler (C#) Exception Information Disclosure (C#) Generic Exception Handler (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#) Inappropriate Exception Handler (C#) Method Should Not Return null (C#) Null Pointer Dereference (C#) Unused Object (C#) Useless null Test of Return Value (C#)

CWE:729 OWASP Top Ten 2004 Category A8 - Insecure Storage

Category

hierarchy ancestor

CWE:730 OWASP Top Ten 2004 Category A9 - Denial of Service

Category

hierarchy ancestor

CWE:731 OWASP Top Ten 2004 Category A10 - Insecure Configuration Management

Category

hierarchy ancestor	Class Enables Debug Features (C#) Debug Call (C#) Exception Information Disclosure (C#) Method Enables Debug Features (C#)

CWE:734 Weaknesses Addressed by the CERT C Secure Coding Standard (2008)

View

hierarchy ancestor

CWE:735 CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE)

Category

hierarchy ancestor	Unused Object (C#) toString on Array (C#)

CWE:736 CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL)

Category

hierarchy ancestor	Copy-Paste Error Hardcoded Filename (C#) Hardcoded IP Address (C#) Method Names Differ Only in Case (C#) Non-overriding Method Signature (C#)

CWE:737 CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)

Category

hierarchy ancestor

CWE:738 CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT)

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#) DLL Injection (C#) Disabled Input Validation (C#) Format String Injection (C#) Method Disables Security Setting (C#) Reflection Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#)

CWE:739 CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP)

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#) Non-overriding Method Signature (C#)

CWE:740 CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)

Category

hierarchy ancestor	Empty zip File Archived (C#) Field Never Written (C#) Null Pointer Dereference (C#) Tainted Allocation Size (C#) Useless Assignment (C#) Useless Assignment to Default (C#)

CWE:741 CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)

Category

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Command Injection (C#) Non-overriding Method Signature (C#) Risky Class Cast (C#) Risky array store (C#)

CWE:742 CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)

Category

hierarchy ancestor

CWE:743 CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)

Category

hierarchy ancestor	Closeable Not Closed (C#) Format String Injection (C#) Method Disables Security Setting (C#) Non-overriding Method Signature (C#) Tainted Path (C#)

CWE:744 CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)

Category

hierarchy ancestor	Command Injection (C#) Execution After Redirect (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#)

CWE:745 CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:746 CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR)

Category

hierarchy ancestor	Cast: int Computation to long (C#) DLL Injection (C#) Disabled Input Validation (C#) Execution After Redirect (C#) Format String Injection (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#) Method Disables Security Setting (C#) Reflection Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#)

CWE:747 CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:748 CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Non-overriding Method Signature (C#) Synchronization on Interned String (C#) Synchronization on static (C#)

CWE:749 Exposed Dangerous Method or Function

Weakness

closely mapped	Security Annotation Conflict (C#)

CWE:750 Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors

View

hierarchy ancestor

CWE:751 2009 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor	Cast: int Computation to long (C#) Command Injection (C#) Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#) DLL Injection (C#) Disabled Input Validation (C#) Exception Information Disclosure (C#) Format String Injection (C#) Insecure Cookie (C#) Reflection Injection (C#) SQL Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#) Tainted Message (C#)

CWE:752 2009 Top 25 - Risky Resource Management

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: int Computation to long (C#) Closeable Not Closed (C#) Code Injection (C#) DLL Injection (C#) Empty zip File Archived (C#) Field Never Written (C#) Null Pointer Dereference (C#) Tainted Allocation Size (C#) Tainted Expression Evaluation (C#) Useless Assignment (C#) Useless Assignment to Default (C#)

CWE:753 2009 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:754 Improper Check for Unusual or Exceptional Conditions

Weakness

hierarchy ancestor

CWE:755 Improper Handling of Exceptional Conditions

Weakness

hierarchy ancestor	Empty Exception Handler (C#) Exception Information Disclosure (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#) Unused Object (C#)

CWE:757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Weakness

closely mapped	Deprecated Transfer Protocol (C#)

CWE:768 Incorrect Short Circuit Evaluation

Weakness

closely mapped	Bitwise AND on Boolean (C#) Bitwise OR on Boolean (C#)

CWE:770 Allocation of Resources Without Limits or Throttling

Weakness

hierarchy ancestor	Tainted Allocation Size (C#)

CWE:771 Missing Reference to Active Allocated Resource

Weakness

also related	Unused Object (C#)

CWE:772 Missing Release of Resource after Effective Lifetime

Weakness

closely mapped	Closeable Not Closed (C#)

CWE:789 Memory Allocation with Excessive Size Value

Weakness

closely mapped	Tainted Allocation Size (C#)

CWE:798 Use of Hard-coded Credentials

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#)

CWE:800 Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors

View

hierarchy ancestor

CWE:801 2010 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor	Command Injection (C#) Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#) Exception Information Disclosure (C#) Open Redirect (C#) SQL Injection (C#) Tainted URL (C#)

CWE:802 2010 Top 25 - Risky Resource Management

Category

hierarchy ancestor

CWE:803 2010 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:808 2010 Top 25 - Weaknesses On the Cusp

Category

hierarchy ancestor

CWE:809 Weaknesses in OWASP Top Ten (2010)

View

hierarchy ancestor

CWE:810 OWASP Top Ten 2010 Category A1 - Injection

Category

hierarchy ancestor	Command Injection (C#) SQL Injection (C#) Tainted LDAP Attribute (C#) Tainted LDAP Filter (C#) Tainted Xpath (C#)

CWE:811 OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)

CWE:812 OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#)

CWE:813 OWASP Top Ten 2010 Category A4 - Insecure Direct Object References

Category

hierarchy ancestor	Tainted Path (C#)

CWE:815 OWASP Top Ten 2010 Category A6 - Security Misconfiguration

Category

hierarchy ancestor	Exception Information Disclosure (C#)

CWE:816 OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage

Category

hierarchy ancestor

CWE:818 OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection

Category

hierarchy ancestor	Insecure Cookie (C#) Tainted Message (C#)

CWE:819 OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards

Category

hierarchy ancestor	Open Redirect (C#) Tainted URL (C#)

CWE:820 Missing Synchronization

Weakness

closely mapped	Unguarded Method (C#)
hierarchy ancestor	Missing synchronized Statement (C#) Unguarded Field (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:821 Incorrect Synchronization

Weakness

hierarchy ancestor	Synchronous Call to Thread Body (C#)

CWE:833 Deadlock

Weakness

closely mapped	Blocking in Critical Section (C#)

CWE:834 Excessive Iteration

Weakness

hierarchy ancestor	Potential Infinite Recursion (C#)

CWE:840 Business Logic Errors

Category

hierarchy ancestor	Tainted Allocation Size (C#)

CWE:844 Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011)

View

hierarchy ancestor

CWE:845 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor	Command Injection (C#) Format String Injection (C#) Tainted Log (C#)

CWE:846 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL)

Category

hierarchy ancestor	Empty zip File Archived (C#) Field Never Written (C#) Null Pointer Dereference (C#) Tainted Allocation Size (C#) Useless Assignment (C#) Useless Assignment to Default (C#)

CWE:847 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP)

Category

hierarchy ancestor	Call Might Return Null (C#) Comparison to Empty String (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#) Method Should Not Return null (C#) Non-Object compareTo Parameter (C#) Should Use equals() Instead of == (C#) equals Parameter Should Be Object (C#) equals on Array (C#)

CWE:848 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM)

Category

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#)

CWE:849 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ)

Category

hierarchy ancestor	Comparison to Class Names (C#) Method Should be final (C#) Mutable Public Static Final Array (C#) clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:850 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)

Category

hierarchy ancestor	Copy-Paste Error Defines equals but not hashCode (C#) Defines hashCode but not equals (C#) Method Names Differ Only in Case (C#) Missing Call to super (C#) Missing Required Cryptographic Step (C#) Non-overriding Method Signature (C#) Null Pointer Dereference (C#) Useless null Test of Return Value (C#)

CWE:851 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)

Category

hierarchy ancestor

CWE:852 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:853 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:854 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI)

Category

hierarchy ancestor	Execution After Redirect (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#) Synchronous Call to Thread Body (C#)

CWE:855 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)

Category

hierarchy ancestor	Single-use Random Number Generator (C#) Unused Object (C#)

CWE:857 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO)

Category

hierarchy ancestor	Closeable Not Closed (C#) Single-use Random Number Generator (C#) Tainted Allocation Size (C#)

CWE:858 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER)

Category

hierarchy ancestor	Closeable Not Stored (C#) Insecure Cookie (C#) Single-use Random Number Generator (C#) Tainted Allocation Size (C#) Tainted Message (C#) Unused Object (C#)

CWE:859 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC)

Category

hierarchy ancestor	Insecure Cookie (C#) Reflection Injection (C#) Tainted Message (C#)

CWE:861 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:864 2011 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor	Command Injection (C#) Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#) Open Redirect (C#) SQL Injection (C#) Tainted URL (C#)

CWE:865 2011 Top 25 - Risky Resource Management

Category

hierarchy ancestor	Cast: int Computation to long (C#) Format String Injection (C#) Method Disables Security Setting (C#) Tainted Path (C#)

CWE:866 2011 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:867 2011 Top 25 - Weaknesses On the Cusp

Category

hierarchy ancestor

CWE:868 Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)

View

hierarchy ancestor

CWE:871 CERT C++ Secure Coding Section 03 - Expressions (EXP)

Category

hierarchy ancestor

CWE:872 CERT C++ Secure Coding Section 04 - Integers (INT)

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#) DLL Injection (C#) Disabled Input Validation (C#) Format String Injection (C#) Method Disables Security Setting (C#) Reflection Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#)

CWE:873 CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#) Non-overriding Method Signature (C#)

CWE:874 CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)

Category

hierarchy ancestor	Empty zip File Archived (C#) Field Never Written (C#) Null Pointer Dereference (C#) Tainted Allocation Size (C#) Useless Assignment (C#) Useless Assignment to Default (C#)

CWE:875 CERT C++ Secure Coding Section 07 - Characters and Strings (STR)

Category

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Command Injection (C#) Non-overriding Method Signature (C#) Risky Class Cast (C#) Risky array store (C#)

CWE:876 CERT C++ Secure Coding Section 08 - Memory Management (MEM)

Category

hierarchy ancestor

CWE:877 CERT C++ Secure Coding Section 09 - Input Output (FIO)

Category

hierarchy ancestor	Closeable Not Closed (C#) DLL Injection (C#) Format String Injection (C#) Method Disables Security Setting (C#) Tainted Allocation Size (C#) Tainted Path (C#)

CWE:878 CERT C++ Secure Coding Section 10 - Environment (ENV)

Category

hierarchy ancestor	Command Injection (C#) Execution After Redirect (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#)

CWE:879 CERT C++ Secure Coding Section 11 - Signals (SIG)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:880 CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)

Category

hierarchy ancestor

CWE:882 CERT C++ Secure Coding Section 14 - Concurrency (CON)

Category

hierarchy ancestor	Closeable Not Closed (C#)

CWE:883 CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:884 CWE Cross-section

View

hierarchy ancestor

CWE:885 SFP Primary Cluster: Risky Values

Category

hierarchy ancestor

CWE:886 SFP Primary Cluster: Unused entities

Category

hierarchy ancestor	Unnecessary Field (C#) Unreachable Instruction (C#) Unused Class (C#) Unused Method (C#) Unused Value: Actual Parameter (C#) Unused Value: Variable (C#) Unused Value: Write to Parameter (C#)

CWE:887 SFP Primary Cluster: API

Category

hierarchy ancestor

CWE:888 Software Fault Pattern (SFP) Clusters

View

hierarchy ancestor

CWE:889 SFP Primary Cluster: Exception Management

Category

hierarchy ancestor

CWE:890 SFP Primary Cluster: Memory Access

Category

hierarchy ancestor

CWE:892 SFP Primary Cluster: Resource Management

Category

hierarchy ancestor

CWE:893 SFP Primary Cluster: Path Resolution

Category

hierarchy ancestor	DLL Injection (C#) Insecure XSLT Execution (C#) Open Redirect (C#) Possible XML External Entity Reference (C#) Reflection Injection (C#) Tainted Path (C#) Tainted URL (C#)

CWE:894 SFP Primary Cluster: Synchronization

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless Synchronization (C#) Useless volatile Modifier (C#)

CWE:895 SFP Primary Cluster: Information Leak

Category

hierarchy ancestor

CWE:896 SFP Primary Cluster: Tainted Input

Category

hierarchy ancestor

CWE:897 SFP Primary Cluster: Entry Points

Category

hierarchy ancestor	Class Enables Debug Features (C#) Debug Call (C#) Method Enables Debug Features (C#) Method Should be final (C#) Mutable Public Static Final Array (C#) clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:898 SFP Primary Cluster: Authentication

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Filename (C#) Hardcoded IP Address (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Unsafe Session Expiration Time (C#)

CWE:899 SFP Primary Cluster: Access Control

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Security Annotation Conflict (C#)

CWE:900 Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors

View

hierarchy ancestor

CWE:902 SFP Primary Cluster: Channel

Category

hierarchy ancestor	Deprecated Transfer Protocol (C#) Tainted HTTP Response (C#)

CWE:903 SFP Primary Cluster: Cryptography

Category

hierarchy ancestor

CWE:905 SFP Primary Cluster: Predictability

Category

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hardcoded Random Seed (C#) Insecure Random Number Generator (C#) Legacy Random Generator (C#) Use of Same Seed (C#) Weak Cryptographic Value (C#) Weak Initialization Vector Field (C#) Weak Initialization Vector Value (C#)

CWE:906 SFP Primary Cluster: UI

Category

hierarchy ancestor	Generic Exception Handler (C#)

CWE:907 SFP Primary Cluster: Other

Category

hierarchy ancestor

CWE:909 Missing Initialization of Resource

Weakness

closely mapped	Empty zip File Archived (C#)
hierarchy ancestor	Field Never Written (C#) Null Pointer Dereference (C#)

CWE:913 Improper Control of Dynamically-Managed Code Resources

Weakness

closely mapped	Deserializable Class (C#) Nonserializable Field (C#) Nonserializable Field Element (C#) Nonserializable Outer Class (C#)
hierarchy ancestor	Code Injection (C#) Reflection Bypasses Member Accessibility (C#) Reflection Injection (C#) Reflection Modifies Member Accessibility (C#) Tainted Expression Evaluation (C#)

CWE:915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Weakness

closely mapped	Reflection Bypasses Member Accessibility (C#) Reflection Modifies Member Accessibility (C#)

CWE:916 Use of Password Hash With Insufficient Computational Effort

Weakness

closely mapped	Inadequate Salt (C#)

CWE:919 Weaknesses in Mobile Applications

View

hierarchy ancestor	Closeable Not Closed (C#) Exception Information Disclosure (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Insecure Cookie (C#) Tainted Message (C#) Unsafe Session Expiration Time (C#)

CWE:922 Insecure Storage of Sensitive Information

Weakness

closely mapped	Certificate Added to Root Store (C#)

CWE:928 Weaknesses in OWASP Top Ten (2013)

View

hierarchy ancestor

CWE:929 OWASP Top Ten 2013 Category A1 - Injection

Category

hierarchy ancestor

CWE:930 OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Insecure Cookie (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Tainted Message (C#) Unsafe Session Expiration Time (C#)

CWE:931 OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)

CWE:932 OWASP Top Ten 2013 Category A4 - Insecure Direct Object References

Category

hierarchy ancestor	Tainted Path (C#)

CWE:933 OWASP Top Ten 2013 Category A5 - Security Misconfiguration

Category

hierarchy ancestor	Exception Information Disclosure (C#)

CWE:934 OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure

Category

hierarchy ancestor

CWE:938 OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards

Category

hierarchy ancestor	Open Redirect (C#) Tainted URL (C#)

CWE:943 Improper Neutralization of Special Elements in Data Query Logic

Weakness

hierarchy ancestor	SQL Injection (C#) Tainted LDAP Attribute (C#) Tainted LDAP Filter (C#) Tainted Xpath (C#)

CWE:944 SFP Secondary Cluster: Access Management

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Security Annotation Conflict (C#)

CWE:947 SFP Secondary Cluster: Authentication Bypass

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#)

CWE:950 SFP Secondary Cluster: Hardcoded Sensitive Data

Category

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Filename (C#) Hardcoded IP Address (C#) Hardcoded Password (C#)

CWE:951 SFP Secondary Cluster: Insecure Authentication Policy

Category

hierarchy ancestor	Unsafe Session Expiration Time (C#)

CWE:957 SFP Secondary Cluster: Protocol Error

Category

hierarchy ancestor	Deprecated Transfer Protocol (C#) Tainted HTTP Response (C#)

CWE:958 SFP Secondary Cluster: Broken Cryptography

Category

hierarchy ancestor

CWE:959 SFP Secondary Cluster: Weak Cryptography

Category

hierarchy ancestor	Cryptographic Algorithm with Weak Hash (C#) Inadequate Salt (C#) Insecure Key Derivation (C#) Weak Hash Algorithm (C#) Weak Hash Algorithm Field (C#)

CWE:960 SFP Secondary Cluster: Ambiguous Exception Type

Category

hierarchy ancestor	Generic Exception Handler (C#)

CWE:961 SFP Secondary Cluster: Incorrect Exception Behavior

Category

hierarchy ancestor

CWE:962 SFP Secondary Cluster: Unchecked Status Condition

Category

hierarchy ancestor

CWE:963 SFP Secondary Cluster: Exposed Data

Category

hierarchy ancestor

CWE:966 SFP Secondary Cluster: Other Exposures

Category

hierarchy ancestor	Insecure Cookie (C#)

CWE:971 SFP Secondary Cluster: Faulty Pointer Use

Category

hierarchy ancestor

CWE:975 SFP Secondary Cluster: Architecture

Category

hierarchy ancestor

CWE:977 SFP Secondary Cluster: Design

Category

hierarchy ancestor

CWE:978 SFP Secondary Cluster: Implementation

Category

hierarchy ancestor

CWE:980 SFP Secondary Cluster: Link in Resource Name Resolution

Category

hierarchy ancestor	DLL Injection (C#) Insecure XSLT Execution (C#) Open Redirect (C#) Possible XML External Entity Reference (C#) Reflection Injection (C#) Tainted URL (C#)

CWE:981 SFP Secondary Cluster: Path Traversal

Category

hierarchy ancestor	DLL Injection (C#) Tainted Path (C#)

CWE:982 SFP Secondary Cluster: Failure to Release Resource

Category

hierarchy ancestor	Closeable Not Closed (C#) Unused Object (C#)

CWE:983 SFP Secondary Cluster: Faulty Resource Use

Category

hierarchy ancestor	Unsafe Session Expiration Time (C#)

CWE:984 SFP Secondary Cluster: Life Cycle

Category

hierarchy ancestor

CWE:985 SFP Secondary Cluster: Unrestricted Consumption

Category

hierarchy ancestor	Closeable Not Stored (C#) Potential Infinite Recursion (C#) Single-use Random Number Generator (C#) Tainted Allocation Size (C#) Unused Object (C#)

CWE:986 SFP Secondary Cluster: Missing Lock

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:987 SFP Secondary Cluster: Multiple Locks/Unlocks

Category

hierarchy ancestor	Useless Synchronization (C#)

CWE:989 SFP Secondary Cluster: Unrestricted Lock

Category

hierarchy ancestor	Synchronization on Interned String (C#)

CWE:990 SFP Secondary Cluster: Tainted Input to Command

Category

hierarchy ancestor

CWE:991 SFP Secondary Cluster: Tainted Input to Environment

Category

hierarchy ancestor	Code Injection (C#) DLL Injection (C#) Mutable Constant Field (C#) Mutable Enumeration (C#) Mutable Public Static Final Array (C#) Reflection Injection (C#) Tainted Expression Evaluation (C#)

CWE:992 SFP Secondary Cluster: Faulty Input Transformation

Category

hierarchy ancestor	Tainted Log (C#)

CWE:994 SFP Secondary Cluster: Tainted Input to Variable

Category

hierarchy ancestor	Cast: int Computation to long (C#) DLL Injection (C#) Disabled Input Validation (C#) Format String Injection (C#) Reflection Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#)

CWE:997 SFP Secondary Cluster: Information Loss

Category

hierarchy ancestor	Generic Exception Handler (C#)

CWE:998 SFP Secondary Cluster: Glitch in Computation

Category

hierarchy ancestor

CWE:1000 Research Concepts

View

hierarchy ancestor

CWE:1001 SFP Secondary Cluster: Use of an Improper API

Category

hierarchy ancestor

CWE:1002 SFP Secondary Cluster: Unexpected Entry Points

Category

hierarchy ancestor	Class Enables Debug Features (C#) Debug Call (C#) Method Enables Debug Features (C#) Method Should be final (C#) Mutable Public Static Final Array (C#) clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:1003 Weaknesses for Simplified Mapping of Published Vulnerabilities

View

hierarchy ancestor

CWE:1005 7PK - Input Validation and Representation

Category

hierarchy ancestor	Cast: int Computation to long (C#) Command Injection (C#) Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#) DLL Injection (C#) Disabled Input Validation (C#) Format String Injection (C#) Reflection Injection (C#) SQL Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#) Tainted Regular Expression (C#)

CWE:1006 Bad Coding Practices

Category

hierarchy ancestor

CWE:1008 Architectural Concepts

View

hierarchy ancestor

CWE:1009 Audit

Category

hierarchy ancestor	Tainted Log (C#)

CWE:1010 Authenticate Actors

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Inadequate Salt (C#) Missing Authentication Annotation (C#) Password in Property File (C#)

CWE:1011 Authorize Actors

Category

hierarchy ancestor

CWE:1012 Cross Cutting

Category

hierarchy ancestor

CWE:1013 Encrypt Data

Category

hierarchy ancestor

CWE:1015 Limit Access

Category

hierarchy ancestor	DLL Injection (C#) Exception Information Disclosure (C#) Insecure XSLT Execution (C#) Open Redirect (C#) Possible XML External Entity Reference (C#) Reflection Injection (C#) Tainted URL (C#)

CWE:1016 Limit Exposure

Category

hierarchy ancestor	Exception Information Disclosure (C#)

CWE:1018 Manage User Sessions

Category

hierarchy ancestor	Unsafe Session Expiration Time (C#)

CWE:1019 Validate Inputs

Category

hierarchy ancestor

CWE:1020 Verify Message Integrity

Category

hierarchy ancestor

CWE:1023 Incomplete Comparison with Missing Factors

Weakness

closely mapped	Missing Equals Override (C#)

CWE:1024 Comparison of Incompatible Types

Weakness

closely mapped	== Always Fails Because Types Always Different (C#)

CWE:1025 Comparison Using Wrong Factors

Weakness

hierarchy ancestor	Comparison to Class Names (C#) Comparison to Empty String (C#) Non-Object compareTo Parameter (C#) Should Use equals() Instead of == (C#) equals Parameter Should Be Object (C#) equals on Array (C#)

CWE:1026 Weaknesses in OWASP Top Ten (2017)

View

hierarchy ancestor

CWE:1027 OWASP Top Ten 2017 Category A1 - Injection

Category

hierarchy ancestor

CWE:1028 OWASP Top Ten 2017 Category A2 - Broken Authentication

Category

hierarchy ancestor

CWE:1029 OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure

Category

hierarchy ancestor

CWE:1030 OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)

Category

hierarchy ancestor	Insecure XSLT Execution (C#) Possible XML External Entity Reference (C#)

CWE:1031 OWASP Top Ten 2017 Category A5 - Broken Access Control

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Disabled Input Validation (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Method Disables Security Setting (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Security Annotation Conflict (C#) Tainted Path (C#)

CWE:1032 OWASP Top Ten 2017 Category A6 - Security Misconfiguration

Category

hierarchy ancestor	Exception Information Disclosure (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#)

CWE:1033 OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (C#) Cross Site Scripting In Error Message Web Page (C#)

CWE:1034 OWASP Top Ten 2017 Category A8 - Insecure Deserialization

Category

hierarchy ancestor	Deserializable Class (C#)

CWE:1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Category

hierarchy ancestor	Deprecated Cryptography Provider (C#) Deprecated Transfer Protocol (C#)

CWE:1040 Quality Weaknesses with Indirect Security Impacts

View

hierarchy ancestor

CWE:1041 Use of Redundant Code

Weakness

closely mapped	Copy-Paste Error

CWE:1061 Insufficient Encapsulation

Weakness

closely mapped	Field Too Visible (C#) Method Should be private (C#) Static Field Too Visible (C#)

CWE:1071 Empty Code Block

Weakness

closely mapped	Empty Branch Statement (C#)
hierarchy ancestor	Useless Synchronization (C#)

CWE:1076 Insufficient Adherence to Expected Conventions

Weakness

closely mapped	Ambiguous Call from Inner Class (C#) Inappropriate Instanceof (C#) Shadowed Identifier (C#) compareTo in Non-Comparable Class (C#) equals Parameter Should Be Object (C#)
hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Hardcoded Filename (C#) Hardcoded IP Address (C#) Non-Object compareTo Parameter (C#)

CWE:1077 Floating Point Comparison with Incorrect Operator

Weakness

closely mapped	Floating Point Equality (C#)

CWE:1078 Inappropriate Source Code Style or Formatting

Weakness

closely mapped	Approximate e Constant (C#) Approximate pi Constant (C#)
hierarchy ancestor	Hardcoded Filename (C#) Hardcoded IP Address (C#)

CWE:1081 Entries with Maintenance Notes

View

hierarchy ancestor

CWE:1097 Persistent Storable Data Element without Associated Comparison Control Element

Weakness

closely mapped	Non-Object compareTo Parameter (C#)
also related	equals Parameter Should Be Object (C#)

CWE:1126 Declaration of Variable with Unnecessarily Wide Scope

Weakness

closely mapped	Unnecessary Field (C#)

CWE:1128 CISQ Quality Measures (2016)

View

hierarchy ancestor

CWE:1129 CISQ Quality Measures (2016) - Reliability

Category

hierarchy ancestor

CWE:1130 CISQ Quality Measures (2016) - Maintainability

Category

hierarchy ancestor	Copy-Paste Error Unreachable Instruction (C#) Unused Class (C#) Unused Method (C#)

CWE:1131 CISQ Quality Measures (2016) - Security

Category

hierarchy ancestor

CWE:1133 Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java

View

hierarchy ancestor

CWE:1134 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor	Command Injection (C#) Format String Injection (C#) Tainted Log (C#)

CWE:1135 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL)

Category

hierarchy ancestor	Empty zip File Archived (C#) Field Never Written (C#) Null Pointer Dereference (C#) Tainted Allocation Size (C#) Useless Assignment (C#) Useless Assignment to Default (C#)

CWE:1136 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)

Category

hierarchy ancestor

CWE:1137 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM)

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#)

CWE:1139 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)

Category

hierarchy ancestor	Comparison to Class Names (C#) clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:1140 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)

Category

hierarchy ancestor

CWE:1141 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR)

Category

hierarchy ancestor

CWE:1142 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:1143 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:1144 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI)

Category

hierarchy ancestor	Synchronous Call to Thread Body (C#)

CWE:1145 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)

Category

hierarchy ancestor	Single-use Random Number Generator (C#) Unused Object (C#)

CWE:1147 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO)

Category

hierarchy ancestor	Closeable Not Closed (C#) Execution After Redirect (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#) Single-use Random Number Generator (C#) Tainted Allocation Size (C#)

CWE:1148 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER)

Category

hierarchy ancestor	Closeable Not Stored (C#) Insecure Cookie (C#) Single-use Random Number Generator (C#) Tainted Allocation Size (C#) Tainted Message (C#) Unused Object (C#)

CWE:1152 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:1154 Weaknesses Addressed by the SEI CERT C Coding Standard

View

hierarchy ancestor

CWE:1157 SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)

Category

hierarchy ancestor

CWE:1158 SEI CERT C Coding Standard - Guidelines 04. Integers (INT)

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#) Risky Class Cast (C#) Risky array store (C#)

CWE:1159 SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#)

CWE:1161 SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR)

Category

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Method Disables Security Setting (C#) Risky Class Cast (C#) Risky array store (C#)

CWE:1162 SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)

Category

hierarchy ancestor	Cast: int Computation to long (C#) Closeable Not Closed (C#) Tainted Allocation Size (C#) Unsafe Session Expiration Time (C#) Unused Object (C#)

CWE:1163 SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)

Category

hierarchy ancestor

CWE:1164 Irrelevant Code

Weakness

closely mapped	Field Never Read (C#) Redundant Call for String Argument (C#) Static Field Assigned Non-Static (C#) Unused Field (C#) Unused Object (C#) Useless Class Cast (C#) Useless null Test (C#) Useless null Test of Field (C#) Useless null Test of Parameter (C#)
hierarchy ancestor	Empty Branch Statement (C#) Unnecessary Field (C#) Unreachable Instruction (C#) Unused Class (C#) Unused Method (C#) Unused Value: Actual Parameter (C#) Unused Value: Variable (C#) Unused Value: Write to Parameter (C#) Useless Synchronization (C#)

CWE:1165 SEI CERT C Coding Standard - Guidelines 10. Environment (ENV)

Category

hierarchy ancestor	Command Injection (C#) Execution After Redirect (C#) Generic Exception Handler (C#) Inappropriate Exception Handler (C#) Method Disables Security Setting (C#)

CWE:1166 SEI CERT C Coding Standard - Guidelines 11. Signals (SIG)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:1167 SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)

Category

hierarchy ancestor	Call Might Return Null (C#) Field Never Written (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#) Method Disables Security Setting (C#) Method Should Not Return null (C#) Null Pointer Dereference (C#) Useless null Test of Return Value (C#)

CWE:1169 SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON)

Category

hierarchy ancestor

CWE:1170 SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:1171 SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)

Category

hierarchy ancestor	Blocking in Critical Section (C#) Call Might Return Null (C#) Double-Checked Locking (C#) Ignored Return Value (C#) Ignored Return Value for Pure Function (C#) Impossible Client Side Locking (C#) Method Should Not Return null (C#) Null Pointer Dereference (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Useless null Test of Return Value (C#)

CWE:1176 Inefficient CPU Computation

Weakness

closely mapped	Single-use Random Number Generator (C#)

CWE:1177 Use of Prohibited Code

Weakness

hierarchy ancestor	Method Disables Security Setting (C#)

CWE:1178 Weaknesses Addressed by the SEI CERT Perl Coding Standard

View

hierarchy ancestor

CWE:1179 SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor	Command Injection (C#) Format String Injection (C#) Tainted Allocation Size (C#) Tainted Expression Evaluation (C#) Tainted Log (C#) Tainted Path (C#) Tainted Regular Expression (C#)

CWE:1180 SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL)

Category

hierarchy ancestor	Copy-Paste Error Debug Warning (C#) Field Never Written (C#) Method Names Differ Only in Case (C#) Non-overriding Method Signature (C#) Null Pointer Dereference (C#)

CWE:1181 SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP)

Category

hierarchy ancestor

CWE:1182 SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT)

Category

hierarchy ancestor	Approximate e Constant (C#) Approximate pi Constant (C#) Cast: Integer to Floating Point (C#) Cast: int Computation to long (C#)

CWE:1186 SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)

Category

hierarchy ancestor	Unnecessary Field (C#) Unreachable Instruction (C#) Unused Class (C#) Unused Method (C#) Unused Value: Actual Parameter (C#) Unused Value: Variable (C#) Unused Value: Write to Parameter (C#)

CWE:1194 Hardware Design

View

hierarchy ancestor	Insecure Cookie (C#) Missing Required Cryptographic Step (C#) Tainted Message (C#) toString on Array (C#)

CWE:1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors

View

hierarchy ancestor

CWE:1204 Generation of Weak Initialization Vector (IV)

Weakness

closely mapped	Weak Initialization Vector Field (C#) Weak Initialization Vector Value (C#)

CWE:1205 Security Primitives and Cryptography Issues

Category

hierarchy ancestor	Missing Required Cryptographic Step (C#)

CWE:1207 Debug and Test Problems

Category

hierarchy ancestor	Insecure Cookie (C#) Tainted Message (C#)

CWE:1208 Cross-Cutting Problems

Category

hierarchy ancestor	toString on Array (C#)

CWE:1210 Audit / Logging Errors

Category

hierarchy ancestor	Tainted Log (C#)

CWE:1213 Random Number Issues

Category

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Use of Same Seed (C#) Weak Cryptographic Value (C#)

CWE:1217 User Session Errors

Category

hierarchy ancestor	Unsafe Session Expiration Time (C#)

CWE:1219 File Handling Issues

Category

hierarchy ancestor	Tainted Path (C#)

CWE:1228 API / Function Errors

Category

hierarchy ancestor	Debug Warning (C#) Method Disables Security Setting (C#) Security Annotation Conflict (C#)

CWE:1305 CISQ Quality Measures (2020)

View

hierarchy ancestor

CWE:1306 CISQ Quality Measures - Reliability

Category

hierarchy ancestor

CWE:1307 CISQ Quality Measures - Maintainability

Category

hierarchy ancestor

CWE:1308 CISQ Quality Measures - Security

Category

hierarchy ancestor

CWE:1309 CISQ Quality Measures - Efficiency

Category

hierarchy ancestor	Closeable Not Closed (C#)

CWE:1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1339 Insufficient Precision or Accuracy of a Real Number

Weakness

closely mapped	Approximate e Constant (C#) Approximate pi Constant (C#)

CWE:1340 CISQ Data Protection Measures

View

hierarchy ancestor

CWE:1344 Weaknesses in OWASP Top Ten (2021)

View

hierarchy ancestor

CWE:1345 OWASP Top Ten 2021 Category A01:2021 - Broken Access Control

Category

hierarchy ancestor

CWE:1346 OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures

Category

hierarchy ancestor

CWE:1347 OWASP Top Ten 2021 Category A03:2021 - Injection

Category

hierarchy ancestor

CWE:1348 OWASP Top Ten 2021 Category A04:2021 - Insecure Design

Category

hierarchy ancestor	DLL Injection (C#) Exception Information Disclosure (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Insecure Cookie (C#) Password in Property File (C#) Tainted Allocation Size (C#) Tainted Bundle (C#) Tainted Message (C#) Tainted Session (C#)

CWE:1349 OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration

Category

hierarchy ancestor	Exception Information Disclosure (C#) Generic Exception Handler (C#) Hardcoded Filename (C#) Hardcoded IP Address (C#) Inappropriate Exception Handler (C#) Insecure Cookie (C#) Insecure XSLT Execution (C#) Possible XML External Entity Reference (C#)

CWE:1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1352 OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components

Category

hierarchy ancestor	Deprecated Cryptography Provider (C#) Deprecated Transfer Protocol (C#)

CWE:1353 OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures

Category

hierarchy ancestor

CWE:1354 OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures

Category

hierarchy ancestor	Deserializable Class (C#) Reflection Bypasses Member Accessibility (C#) Reflection Modifies Member Accessibility (C#)

CWE:1355 OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures

Category

hierarchy ancestor	Tainted Log (C#)

CWE:1358 Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS

View

hierarchy ancestor

CWE:1359 ICS Communications

Category

hierarchy ancestor

CWE:1360 ICS Dependencies (& Architecture)

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) DLL Injection (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Insecure XSLT Execution (C#) Missing Authentication Annotation (C#) Open Redirect (C#) Password in Property File (C#) Possible XML External Entity Reference (C#) Reflection Injection (C#) Tainted URL (C#) toString on Array (C#)

CWE:1361 ICS Supply Chain

Category

hierarchy ancestor

CWE:1362 ICS Engineering (Constructions/Deployment)

Category

hierarchy ancestor

CWE:1363 ICS Operations (& Maintenance)

Category

hierarchy ancestor

CWE:1364 ICS Communications: Zone Boundary Failures

Category

hierarchy ancestor

CWE:1366 ICS Communications: Frail Security in Protocols

Category

hierarchy ancestor

CWE:1368 ICS Dependencies (& Architecture): External Digital Systems

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) DLL Injection (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Insecure XSLT Execution (C#) Missing Authentication Annotation (C#) Open Redirect (C#) Password in Property File (C#) Possible XML External Entity Reference (C#) Reflection Injection (C#) Tainted URL (C#) toString on Array (C#)

CWE:1369 ICS Supply Chain: IT/OT Convergence/Expansion

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Security Annotation Conflict (C#)

CWE:1370 ICS Supply Chain: Common Mode Frailties

Category

hierarchy ancestor

CWE:1371 ICS Supply Chain: Poorly Documented or Undocumented Features

Category

hierarchy ancestor	Class Enables Debug Features (C#) Debug Call (C#) Method Enables Debug Features (C#)

CWE:1372 ICS Supply Chain: OT Counterfeit and Malicious Corruption

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Missing Authentication Annotation (C#) Password in Property File (C#) Security Annotation Conflict (C#)

CWE:1375 ICS Engineering (Construction/Deployment): Gaps in Details/Data

Category

hierarchy ancestor

CWE:1382 ICS Operations (& Maintenance): Emerging Energy Technologies

Category

hierarchy ancestor	Cast: int Computation to long (C#) DLL Injection (C#) Disabled Input Validation (C#) Format String Injection (C#) Open Redirect (C#) Reflection Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#) Tainted URL (C#)

CWE:1383 ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements

Category

hierarchy ancestor

CWE:1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1390 Weak Authentication

Weakness

closely mapped	Anonymous LDAP Authentication (C#)
hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Password in Property File (C#)

CWE:1391 Use of Weak Credentials

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#)

CWE:1396 Comprehensive Categorization: Access Control

Category

hierarchy ancestor	Anonymous LDAP Authentication (C#) Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hostname in Condition (C#) Insecure XSLT Execution (C#) Missing Authentication Annotation (C#) Open Redirect (C#) Password in Property File (C#) Possible XML External Entity Reference (C#) Security Annotation Conflict (C#) Tainted URL (C#) Unsafe Session Expiration Time (C#)

CWE:1397 Comprehensive Categorization: Comparison

Category

hierarchy ancestor

CWE:1398 Comprehensive Categorization: Component Interaction

Category

hierarchy ancestor	Tainted HTTP Response (C#)

CWE:1399 Comprehensive Categorization: Memory Safety

Category

hierarchy ancestor	Format String Injection (C#) Method Should Not Return null (C#) Tainted Allocation Size (C#)

CWE:1400 Comprehensive Categorization for Software Assurance Trends

View

hierarchy ancestor

CWE:1401 Comprehensive Categorization: Concurrency

Category

hierarchy ancestor	Blocking in Critical Section (C#) Double-Checked Locking (C#) Impossible Client Side Locking (C#) Missing synchronized Statement (C#) Synchronization on Interned String (C#) Synchronization on static (C#) Synchronous Call to Thread Body (C#) Unguarded Field (C#) Unguarded Method (C#) Unguarded Parameter (C#) Useless volatile Modifier (C#)

CWE:1402 Comprehensive Categorization: Encryption

Category

hierarchy ancestor

CWE:1403 Comprehensive Categorization: Exposed Resource

Category

hierarchy ancestor	DLL Injection (C#) Exception Information Disclosure (C#) Format String Injection (C#) Method Should be final (C#) Mutable Public Static Final Array (C#) Password in Property File (C#) Tainted Path (C#) clone Non-cloneable (C#) clone Subclass of Non-clonable (C#) clone not final (C#)

CWE:1404 Comprehensive Categorization: File Handling

Category

hierarchy ancestor	Tainted Path (C#)

CWE:1405 Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions

Category

hierarchy ancestor

CWE:1406 Comprehensive Categorization: Improper Input Validation

Category

hierarchy ancestor	Cast: int Computation to long (C#) DLL Injection (C#) Disabled Input Validation (C#) Format String Injection (C#) Reflection Injection (C#) Tainted HTTP Response (C#) Tainted Log (C#)

CWE:1407 Comprehensive Categorization: Improper Neutralization

Category

hierarchy ancestor

CWE:1408 Comprehensive Categorization: Incorrect Calculation

Category

hierarchy ancestor	Abs on random (C#) Approximate e Constant (C#) Approximate pi Constant (C#) Cast: int Computation to long (C#)

CWE:1409 Comprehensive Categorization: Injection

Category

hierarchy ancestor

CWE:1410 Comprehensive Categorization: Insufficient Control Flow Management

Category

hierarchy ancestor

CWE:1412 Comprehensive Categorization: Poor Coding Practices

Category

hierarchy ancestor

CWE:1413 Comprehensive Categorization: Protection Mechanism Failure

Category

hierarchy ancestor

CWE:1414 Comprehensive Categorization: Randomness

Category

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#) Hardcoded Random Seed (C#) Insecure Random Number Generator (C#) Legacy Random Generator (C#) Use of Same Seed (C#) Weak Cryptographic Value (C#) Weak Initialization Vector Field (C#) Weak Initialization Vector Value (C#)

CWE:1415 Comprehensive Categorization: Resource Control

Category

hierarchy ancestor	Reflection Bypasses Member Accessibility (C#) Reflection Injection (C#) Reflection Modifies Member Accessibility (C#) Unsafe Session Expiration Time (C#)

CWE:1416 Comprehensive Categorization: Resource Lifecycle Management

Category

hierarchy ancestor

CWE:1417 Comprehensive Categorization: Sensitive Information Exposure

Category

hierarchy ancestor	Exception Information Disclosure (C#)

CWE:1418 Comprehensive Categorization: Violation of Secure Design Principles

Category

hierarchy ancestor	Hardcoded Cryptographic Key (C#) Hardcoded Password (C#)

CWE:1424 Weaknesses Addressed by ISA/IEC 62443 Requirements

View

hierarchy ancestor

CWE:1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1430 Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:2000 Comprehensive CWE Dictionary

View

hierarchy ancestor