Broad CWE Mapping: CWE IDs Detected by CodeSonar in Java

JavaScript is not currently enabled, but is required for full CodeSonar manual search and browse functionality.

If you are viewing this file in your hub's Web GUI, enable JavaScript in your browser: you will also need it for GUI functionality.

If you opened this file directly from disk, your browser may be directly suppressing JavaScript functionality: certain browsers perform this suppression on local files (but not files delivered by web servers) for security reasons.

If you access the manual through the hub's Web GUI, the functionality will not be suppressed because the hub is a web server.
Alternatively, your browser may allow you to explicitly disable the security setting that suppresses functionality. See the CodeSonar FAQ for more information.

CodeSonar^® 9.0p0 Hot Tips

CONFIDENTIAL

CodeSecure Inc

CWE IDs Detected by CodeSonar in Java Code

This table contains close and broad CWE mappings for CodeSonar Java warning classes, organized by CWE ID.

CWE mappings organized by CodeSonar Java warning class: close mapping, broad mapping.
Mappings between CWE IDs and CodeSonar warning classes, all languages: close mapping, broad mapping.
CWE mapping information for CodeSonar in CSV format: CWE-mapping-broad.csv (broad mapping); CWE-mapping.csv (close mapping).

This version of CodeSonar (9.0p0) uses CWE 4.16, published November 19, 2024.

Close Mapping
Broad Mapping

Close Mapping

CWE	Entity Type	Java Warning Classes
CWE:22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	Weakness	Tainted Path (Java)
CWE:74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')	Weakness	Android URL Injection (Java) DLL Injection (Java) DOS Injection (Java) Tainted @Trusted Value (Java) Tainted Control (Java) Tainted Data in Vulnerable Method (Java) Tainted Hardware Device Property (Java) Tainted Network Address (Java) Tainted Resource (Java) Tainted URL (Java) Tainted XAML (Java) Tainted XML (Java)
CWE:78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	Weakness	Command Injection (Java)
CWE:79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Weakness	Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java)
CWE:81 Improper Neutralization of Script in an Error Message Web Page	Weakness	Cross Site Scripting In Error Message Web Page (Java)
CWE:89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Weakness	SQL Injection (Java)
CWE:90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')	Weakness	Tainted LDAP Attribute (Java) Tainted LDAP Filter (Java)
CWE:94 Improper Control of Generation of Code ('Code Injection')	Weakness	Code Injection (Java)
CWE:95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')	Weakness	Tainted Expression Evaluation (Java)
CWE:103 Struts: Incomplete validate() Method Definition	Weakness	Missing Call to super (Java)
CWE:113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')	Weakness	Tainted HTTP Response (Java)
CWE:114 Process Control	Weakness	DLL Injection (Java)
CWE:117 Improper Output Neutralization for Logs	Weakness	Tainted Log (Java)
CWE:134 Use of Externally-Controlled Format String	Weakness	Format String Injection (Java)
CWE:190 Integer Overflow or Wraparound	Weakness	Cast: int Computation to long (Java)
CWE:191 Integer Underflow (Wrap or Wraparound)	Weakness	Cast: int Computation to long (Java)
CWE:192 Integer Coercion Error	Weakness	Cast: Integer to Floating Point (Java)
CWE:197 Numeric Truncation Error	Weakness	Approximate e Constant (Java) Approximate pi Constant (Java)
CWE:200 Exposure of Sensitive Information to an Unauthorized Actor	Weakness	Use of Hardware ID (Java)
CWE:209 Generation of Error Message Containing Sensitive Information	Weakness	Debug Warning (Java)
CWE:252 Unchecked Return Value	Weakness	Call Might Return Null (Java) Ignored Return Value (Java) Ignored Return Value for Pure Function (Java)
CWE:253 Incorrect Check of Function Return Value	Weakness	Useless null Test of Return Value (Java)
CWE:259 Use of Hard-coded Password	Weakness	Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)
CWE:287 Improper Authentication	Weakness	Hostname in Condition (Java) Ineffective Cleansing of Fragment Taint (Java) Insecure verifier Override for Hostname (Java) Missing Authentication Annotation (Java) Use of Insecure verify for Hostname (Java)
CWE:295 Improper Certificate Validation	Weakness	Insecure Socket Factory (Java) Insecure verify Override for Certificate (Java) Untrusted Network Host (Java) Use of Insecure verify for Certificate (Java)
CWE:319 Cleartext Transmission of Sensitive Information	Weakness	Android Message Injection (Java) Tainted Message (Java)
CWE:321 Use of Hard-coded Cryptographic Key	Weakness	Hardcoded Cryptographic Key (Java)
CWE:325 Missing Cryptographic Step	Weakness	Missing Required Cryptographic Step (Java)
CWE:326 Inadequate Encryption Strength	Weakness	Insecure Key Derivation (Java)
CWE:327 Use of a Broken or Risky Cryptographic Algorithm	Weakness	Cryptographic Algorithm with Risky Default Cipher (Java) Cryptographic Algorithm with Weak Cipher (Java) Deprecated Cryptography Provider (Java) Risky Cipher Algorithm (Java) Risky Cipher Field (Java) Risky Cryptographic Algorithm (Java) Risky Cryptographic Field (Java) Unsafe Base64 Encoding (Java)
CWE:328 Use of Weak Hash	Weakness	Cryptographic Algorithm with Weak Hash (Java) Weak Hash Algorithm (Java) Weak Hash Algorithm Field (Java)
CWE:330 Use of Insufficiently Random Values	Weakness	Hardcoded Random Seed (Java) Insecure Random Number Generator (Java) Legacy Random Generator (Java)
CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)	Weakness	Use of Same Seed (Java)
CWE:338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	Weakness	Weak Cryptographic Value (Java)
CWE:349 Acceptance of Extraneous Untrusted Data With Trusted Data	Weakness	Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java)
CWE:366 Race Condition within a Thread	Weakness	Double-Checked Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)
CWE:382 J2EE Bad Practices: Use of System.exit()	Weakness	Debug Call (Java)
CWE:383 J2EE Bad Practices: Direct Use of Threads	Weakness	Direct Thread Usage in Http Servlet (Java)
CWE:390 Detection of Error Condition Without Action	Weakness	Empty Exception Handler (Java)
CWE:395 Use of NullPointerException Catch to Detect NULL Pointer Dereference	Weakness	Inappropriate Exception Handler (Java)
CWE:396 Declaration of Catch for Generic Exception	Weakness	Generic Exception Handler (Java)
CWE:397 Declaration of Throws for Generic Exception	Weakness	Broad Throws Clause (Java)
CWE:400 Uncontrolled Resource Consumption	Weakness	Closeable Not Stored (Java) Inefficient Instantiation (Java)
CWE:412 Unrestricted Externally Accessible Lock	Weakness	Synchronization on Interned String (Java)
CWE:413 Improper Resource Locking	Weakness	Impossible Client Side Locking (Java) Synchronization on static (Java)
CWE:440 Expected Behavior Violation	Weakness	toString on Array (Java)
CWE:456 Missing Initialization of a Variable	Weakness	Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java)
CWE:470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')	Weakness	Fragment Injection (Java) Reflection Injection (Java)
CWE:476 NULL Pointer Dereference	Weakness	Actual Parameter Element may be null (Java) Field Element may be null (deep) (Java) Field may be null (deep) (Java) Method Should Not Return null (Java) Null Parameter Dereference (Java) Null Pointer Dereference (Java) Null Pointer Dereference (deep) (Java) Return Value may Contain null Element (Java) Return Value may be null (Java) Return null Array (Java) Return null Boolean (Java) Return null Optional (Java) Unchecked Parameter Dereference (Java) Unchecked Parameter Dereference (deep) (Java) Unchecked Parameter Element Dereference (deep) (Java) null Passed to Method (deep) (Java)
CWE:477 Use of Obsolete Function	Weakness	Debug Warning (Java)
CWE:480 Use of Incorrect Operator	Weakness	Bitwise AND on Boolean Constant (Java) Bitwise OR on Boolean Constant (Java) Inefficient Bitwise AND (Java) Inefficient Bitwise OR (Java) Should Use == Instead of equals() (Java)
CWE:481 Assigning instead of Comparing	Weakness	Assignment in Conditional (Java)
CWE:486 Comparison of Classes by Name	Weakness	Comparison to Class Names (Java)
CWE:487 Reliance on Package-level Scope	Weakness	Field Too Visible (Java) Static Field Too Visible (Java)
CWE:489 Active Debug Code	Weakness	Class Enables Debug Features (Java) Debug Call (Java) Method Enables Debug Features (Java)
CWE:491 Public cloneable() Method Without Final ('Object Hijack')	Weakness	clone Non-cloneable (Java) clone Subclass of Non-clonable (Java) clone not final (Java)
CWE:492 Use of Inner Class Containing Sensitive Data	Weakness	Inner Class Should be Static (Java)
CWE:493 Critical Public Variable Without Final Modifier	Weakness	Method Should be final (Java)
CWE:499 Serializable Class Containing Sensitive Data	Weakness	Serialization Not Disabled (Java)
CWE:501 Trust Boundary Violation	Weakness	Tainted Bundle (Java) Tainted Session (Java)
CWE:502 Deserialization of Untrusted Data	Weakness	Deserializable Class (Java) Serialization Not Disabled (Java)
CWE:522 Insufficiently Protected Credentials	Weakness	Password in Property File (Java)
CWE:524 Use of Cache Containing Sensitive Information	Weakness	Sensitive Data Cached (Java)
CWE:537 Java Runtime Error Message Containing Sensitive Information	Weakness	Debug Warning (Java) Exception Information Disclosure (Java)
CWE:538 Insertion of Sensitive Information into Externally-Accessible File or Directory	Weakness	Sensitive Data Written to Local File (Java)
CWE:547 Use of Hard-coded, Security-relevant Constants	Weakness	Hardcoded Filename (Java) Hardcoded IP Address (Java)
CWE:550 Server-generated Error Message Containing Sensitive Information	Weakness	Exception Information Disclosure (Java)
CWE:561 Dead Code	Weakness	Unreachable Instruction (Java) Unused Class (Java) Unused Method (Java)
CWE:563 Assignment to Variable without Use	Weakness	Unnecessary Field (Java) Unused Value: Actual Parameter (Java) Unused Value: Variable (Java) Unused Value: Write to Parameter (Java)
CWE:567 Unsynchronized Access to Shared Data in a Multithreaded Context	Weakness	Missing synchronized Statement (Java) Unguarded Field (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)
CWE:568 finalize() Method Without super.finalize()	Weakness	Missing Call to super (Java)
CWE:570 Expression is Always False	Weakness	Impossible reference comparison (Java) Instanceof Always False (Java) Redundant Condition (Java) equals Always Fails (Java)
CWE:571 Expression is Always True	Weakness	Instanceof Always True (Java) Redundant Condition (Java)
CWE:572 Call to Thread run() instead of start()	Weakness	Synchronous Call to Thread Body (Java)
CWE:573 Improper Following of Specification by Caller	Weakness	Missing Call to super (Java)
CWE:580 clone() Method Without super.clone()	Weakness	Clone Call to Super is Missing (Java) Missing Call to super (Java)
CWE:581 Object Model Violation: Just One of Equals and Hashcode Defined	Weakness	Defines equals but not hashCode (Java) Defines hashCode but not equals (Java)
CWE:582 Array Declared Public, Final, and Static	Weakness	Mutable Public Static Final Array (Java)
CWE:585 Empty Synchronized Block	Weakness	Useless Synchronization (Java)
CWE:586 Explicit Call to Finalize()	Weakness	Explicit Finalize (Java)
CWE:595 Comparison of Object References Instead of Object Contents	Weakness	Should Use equals() Instead of == (Java) equals on Array (Java)
CWE:597 Use of Wrong Operator in String Comparison	Weakness	Comparison to Empty String (Java)
CWE:601 URL Redirection to Untrusted Site ('Open Redirect')	Weakness	Android URL Injection (Java) Open Redirect (Java) Tainted URL (Java)
CWE:607 Public Static Final Field References Mutable Object	Weakness	Mutable Constant Field (Java) Mutable Enumeration (Java) Mutable Public Static Final Array (Java)
CWE:608 Struts: Non-private Field in ActionForm Class	Weakness	Field Too Visible (Java) Static Field Too Visible (Java)
CWE:609 Double-Checked Locking	Weakness	Double-Checked Locking (Java)
CWE:611 Improper Restriction of XML External Entity Reference	Weakness	Insecure XSLT Execution (Java) Possible XML External Entity Reference (Java)
CWE:613 Insufficient Session Expiration	Weakness	Unsafe Session Expiration Time (Java)
CWE:614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute	Weakness	Insecure Cookie (Java)
CWE:624 Executable Regular Expression Error	Weakness	Tainted Regular Expression (Java)
CWE:628 Function Call with Incorrectly Specified Arguments	Weakness	Array Parameter Empty (Java) Method Names Differ Only in Case (Java)
CWE:643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')	Weakness	Tainted Xpath (Java)
CWE:662 Improper Synchronization	Weakness	Useless volatile Modifier (Java)
CWE:664 Improper Control of a Resource Through its Lifetime	Weakness	Android Leak (Java)
CWE:665 Improper Initialization	Weakness	Assertion Contains Side Effects (Java) Useless Assignment (Java) Useless Assignment to Default (Java)
CWE:674 Uncontrolled Recursion	Weakness	Potential Infinite Recursion (Java)
CWE:676 Use of Potentially Dangerous Function	Weakness	Method Disables Security Setting (Java)
CWE:682 Incorrect Calculation	Weakness	Abs on random (Java)
CWE:686 Function Call With Incorrect Argument Type	Weakness	Non-overriding Method Signature (Java)
CWE:697 Incorrect Comparison	Weakness	Asymmetric compareTo (Java) compareTo without equals (Java) compareTo/equals mismatch (Java)
CWE:698 Execution After Redirect (EAR)	Weakness	Execution After Redirect (Java)
CWE:704 Incorrect Type Conversion or Cast	Weakness	Risky Class Cast (Java) Risky array store (Java)
CWE:710 Improper Adherence to Coding Standards	Weakness	Naming Style Violation (Java)
CWE:732 Incorrect Permission Assignment for Critical Resource	Weakness	Accessing File in Permissive Mode (Java) Permissive File Mode (Java)
CWE:749 Exposed Dangerous Method or Function	Weakness	JavaScript Enabled (Java) JavaScript File Access from File URLs (Java) Missing JavaScript Entry Point (Java) Missing JavaScript Execution (Java) Risky JavaScript Interface (Java) Security Annotation Conflict (Java) Universal JavaScript Access to File URLs (Java)
CWE:757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')	Weakness	Deprecated Transfer Protocol (Java)
CWE:766 Critical Data Element Declared Public	Weakness	Field Too Visible (Java) Static Field Too Visible (Java)
CWE:768 Incorrect Short Circuit Evaluation	Weakness	Bitwise AND on Boolean (Java) Bitwise OR on Boolean (Java)
CWE:772 Missing Release of Resource after Effective Lifetime	Weakness	Closeable Not Closed (Java)
CWE:789 Memory Allocation with Excessive Size Value	Weakness	Tainted Allocation Size (Java)
CWE:820 Missing Synchronization	Weakness	Unguarded Method (Java)
CWE:833 Deadlock	Weakness	Blocking in Critical Section (Java)
CWE:909 Missing Initialization of Resource	Weakness	Empty jar File Archived (Java) Empty zip File Archived (Java)
CWE:913 Improper Control of Dynamically-Managed Code Resources	Weakness	Deserializable Class (Java) Deserializing Non-Serializable Class (Java) Insecure Class Loader (Java) Missing Serial Version Field (Java) Nonserializable Field (Java) Nonserializable Field Element (Java) Nonserializable Outer Class (Java) Unexpected Serial Version Field (Java)
CWE:915 Improperly Controlled Modification of Dynamically-Determined Object Attributes	Weakness	Reflection Bypasses Member Accessibility (Java) Reflection Modifies Member Accessibility (Java)
CWE:916 Use of Password Hash With Insufficient Computational Effort	Weakness	Inadequate Salt (Java)
CWE:917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')	Weakness	Tainted Expression Evaluation (Java)
CWE:922 Insecure Storage of Sensitive Information	Weakness	Certificate Added to Root Store (Java)
CWE:1023 Incomplete Comparison with Missing Factors	Weakness	Missing Equals Override (Java)
CWE:1024 Comparison of Incompatible Types	Weakness	== Always Fails Because Types Always Different (Java)
CWE:1041 Use of Redundant Code	Weakness	Copy-Paste Error
CWE:1061 Insufficient Encapsulation	Weakness	Field Too Visible (Java) Method Should be private (Java) Static Field Too Visible (Java)
CWE:1071 Empty Code Block	Weakness	Empty Branch Statement (Java)
CWE:1076 Insufficient Adherence to Expected Conventions	Weakness	Ambiguous Call from Inner Class (Java) Inappropriate Instanceof (Java) Missing Serial Version Field (Java) Shadowed Identifier (Java) compareTo in Non-Comparable Class (Java) equals Parameter Should Be Object (Java)
CWE:1077 Floating Point Comparison with Incorrect Operator	Weakness	Floating Point Equality (Java)
CWE:1078 Inappropriate Source Code Style or Formatting	Weakness	Approximate e Constant (Java) Approximate pi Constant (Java)
CWE:1097 Persistent Storable Data Element without Associated Comparison Control Element	Weakness	Non-Object compareTo Parameter (Java)
CWE:1126 Declaration of Variable with Unnecessarily Wide Scope	Weakness	Unnecessary Field (Java)
CWE:1164 Irrelevant Code	Weakness	Field Never Read (Java) Redundant Call for String Argument (Java) Redundant Implements Clause (Java) Static Field Assigned Non-Static (Java) Unused Field (Java) Unused Object (Java) Useless Class Cast (Java) Useless null Test (Java) Useless null Test of Field (Java) Useless null Test of Parameter (Java)
CWE:1173 Improper Use of Validation Framework	Weakness	Missing isValidFragment Override (Java)
CWE:1176 Inefficient CPU Computation	Weakness	Single-use Random Number Generator (Java)
CWE:1204 Generation of Weak Initialization Vector (IV)	Weakness	Weak Initialization Vector Field (Java) Weak Initialization Vector Value (Java)
CWE:1339 Insufficient Precision or Accuracy of a Real Number	Weakness	Approximate e Constant (Java) Approximate pi Constant (Java)
CWE:1390 Weak Authentication	Weakness	Anonymous LDAP Authentication (Java) LDAP Authentication Disabled (Java)

Broad Mapping

CWE

Entity Type

Java Warning Classes

CWE:2 7PK - Environment

Category

hierarchy ancestor

CWE:5 J2EE Misconfiguration: Data Transmission Without Encryption

Weakness

also related

CWE:7 J2EE Misconfiguration: Missing Custom Error Page

Weakness

also related	Class Enables Debug Features (Java) Debug Warning (Java) Exception Information Disclosure (Java)

CWE:19 Data Processing Errors

Category

hierarchy ancestor	== Always Fails Because Types Always Different (Java) Android URL Injection (Java) Insecure XSLT Execution (Java) Open Redirect (Java) Possible XML External Entity Reference (Java) Tainted Regular Expression (Java) Tainted URL (Java)

CWE:20 Improper Input Validation

Weakness

hierarchy ancestor	Cast: int Computation to long (Java) DLL Injection (Java) Format String Injection (Java) Fragment Injection (Java) Missing Call to super (Java) Missing isValidFragment Override (Java) Reflection Injection (Java) Tainted HTTP Response (Java) Tainted Log (Java)

CWE:22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Weakness

closely mapped	Tainted Path (Java)

CWE:73 External Control of File Name or Path

Weakness

hierarchy ancestor	DLL Injection (Java)

CWE:74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Weakness

closely mapped	Android URL Injection (Java) DLL Injection (Java) DOS Injection (Java) Tainted @Trusted Value (Java) Tainted Control (Java) Tainted Data in Vulnerable Method (Java) Tainted Hardware Device Property (Java) Tainted Network Address (Java) Tainted Resource (Java) Tainted URL (Java) Tainted XAML (Java) Tainted XML (Java)
hierarchy ancestor	Code Injection (Java) Command Injection (Java) Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java) SQL Injection (Java) Tainted Expression Evaluation (Java) Tainted HTTP Response (Java) Tainted LDAP Attribute (Java) Tainted LDAP Filter (Java) Tainted Regular Expression (Java) Tainted Xpath (Java)

CWE:77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Weakness

hierarchy ancestor	Command Injection (Java) Tainted Expression Evaluation (Java) Tainted Regular Expression (Java)

CWE:78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Weakness

closely mapped	Command Injection (Java)

CWE:79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Weakness

closely mapped	Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java)

CWE:81 Improper Neutralization of Script in an Error Message Web Page

Weakness

closely mapped	Cross Site Scripting In Error Message Web Page (Java)

CWE:89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Weakness

closely mapped	SQL Injection (Java)

CWE:90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Weakness

closely mapped	Tainted LDAP Attribute (Java) Tainted LDAP Filter (Java)

CWE:91 XML Injection (aka Blind XPath Injection)

Weakness

hierarchy ancestor	Tainted Xpath (Java)

CWE:93 Improper Neutralization of CRLF Sequences ('CRLF Injection')

Weakness

hierarchy ancestor	Tainted HTTP Response (Java)

CWE:94 Improper Control of Generation of Code ('Code Injection')

Weakness

closely mapped	Code Injection (Java)
hierarchy ancestor	Tainted Expression Evaluation (Java)

CWE:95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Weakness

closely mapped	Tainted Expression Evaluation (Java)

CWE:103 Struts: Incomplete validate() Method Definition

Weakness

closely mapped	Missing Call to super (Java)

CWE:113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

Weakness

closely mapped	Tainted HTTP Response (Java)

CWE:114 Process Control

Weakness

closely mapped	DLL Injection (Java)

CWE:116 Improper Encoding or Escaping of Output

Weakness

hierarchy ancestor	Tainted Log (Java)

CWE:117 Improper Output Neutralization for Logs

Weakness

closely mapped	Tainted Log (Java)

CWE:133 String Errors

Category

hierarchy ancestor	Assignment in Conditional (Java) Bitwise AND on Boolean Constant (Java) Bitwise OR on Boolean Constant (Java) Comparison to Empty String (Java) Format String Injection (Java) Inefficient Bitwise AND (Java) Inefficient Bitwise OR (Java) Should Use == Instead of equals() (Java)

CWE:134 Use of Externally-Controlled Format String

Weakness

closely mapped	Format String Injection (Java)

CWE:136 Type Errors

Category

hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java)

CWE:137 Data Neutralization Issues

Category

hierarchy ancestor	Code Injection (Java) Command Injection (Java) Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java) SQL Injection (Java) Tainted Expression Evaluation (Java) Tainted HTTP Response (Java) Tainted LDAP Attribute (Java) Tainted LDAP Filter (Java) Tainted Log (Java) Tainted Xpath (Java)

CWE:189 Numeric Errors

Category

hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java)

CWE:190 Integer Overflow or Wraparound

Weakness

closely mapped	Cast: int Computation to long (Java)

CWE:191 Integer Underflow (Wrap or Wraparound)

Weakness

closely mapped	Cast: int Computation to long (Java)

CWE:192 Integer Coercion Error

Weakness

closely mapped	Cast: Integer to Floating Point (Java)

CWE:197 Numeric Truncation Error

Weakness

closely mapped	Approximate e Constant (Java) Approximate pi Constant (Java)

CWE:199 Information Management Errors

Category

hierarchy ancestor

CWE:200 Exposure of Sensitive Information to an Unauthorized Actor

Weakness

closely mapped	Use of Hardware ID (Java)
hierarchy ancestor	Debug Warning (Java) Exception Information Disclosure (Java) Sensitive Data Written to Local File (Java)

CWE:209 Generation of Error Message Containing Sensitive Information

Weakness

closely mapped	Debug Warning (Java)
hierarchy ancestor	Exception Information Disclosure (Java)

CWE:211 Externally-Generated Error Message Containing Sensitive Information

Weakness

hierarchy ancestor	Debug Warning (Java) Exception Information Disclosure (Java)

CWE:221 Information Loss or Omission

Weakness

hierarchy ancestor	Broad Throws Clause (Java) Generic Exception Handler (Java)

CWE:227 7PK - API Abuse

Category

also related	Non-Object compareTo Parameter (Java)
hierarchy ancestor	Call Might Return Null (Java) Ignored Return Value (Java) Ignored Return Value for Pure Function (Java) Method Should Not Return null (Java)

CWE:252 Unchecked Return Value

Weakness

closely mapped	Call Might Return Null (Java) Ignored Return Value (Java) Ignored Return Value for Pure Function (Java)
hierarchy ancestor	Method Should Not Return null (Java)

CWE:253 Incorrect Check of Function Return Value

Weakness

closely mapped	Useless null Test of Return Value (Java)
also related	Null Pointer Dereference (Java)

CWE:254 7PK - Security Features

Category

hierarchy ancestor

CWE:255 Credentials Management Errors

Category

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Inadequate Salt (Java) Sensitive Data Written to External Storage (Java)

CWE:259 Use of Hard-coded Password

Weakness

closely mapped	Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:265 Privilege Issues

Category

hierarchy ancestor	Clone Call to Super is Missing (Java) Missing Call to super (Java) Tainted Bundle (Java) Tainted Session (Java)

CWE:275 Permission Issues

Category

hierarchy ancestor	Field Too Visible (Java) Static Field Too Visible (Java)

CWE:284 Improper Access Control

Weakness

hierarchy ancestor

CWE:285 Improper Authorization

Weakness

hierarchy ancestor	Accessing File in Permissive Mode (Java) Field Too Visible (Java) Permissive File Mode (Java) Static Field Too Visible (Java)

CWE:287 Improper Authentication

Weakness

closely mapped	Hostname in Condition (Java) Ineffective Cleansing of Fragment Taint (Java) Insecure verifier Override for Hostname (Java) Missing Authentication Annotation (Java) Use of Insecure verify for Hostname (Java)
hierarchy ancestor	Anonymous LDAP Authentication (Java) Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Insecure Socket Factory (Java) Insecure verify Override for Certificate (Java) LDAP Authentication Disabled (Java) Password in Property File (Java) Sensitive Data Written to External Storage (Java) Untrusted Network Host (Java) Use of Insecure verify for Certificate (Java)

CWE:295 Improper Certificate Validation

Weakness

closely mapped	Insecure Socket Factory (Java) Insecure verify Override for Certificate (Java) Untrusted Network Host (Java) Use of Insecure verify for Certificate (Java)

CWE:310 Cryptographic Issues

Category

hierarchy ancestor	Cryptographic Algorithm with Weak Hash (Java) Inadequate Salt (Java) Missing Required Cryptographic Step (Java) Use of Same Seed (Java) Weak Cryptographic Value (Java) Weak Hash Algorithm (Java) Weak Hash Algorithm Field (Java) Weak Initialization Vector Field (Java) Weak Initialization Vector Value (Java)

CWE:311 Missing Encryption of Sensitive Data

Weakness

hierarchy ancestor

CWE:319 Cleartext Transmission of Sensitive Information

Weakness

closely mapped

hierarchy ancestor

CWE:320 Key Management Errors

Category

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:321 Use of Hard-coded Cryptographic Key

Weakness

closely mapped	Hardcoded Cryptographic Key (Java)

CWE:325 Missing Cryptographic Step

Weakness

closely mapped	Missing Required Cryptographic Step (Java)

CWE:326 Inadequate Encryption Strength

Weakness

closely mapped	Insecure Key Derivation (Java)
hierarchy ancestor	Cryptographic Algorithm with Weak Hash (Java) Inadequate Salt (Java) Weak Hash Algorithm (Java) Weak Hash Algorithm Field (Java)

CWE:327 Use of a Broken or Risky Cryptographic Algorithm

Weakness

closely mapped	Cryptographic Algorithm with Risky Default Cipher (Java) Cryptographic Algorithm with Weak Cipher (Java) Deprecated Cryptography Provider (Java) Risky Cipher Algorithm (Java) Risky Cipher Field (Java) Risky Cryptographic Algorithm (Java) Risky Cryptographic Field (Java) Unsafe Base64 Encoding (Java)
hierarchy ancestor	Cryptographic Algorithm with Weak Hash (Java) Inadequate Salt (Java) Weak Hash Algorithm (Java) Weak Hash Algorithm Field (Java)

CWE:328 Use of Weak Hash

Weakness

closely mapped	Cryptographic Algorithm with Weak Hash (Java) Weak Hash Algorithm (Java) Weak Hash Algorithm Field (Java)
hierarchy ancestor	Inadequate Salt (Java)

CWE:330 Use of Insufficiently Random Values

Weakness

closely mapped	Hardcoded Random Seed (Java) Insecure Random Number Generator (Java) Legacy Random Generator (Java)
hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java) Use of Same Seed (Java) Weak Cryptographic Value (Java) Weak Initialization Vector Field (Java) Weak Initialization Vector Value (Java)

CWE:335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

Weakness

hierarchy ancestor	Use of Same Seed (Java)

CWE:336 Same Seed in Pseudo-Random Number Generator (PRNG)

Weakness

closely mapped	Use of Same Seed (Java)

CWE:338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Weakness

closely mapped	Weak Cryptographic Value (Java)

CWE:344 Use of Invariant Value in Dynamically Changing Context

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:345 Insufficient Verification of Data Authenticity

Weakness

hierarchy ancestor	Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java)

CWE:349 Acceptance of Extraneous Untrusted Data With Trusted Data

Weakness

closely mapped	Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java)

CWE:361 7PK - Time and State

Category

hierarchy ancestor	Debug Call (Java) Direct Thread Usage in Http Servlet (Java) Synchronization on Interned String (Java)

CWE:362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Weakness

hierarchy ancestor	Double-Checked Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:366 Race Condition within a Thread

Weakness

closely mapped	Double-Checked Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:382 J2EE Bad Practices: Use of System.exit()

Weakness

closely mapped	Debug Call (Java)

CWE:383 J2EE Bad Practices: Direct Use of Threads

Weakness

closely mapped	Direct Thread Usage in Http Servlet (Java)

CWE:388 7PK - Errors

Category

hierarchy ancestor	Broad Throws Clause (Java) Generic Exception Handler (Java) Inappropriate Exception Handler (Java)

CWE:389 Error Conditions, Return Values, Status Codes

Category

hierarchy ancestor

CWE:390 Detection of Error Condition Without Action

Weakness

closely mapped	Empty Exception Handler (Java)

CWE:392 Missing Report of Error Condition

Weakness

also related	Unused Object (Java)

CWE:395 Use of NullPointerException Catch to Detect NULL Pointer Dereference

Weakness

closely mapped	Inappropriate Exception Handler (Java)

CWE:396 Declaration of Catch for Generic Exception

Weakness

closely mapped	Generic Exception Handler (Java)

CWE:397 Declaration of Throws for Generic Exception

Weakness

closely mapped	Broad Throws Clause (Java)

CWE:398 7PK - Code Quality

Category

also related

hierarchy ancestor

CWE:399 Resource Management Errors

Category

hierarchy ancestor

CWE:400 Uncontrolled Resource Consumption

Weakness

closely mapped	Closeable Not Stored (Java) Inefficient Instantiation (Java)
hierarchy ancestor	Inefficient Box-Unbox (Java) Single-use Random Number Generator (Java) Tainted Allocation Size (Java) Unused Object (Java)

CWE:404 Improper Resource Shutdown or Release

Weakness

hierarchy ancestor	Closeable Not Closed (Java) Missing Call to super (Java)

CWE:405 Asymmetric Resource Consumption (Amplification)

Weakness

hierarchy ancestor	Single-use Random Number Generator (Java)

CWE:411 Resource Locking Problems

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Synchronization on Interned String (Java) Synchronization on static (Java)

CWE:412 Unrestricted Externally Accessible Lock

Weakness

closely mapped	Synchronization on Interned String (Java)

CWE:413 Improper Resource Locking

Weakness

closely mapped	Impossible Client Side Locking (Java) Synchronization on static (Java)

CWE:435 Improper Interaction Between Multiple Correctly-Behaving Entities

Weakness

hierarchy ancestor	Tainted HTTP Response (Java)

CWE:436 Interpretation Conflict

Weakness

hierarchy ancestor	Tainted HTTP Response (Java)

CWE:438 Behavioral Problems

Category

hierarchy ancestor

CWE:440 Expected Behavior Violation

Weakness

closely mapped	toString on Array (Java)

CWE:452 Initialization and Cleanup Errors

Category

hierarchy ancestor	Missing Call to super (Java)

CWE:456 Missing Initialization of a Variable

Weakness

closely mapped	Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java)

CWE:459 Incomplete Cleanup

Weakness

hierarchy ancestor	Missing Call to super (Java)

CWE:465 Pointer Issues

Category

hierarchy ancestor

CWE:470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Weakness

closely mapped	Fragment Injection (Java) Reflection Injection (Java)

CWE:471 Modification of Assumed-Immutable Data (MAID)

Weakness

hierarchy ancestor	Mutable Constant Field (Java) Mutable Enumeration (Java) Mutable Public Static Final Array (Java)

CWE:476 NULL Pointer Dereference

Weakness

closely mapped

CWE:477 Use of Obsolete Function

Weakness

closely mapped	Debug Warning (Java)

CWE:480 Use of Incorrect Operator

Weakness

closely mapped	Bitwise AND on Boolean Constant (Java) Bitwise OR on Boolean Constant (Java) Inefficient Bitwise AND (Java) Inefficient Bitwise OR (Java) Should Use == Instead of equals() (Java)
hierarchy ancestor	Assignment in Conditional (Java) Comparison to Empty String (Java)

CWE:481 Assigning instead of Comparing

Weakness

closely mapped	Assignment in Conditional (Java)

CWE:485 7PK - Encapsulation

Category

also related	Field Too Visible (Java) Method Should be final (Java) Method Should be private (Java) Shadowed Identifier (Java) Static Field Too Visible (Java)
hierarchy ancestor	Class Enables Debug Features (Java) Comparison to Class Names (Java) Debug Call (Java) Inner Class Should be Static (Java) Method Enables Debug Features (Java) Tainted Bundle (Java) Tainted Session (Java) clone Non-cloneable (Java) clone Subclass of Non-clonable (Java) clone not final (Java)

CWE:486 Comparison of Classes by Name

Weakness

closely mapped	Comparison to Class Names (Java)

CWE:487 Reliance on Package-level Scope

Weakness

closely mapped	Field Too Visible (Java) Static Field Too Visible (Java)

CWE:489 Active Debug Code

Weakness

closely mapped	Class Enables Debug Features (Java) Debug Call (Java) Method Enables Debug Features (Java)

CWE:491 Public cloneable() Method Without Final ('Object Hijack')

Weakness

closely mapped	clone Non-cloneable (Java) clone Subclass of Non-clonable (Java) clone not final (Java)

CWE:492 Use of Inner Class Containing Sensitive Data

Weakness

closely mapped	Inner Class Should be Static (Java)

CWE:493 Critical Public Variable Without Final Modifier

Weakness

closely mapped	Method Should be final (Java)
also related	Field Too Visible (Java) Static Field Too Visible (Java)

CWE:495 Private Data Structure Returned From A Public Method

Weakness

also related	Method Should be private (Java)

CWE:496 Public Data Assigned to Private Array-Typed Field

Weakness

also related	Field Too Visible (Java) Method Should be private (Java) Static Field Too Visible (Java)

CWE:498 Cloneable Class Containing Sensitive Information

Weakness

also related

CWE:499 Serializable Class Containing Sensitive Data

Weakness

closely mapped	Serialization Not Disabled (Java)

CWE:501 Trust Boundary Violation

Weakness

closely mapped	Tainted Bundle (Java) Tainted Session (Java)

CWE:502 Deserialization of Untrusted Data

Weakness

closely mapped	Deserializable Class (Java) Serialization Not Disabled (Java)

CWE:522 Insufficiently Protected Credentials

Weakness

closely mapped	Password in Property File (Java)

CWE:524 Use of Cache Containing Sensitive Information

Weakness

closely mapped	Sensitive Data Cached (Java)

CWE:537 Java Runtime Error Message Containing Sensitive Information

Weakness

closely mapped	Debug Warning (Java) Exception Information Disclosure (Java)

CWE:538 Insertion of Sensitive Information into Externally-Accessible File or Directory

Weakness

closely mapped	Sensitive Data Written to Local File (Java)

CWE:543 Use of Singleton Pattern Without Synchronization in a Multithreaded Context

Weakness

also related	Unguarded Method (Java)

CWE:547 Use of Hard-coded, Security-relevant Constants

Weakness

closely mapped	Hardcoded Filename (Java) Hardcoded IP Address (Java)

CWE:550 Server-generated Error Message Containing Sensitive Information

Weakness

closely mapped	Exception Information Disclosure (Java)

CWE:557 Concurrency Issues

Category

hierarchy ancestor	Double-Checked Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:561 Dead Code

Weakness

closely mapped	Unreachable Instruction (Java) Unused Class (Java) Unused Method (Java)

CWE:563 Assignment to Variable without Use

Weakness

closely mapped	Unnecessary Field (Java) Unused Value: Actual Parameter (Java) Unused Value: Variable (Java) Unused Value: Write to Parameter (Java)

CWE:567 Unsynchronized Access to Shared Data in a Multithreaded Context

Weakness

closely mapped	Missing synchronized Statement (Java) Unguarded Field (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:568 finalize() Method Without super.finalize()

Weakness

closely mapped	Missing Call to super (Java)

CWE:569 Expression Issues

Category

hierarchy ancestor

CWE:570 Expression is Always False

Weakness

closely mapped	Impossible reference comparison (Java) Instanceof Always False (Java) Redundant Condition (Java) equals Always Fails (Java)
also related	Useless null Test (Java) Useless null Test of Field (Java) Useless null Test of Parameter (Java)

CWE:571 Expression is Always True

Weakness

closely mapped	Instanceof Always True (Java) Redundant Condition (Java)
also related	Useless null Test (Java) Useless null Test of Field (Java) Useless null Test of Parameter (Java)

CWE:572 Call to Thread run() instead of start()

Weakness

closely mapped	Synchronous Call to Thread Body (Java)

CWE:573 Improper Following of Specification by Caller

Weakness

closely mapped

Missing Call to super (Java)

hierarchy ancestor

CWE:580 clone() Method Without super.clone()

Weakness

closely mapped	Clone Call to Super is Missing (Java) Missing Call to super (Java)

CWE:581 Object Model Violation: Just One of Equals and Hashcode Defined

Weakness

closely mapped	Defines equals but not hashCode (Java) Defines hashCode but not equals (Java)

CWE:582 Array Declared Public, Final, and Static

Weakness

closely mapped	Mutable Public Static Final Array (Java)

CWE:583 finalize() Method Declared Public

Weakness

also related	Method Should be private (Java)

CWE:585 Empty Synchronized Block

Weakness

closely mapped	Useless Synchronization (Java)

CWE:586 Explicit Call to Finalize()

Weakness

closely mapped	Explicit Finalize (Java)

CWE:595 Comparison of Object References Instead of Object Contents

Weakness

closely mapped	Should Use equals() Instead of == (Java) equals on Array (Java)
hierarchy ancestor	Comparison to Empty String (Java) Non-Object compareTo Parameter (Java) equals Parameter Should Be Object (Java)

CWE:597 Use of Wrong Operator in String Comparison

Weakness

closely mapped	Comparison to Empty String (Java)

CWE:601 URL Redirection to Untrusted Site ('Open Redirect')

Weakness

closely mapped	Android URL Injection (Java) Open Redirect (Java) Tainted URL (Java)

CWE:607 Public Static Final Field References Mutable Object

Weakness

closely mapped	Mutable Constant Field (Java) Mutable Enumeration (Java) Mutable Public Static Final Array (Java)

CWE:608 Struts: Non-private Field in ActionForm Class

Weakness

closely mapped	Field Too Visible (Java) Static Field Too Visible (Java)

CWE:609 Double-Checked Locking

Weakness

closely mapped	Double-Checked Locking (Java)

CWE:610 Externally Controlled Reference to a Resource in Another Sphere

Weakness

hierarchy ancestor	Android URL Injection (Java) DLL Injection (Java) Fragment Injection (Java) Insecure XSLT Execution (Java) Open Redirect (Java) Possible XML External Entity Reference (Java) Reflection Injection (Java) Tainted URL (Java)

CWE:611 Improper Restriction of XML External Entity Reference

Weakness

closely mapped	Insecure XSLT Execution (Java) Possible XML External Entity Reference (Java)

CWE:613 Insufficient Session Expiration

Weakness

closely mapped	Unsafe Session Expiration Time (Java)

CWE:614 Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Weakness

closely mapped	Insecure Cookie (Java)

CWE:624 Executable Regular Expression Error

Weakness

closely mapped	Tainted Regular Expression (Java)

CWE:628 Function Call with Incorrectly Specified Arguments

Weakness

closely mapped	Array Parameter Empty (Java) Method Names Differ Only in Case (Java)
hierarchy ancestor	Copy-Paste Error Non-overriding Method Signature (Java)

CWE:629 Weaknesses in OWASP Top Ten (2007)

View

hierarchy ancestor

CWE:635 Weaknesses Originally Used by NVD from 2008 to 2016

View

hierarchy ancestor

CWE:642 External Control of Critical State Data

Weakness

hierarchy ancestor	DLL Injection (Java)

CWE:643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')

Weakness

closely mapped	Tainted Xpath (Java)

CWE:657 Violation of Secure Design Principles

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:658 Weaknesses in Software Written in C

View

hierarchy ancestor

CWE:659 Weaknesses in Software Written in C++

View

hierarchy ancestor

CWE:660 Weaknesses in Software Written in Java

View

hierarchy ancestor

CWE:661 Weaknesses in Software Written in PHP

View

hierarchy ancestor

CWE:662 Improper Synchronization

Weakness

closely mapped	Useless volatile Modifier (Java)
hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:664 Improper Control of a Resource Through its Lifetime

Weakness

closely mapped

Android Leak (Java)

hierarchy ancestor

CWE:665 Improper Initialization

Weakness

closely mapped	Assertion Contains Side Effects (Java) Useless Assignment (Java) Useless Assignment to Default (Java)
hierarchy ancestor	Empty jar File Archived (Java) Empty zip File Archived (Java) Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java) Tainted Allocation Size (Java)

CWE:666 Operation on Resource in Wrong Phase of Lifetime

Weakness

hierarchy ancestor	Unsafe Session Expiration Time (Java)

CWE:667 Improper Locking

Weakness

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Synchronization on Interned String (Java) Synchronization on static (Java)

CWE:668 Exposure of Resource to Wrong Sphere

Weakness

hierarchy ancestor

CWE:670 Always-Incorrect Control Flow Implementation

Weakness

hierarchy ancestor	Assignment in Conditional (Java) Bitwise AND on Boolean Constant (Java) Bitwise OR on Boolean Constant (Java) Comparison to Empty String (Java) Execution After Redirect (Java) Inefficient Bitwise AND (Java) Inefficient Bitwise OR (Java) Should Use == Instead of equals() (Java)

CWE:671 Lack of Administrator Control over Security

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:672 Operation on a Resource after Expiration or Release

Weakness

hierarchy ancestor	Unsafe Session Expiration Time (Java)

CWE:674 Uncontrolled Recursion

Weakness

closely mapped	Potential Infinite Recursion (Java)

CWE:676 Use of Potentially Dangerous Function

Weakness

closely mapped	Method Disables Security Setting (Java)

CWE:677 Weakness Base Elements

View

hierarchy ancestor

CWE:681 Incorrect Conversion between Numeric Types

Weakness

hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java)

CWE:682 Incorrect Calculation

Weakness

closely mapped	Abs on random (Java)
hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: int Computation to long (Java)

CWE:683 Function Call With Incorrect Order of Arguments

Weakness

also related	Copy-Paste Error

CWE:684 Incorrect Provision of Specified Functionality

Weakness

hierarchy ancestor	Unused Object (Java) toString on Array (Java)

CWE:685 Function Call With Incorrect Number of Arguments

Weakness

also related	Copy-Paste Error

CWE:686 Function Call With Incorrect Argument Type

Weakness

closely mapped	Non-overriding Method Signature (Java)

CWE:688 Function Call With Incorrect Variable or Reference as Argument

Weakness

also related	Copy-Paste Error

CWE:690 Unchecked Return Value to NULL Pointer Dereference

Weakness

also related	Method Should Not Return null (Java)

CWE:691 Insufficient Control Flow Management

Weakness

hierarchy ancestor

CWE:693 Protection Mechanism Failure

Weakness

hierarchy ancestor

CWE:695 Use of Low-Level Functionality

Weakness

hierarchy ancestor	Direct Thread Usage in Http Servlet (Java)

CWE:697 Incorrect Comparison

Weakness

closely mapped

hierarchy ancestor

CWE:698 Execution After Redirect (EAR)

Weakness

closely mapped	Execution After Redirect (Java)

CWE:699 Software Development

View

hierarchy ancestor

CWE:700 Seven Pernicious Kingdoms

View

hierarchy ancestor

CWE:701 Weaknesses Introduced During Design

View

hierarchy ancestor

CWE:702 Weaknesses Introduced During Implementation

View

hierarchy ancestor

CWE:703 Improper Check or Handling of Exceptional Conditions

Weakness

hierarchy ancestor

CWE:704 Incorrect Type Conversion or Cast

Weakness

closely mapped	Risky Class Cast (Java) Risky array store (Java)
hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java)

CWE:705 Incorrect Control Flow Scoping

Weakness

hierarchy ancestor	Broad Throws Clause (Java) Debug Call (Java) Execution After Redirect (Java) Generic Exception Handler (Java) Inappropriate Exception Handler (Java)

CWE:706 Use of Incorrectly-Resolved Name or Reference

Weakness

hierarchy ancestor	Tainted Path (Java)

CWE:707 Improper Neutralization

Weakness

hierarchy ancestor

CWE:709 Named Chains

View

hierarchy ancestor	Method Should Not Return null (Java)

CWE:710 Improper Adherence to Coding Standards

Weakness

closely mapped

Naming Style Violation (Java)

hierarchy ancestor

CWE:711 Weaknesses in OWASP Top Ten (2004)

View

hierarchy ancestor

CWE:712 OWASP Top Ten 2007 Category A1 - Cross Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java)

CWE:713 OWASP Top Ten 2007 Category A2 - Injection Flaws

Category

hierarchy ancestor	Command Injection (Java) SQL Injection (Java) Tainted Expression Evaluation (Java) Tainted HTTP Response (Java) Tainted LDAP Attribute (Java) Tainted LDAP Filter (Java) Tainted Regular Expression (Java) Tainted Xpath (Java)

CWE:714 OWASP Top Ten 2007 Category A3 - Malicious File Execution

Category

hierarchy ancestor	Command Injection (Java) Tainted Expression Evaluation (Java)

CWE:715 OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference

Category

hierarchy ancestor	Tainted Path (Java)

CWE:717 OWASP Top Ten 2007 Category A6 - Information Leakage and Improper Error Handling

Category

hierarchy ancestor	Debug Warning (Java) Exception Information Disclosure (Java) Sensitive Data Written to Local File (Java) Use of Hardware ID (Java)

CWE:718 OWASP Top Ten 2007 Category A7 - Broken Authentication and Session Management

Category

hierarchy ancestor

CWE:719 OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage

Category

hierarchy ancestor

CWE:720 OWASP Top Ten 2007 Category A9 - Insecure Communications

Category

hierarchy ancestor

CWE:721 OWASP Top Ten 2007 Category A10 - Failure to Restrict URL Access

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Field Too Visible (Java) Permissive File Mode (Java) Static Field Too Visible (Java)

CWE:722 OWASP Top Ten 2004 Category A1 - Unvalidated Input

Category

hierarchy ancestor

CWE:723 OWASP Top Ten 2004 Category A2 - Broken Access Control

Category

hierarchy ancestor

CWE:724 OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management

Category

hierarchy ancestor

CWE:725 OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws

Category

hierarchy ancestor	Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java)

CWE:726 OWASP Top Ten 2004 Category A5 - Buffer Overflows

Category

hierarchy ancestor	Format String Injection (Java)

CWE:727 OWASP Top Ten 2004 Category A6 - Injection Flaws

Category

hierarchy ancestor

CWE:728 OWASP Top Ten 2004 Category A7 - Improper Error Handling

Category

hierarchy ancestor

CWE:729 OWASP Top Ten 2004 Category A8 - Insecure Storage

Category

hierarchy ancestor

CWE:730 OWASP Top Ten 2004 Category A9 - Denial of Service

Category

hierarchy ancestor

CWE:731 OWASP Top Ten 2004 Category A10 - Insecure Configuration Management

Category

hierarchy ancestor

CWE:732 Incorrect Permission Assignment for Critical Resource

Weakness

closely mapped	Accessing File in Permissive Mode (Java) Permissive File Mode (Java)
hierarchy ancestor	Field Too Visible (Java) Static Field Too Visible (Java)

CWE:734 Weaknesses Addressed by the CERT C Secure Coding Standard (2008)

View

hierarchy ancestor

CWE:735 CERT C Secure Coding Standard (2008) Chapter 2 - Preprocessor (PRE)

Category

hierarchy ancestor	Unused Object (Java) toString on Array (Java)

CWE:736 CERT C Secure Coding Standard (2008) Chapter 3 - Declarations and Initialization (DCL)

Category

hierarchy ancestor	Array Parameter Empty (Java) Copy-Paste Error Hardcoded Filename (Java) Hardcoded IP Address (Java) Method Names Differ Only in Case (Java) Non-overriding Method Signature (Java)

CWE:737 CERT C Secure Coding Standard (2008) Chapter 4 - Expressions (EXP)

Category

hierarchy ancestor

CWE:738 CERT C Secure Coding Standard (2008) Chapter 5 - Integers (INT)

Category

hierarchy ancestor

CWE:739 CERT C Secure Coding Standard (2008) Chapter 6 - Floating Point (FLP)

Category

hierarchy ancestor	Abs on random (Java) Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java) Non-overriding Method Signature (Java)

CWE:740 CERT C Secure Coding Standard (2008) Chapter 7 - Arrays (ARR)

Category

hierarchy ancestor	Assertion Contains Side Effects (Java) Empty jar File Archived (Java) Empty zip File Archived (Java) Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java) Tainted Allocation Size (Java) Useless Assignment (Java) Useless Assignment to Default (Java)

CWE:741 CERT C Secure Coding Standard (2008) Chapter 8 - Characters and Strings (STR)

Category

hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Command Injection (Java) Non-overriding Method Signature (Java) Risky Class Cast (Java) Risky array store (Java)

CWE:742 CERT C Secure Coding Standard (2008) Chapter 9 - Memory Management (MEM)

Category

hierarchy ancestor

CWE:743 CERT C Secure Coding Standard (2008) Chapter 10 - Input Output (FIO)

Category

hierarchy ancestor

CWE:744 CERT C Secure Coding Standard (2008) Chapter 11 - Environment (ENV)

Category

hierarchy ancestor	Broad Throws Clause (Java) Command Injection (Java) Debug Call (Java) Execution After Redirect (Java) Generic Exception Handler (Java) Inappropriate Exception Handler (Java)

CWE:745 CERT C Secure Coding Standard (2008) Chapter 12 - Signals (SIG)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:746 CERT C Secure Coding Standard (2008) Chapter 13 - Error Handling (ERR)

Category

hierarchy ancestor

CWE:747 CERT C Secure Coding Standard (2008) Chapter 14 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:748 CERT C Secure Coding Standard (2008) Appendix - POSIX (POS)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Non-overriding Method Signature (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:749 Exposed Dangerous Method or Function

Weakness

closely mapped	JavaScript Enabled (Java) JavaScript File Access from File URLs (Java) Missing JavaScript Entry Point (Java) Missing JavaScript Execution (Java) Risky JavaScript Interface (Java) Security Annotation Conflict (Java) Universal JavaScript Access to File URLs (Java)

CWE:750 Weaknesses in the 2009 CWE/SANS Top 25 Most Dangerous Programming Errors

View

hierarchy ancestor

CWE:751 2009 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor

CWE:752 2009 Top 25 - Risky Resource Management

Category

hierarchy ancestor

CWE:753 2009 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:754 Improper Check for Unusual or Exceptional Conditions

Weakness

hierarchy ancestor

CWE:755 Improper Handling of Exceptional Conditions

Weakness

hierarchy ancestor	Class Enables Debug Features (Java) Debug Warning (Java) Empty Exception Handler (Java) Exception Information Disclosure (Java) Generic Exception Handler (Java) Inappropriate Exception Handler (Java) Unused Object (Java)

CWE:756 Missing Custom Error Page

Weakness

hierarchy ancestor	Class Enables Debug Features (Java) Debug Warning (Java) Exception Information Disclosure (Java)

CWE:757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')

Weakness

closely mapped	Deprecated Transfer Protocol (Java)

CWE:766 Critical Data Element Declared Public

Weakness

closely mapped	Field Too Visible (Java) Static Field Too Visible (Java)

CWE:768 Incorrect Short Circuit Evaluation

Weakness

closely mapped	Bitwise AND on Boolean (Java) Bitwise OR on Boolean (Java)

CWE:770 Allocation of Resources Without Limits or Throttling

Weakness

hierarchy ancestor	Tainted Allocation Size (Java)

CWE:771 Missing Reference to Active Allocated Resource

Weakness

also related	Unused Object (Java)

CWE:772 Missing Release of Resource after Effective Lifetime

Weakness

closely mapped	Closeable Not Closed (Java)

CWE:789 Memory Allocation with Excessive Size Value

Weakness

closely mapped	Tainted Allocation Size (Java)

CWE:798 Use of Hard-coded Credentials

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:800 Weaknesses in the 2010 CWE/SANS Top 25 Most Dangerous Programming Errors

View

hierarchy ancestor

CWE:801 2010 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor

CWE:802 2010 Top 25 - Risky Resource Management

Category

hierarchy ancestor

CWE:803 2010 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:808 2010 Top 25 - Weaknesses On the Cusp

Category

hierarchy ancestor

CWE:809 Weaknesses in OWASP Top Ten (2010)

View

hierarchy ancestor

CWE:810 OWASP Top Ten 2010 Category A1 - Injection

Category

hierarchy ancestor	Command Injection (Java) SQL Injection (Java) Tainted LDAP Attribute (Java) Tainted LDAP Filter (Java) Tainted Xpath (Java)

CWE:811 OWASP Top Ten 2010 Category A2 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java)

CWE:812 OWASP Top Ten 2010 Category A3 - Broken Authentication and Session Management

Category

hierarchy ancestor

CWE:813 OWASP Top Ten 2010 Category A4 - Insecure Direct Object References

Category

hierarchy ancestor	Tainted Path (Java)

CWE:815 OWASP Top Ten 2010 Category A6 - Security Misconfiguration

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Debug Warning (Java) Exception Information Disclosure (Java) Field Too Visible (Java) Permissive File Mode (Java) Sensitive Data Written to Local File (Java) Static Field Too Visible (Java)

CWE:816 OWASP Top Ten 2010 Category A7 - Insecure Cryptographic Storage

Category

hierarchy ancestor

CWE:817 OWASP Top Ten 2010 Category A8 - Failure to Restrict URL Access

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Field Too Visible (Java) Permissive File Mode (Java) Static Field Too Visible (Java)

CWE:818 OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection

Category

hierarchy ancestor

CWE:819 OWASP Top Ten 2010 Category A10 - Unvalidated Redirects and Forwards

Category

hierarchy ancestor	Android URL Injection (Java) Open Redirect (Java) Tainted URL (Java)

CWE:820 Missing Synchronization

Weakness

closely mapped	Unguarded Method (Java)
hierarchy ancestor	Missing synchronized Statement (Java) Unguarded Field (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:821 Incorrect Synchronization

Weakness

hierarchy ancestor	Synchronous Call to Thread Body (Java)

CWE:833 Deadlock

Weakness

closely mapped	Blocking in Critical Section (Java)

CWE:834 Excessive Iteration

Weakness

hierarchy ancestor	Potential Infinite Recursion (Java)

CWE:840 Business Logic Errors

Category

hierarchy ancestor	Tainted Allocation Size (Java)

CWE:844 Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011)

View

hierarchy ancestor

CWE:845 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor

CWE:846 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL)

Category

hierarchy ancestor	Assertion Contains Side Effects (Java) Empty jar File Archived (Java) Empty zip File Archived (Java) Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java) Tainted Allocation Size (Java) Useless Assignment (Java) Useless Assignment to Default (Java)

CWE:847 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP)

Category

hierarchy ancestor

CWE:848 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM)

Category

hierarchy ancestor	Abs on random (Java) Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java) Floating Point Equality (Java)

CWE:849 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ)

Category

hierarchy ancestor

CWE:850 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET)

Category

hierarchy ancestor

CWE:851 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR)

Category

hierarchy ancestor

CWE:852 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:853 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:854 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI)

Category

hierarchy ancestor	Broad Throws Clause (Java) Debug Call (Java) Execution After Redirect (Java) Generic Exception Handler (Java) Inappropriate Exception Handler (Java) Synchronous Call to Thread Body (Java)

CWE:855 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS)

Category

hierarchy ancestor	Single-use Random Number Generator (Java) Unused Object (Java)

CWE:857 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO)

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Closeable Not Closed (Java) Closeable Not Stored (Java) Field Too Visible (Java) Ignored Return Value (Java) Missing Call to super (Java) Permissive File Mode (Java) Single-use Random Number Generator (Java) Static Field Too Visible (Java) Tainted Allocation Size (Java)

CWE:858 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER)

Category

hierarchy ancestor

CWE:859 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC)

Category

hierarchy ancestor

CWE:860 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV)

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Class Enables Debug Features (Java) Field Too Visible (Java) LDAP Authentication Disabled (Java) Method Enables Debug Features (Java) Permissive File Mode (Java) Potential LDAP Poisoning (Java) Static Field Too Visible (Java) Tainted Data in Vulnerable Method (Java)

CWE:861 The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:864 2011 Top 25 - Insecure Interaction Between Components

Category

hierarchy ancestor	Android URL Injection (Java) Command Injection (Java) Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java) Open Redirect (Java) SQL Injection (Java) Tainted URL (Java)

CWE:865 2011 Top 25 - Risky Resource Management

Category

hierarchy ancestor	Cast: int Computation to long (Java) Format String Injection (Java) Method Disables Security Setting (Java) Tainted Path (Java)

CWE:866 2011 Top 25 - Porous Defenses

Category

hierarchy ancestor

CWE:867 2011 Top 25 - Weaknesses On the Cusp

Category

hierarchy ancestor

CWE:868 Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)

View

hierarchy ancestor

CWE:871 CERT C++ Secure Coding Section 03 - Expressions (EXP)

Category

hierarchy ancestor

CWE:872 CERT C++ Secure Coding Section 04 - Integers (INT)

Category

hierarchy ancestor

CWE:873 CERT C++ Secure Coding Section 05 - Floating Point Arithmetic (FLP)

Category

hierarchy ancestor	Abs on random (Java) Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java) Non-overriding Method Signature (Java)

CWE:874 CERT C++ Secure Coding Section 06 - Arrays and the STL (ARR)

Category

hierarchy ancestor	Assertion Contains Side Effects (Java) Empty jar File Archived (Java) Empty zip File Archived (Java) Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java) Tainted Allocation Size (Java) Useless Assignment (Java) Useless Assignment to Default (Java)

CWE:875 CERT C++ Secure Coding Section 07 - Characters and Strings (STR)

Category

hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Command Injection (Java) Non-overriding Method Signature (Java) Risky Class Cast (Java) Risky array store (Java)

CWE:876 CERT C++ Secure Coding Section 08 - Memory Management (MEM)

Category

hierarchy ancestor

CWE:877 CERT C++ Secure Coding Section 09 - Input Output (FIO)

Category

hierarchy ancestor

CWE:878 CERT C++ Secure Coding Section 10 - Environment (ENV)

Category

hierarchy ancestor	Broad Throws Clause (Java) Command Injection (Java) Debug Call (Java) Execution After Redirect (Java) Generic Exception Handler (Java) Inappropriate Exception Handler (Java)

CWE:879 CERT C++ Secure Coding Section 11 - Signals (SIG)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:880 CERT C++ Secure Coding Section 12 - Exceptions and Error Handling (ERR)

Category

hierarchy ancestor

CWE:882 CERT C++ Secure Coding Section 14 - Concurrency (CON)

Category

hierarchy ancestor	Closeable Not Closed (Java) Double-Checked Locking (Java) Missing Call to super (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:883 CERT C++ Secure Coding Section 49 - Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:884 CWE Cross-section

View

hierarchy ancestor

CWE:885 SFP Primary Cluster: Risky Values

Category

hierarchy ancestor

CWE:886 SFP Primary Cluster: Unused entities

Category

hierarchy ancestor	Unnecessary Field (Java) Unreachable Instruction (Java) Unused Class (Java) Unused Method (Java) Unused Value: Actual Parameter (Java) Unused Value: Variable (Java) Unused Value: Write to Parameter (Java)

CWE:887 SFP Primary Cluster: API

Category

hierarchy ancestor

CWE:888 Software Fault Pattern (SFP) Clusters

View

hierarchy ancestor

CWE:889 SFP Primary Cluster: Exception Management

Category

hierarchy ancestor

CWE:890 SFP Primary Cluster: Memory Access

Category

hierarchy ancestor

CWE:892 SFP Primary Cluster: Resource Management

Category

hierarchy ancestor

CWE:893 SFP Primary Cluster: Path Resolution

Category

hierarchy ancestor	Android URL Injection (Java) DLL Injection (Java) Fragment Injection (Java) Insecure XSLT Execution (Java) Open Redirect (Java) Possible XML External Entity Reference (Java) Reflection Injection (Java) Tainted Path (Java) Tainted URL (Java)

CWE:894 SFP Primary Cluster: Synchronization

Category

hierarchy ancestor

CWE:895 SFP Primary Cluster: Information Leak

Category

hierarchy ancestor

CWE:896 SFP Primary Cluster: Tainted Input

Category

hierarchy ancestor

CWE:897 SFP Primary Cluster: Entry Points

Category

hierarchy ancestor

CWE:898 SFP Primary Cluster: Authentication

Category

hierarchy ancestor

CWE:899 SFP Primary Cluster: Access Control

Category

hierarchy ancestor

CWE:900 Weaknesses in the 2011 CWE/SANS Top 25 Most Dangerous Software Errors

View

hierarchy ancestor

CWE:902 SFP Primary Cluster: Channel

Category

hierarchy ancestor	Deprecated Transfer Protocol (Java) Tainted HTTP Response (Java)

CWE:903 SFP Primary Cluster: Cryptography

Category

hierarchy ancestor

CWE:905 SFP Primary Cluster: Predictability

Category

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Hardcoded Random Seed (Java) Insecure Random Number Generator (Java) Legacy Random Generator (Java) Sensitive Data Written to External Storage (Java) Use of Same Seed (Java) Weak Cryptographic Value (Java) Weak Initialization Vector Field (Java) Weak Initialization Vector Value (Java)

CWE:906 SFP Primary Cluster: UI

Category

hierarchy ancestor	Broad Throws Clause (Java) Generic Exception Handler (Java)

CWE:907 SFP Primary Cluster: Other

Category

hierarchy ancestor

CWE:909 Missing Initialization of Resource

Weakness

closely mapped	Empty jar File Archived (Java) Empty zip File Archived (Java)
hierarchy ancestor	Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java)

CWE:913 Improper Control of Dynamically-Managed Code Resources

Weakness

closely mapped	Deserializable Class (Java) Deserializing Non-Serializable Class (Java) Insecure Class Loader (Java) Missing Serial Version Field (Java) Nonserializable Field (Java) Nonserializable Field Element (Java) Nonserializable Outer Class (Java) Unexpected Serial Version Field (Java)
hierarchy ancestor	Code Injection (Java) Fragment Injection (Java) Reflection Bypasses Member Accessibility (Java) Reflection Injection (Java) Reflection Modifies Member Accessibility (Java) Serialization Not Disabled (Java) Tainted Expression Evaluation (Java)

CWE:915 Improperly Controlled Modification of Dynamically-Determined Object Attributes

Weakness

closely mapped	Reflection Bypasses Member Accessibility (Java) Reflection Modifies Member Accessibility (Java)

CWE:916 Use of Password Hash With Insufficient Computational Effort

Weakness

closely mapped	Inadequate Salt (Java)

CWE:917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')

Weakness

closely mapped	Tainted Expression Evaluation (Java)

CWE:919 Weaknesses in Mobile Applications

View

hierarchy ancestor

CWE:922 Insecure Storage of Sensitive Information

Weakness

closely mapped	Certificate Added to Root Store (Java)

CWE:928 Weaknesses in OWASP Top Ten (2013)

View

hierarchy ancestor

CWE:929 OWASP Top Ten 2013 Category A1 - Injection

Category

hierarchy ancestor

CWE:930 OWASP Top Ten 2013 Category A2 - Broken Authentication and Session Management

Category

hierarchy ancestor

CWE:931 OWASP Top Ten 2013 Category A3 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java)

CWE:932 OWASP Top Ten 2013 Category A4 - Insecure Direct Object References

Category

hierarchy ancestor	Tainted Path (Java)

CWE:933 OWASP Top Ten 2013 Category A5 - Security Misconfiguration

Category

hierarchy ancestor

CWE:934 OWASP Top Ten 2013 Category A6 - Sensitive Data Exposure

Category

hierarchy ancestor

CWE:935 OWASP Top Ten 2013 Category A7 - Missing Function Level Access Control

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Field Too Visible (Java) Permissive File Mode (Java) Static Field Too Visible (Java)

CWE:938 OWASP Top Ten 2013 Category A10 - Unvalidated Redirects and Forwards

Category

hierarchy ancestor	Android URL Injection (Java) Open Redirect (Java) Tainted URL (Java)

CWE:943 Improper Neutralization of Special Elements in Data Query Logic

Weakness

hierarchy ancestor	SQL Injection (Java) Tainted LDAP Attribute (Java) Tainted LDAP Filter (Java) Tainted Xpath (Java)

CWE:944 SFP Secondary Cluster: Access Management

Category

hierarchy ancestor

CWE:945 SFP Secondary Cluster: Insecure Resource Access

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Field Too Visible (Java) Permissive File Mode (Java) Static Field Too Visible (Java)

CWE:946 SFP Secondary Cluster: Insecure Resource Permissions

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Field Too Visible (Java) Permissive File Mode (Java) Static Field Too Visible (Java)

CWE:947 SFP Secondary Cluster: Authentication Bypass

Category

hierarchy ancestor

CWE:949 SFP Secondary Cluster: Faulty Endpoint Authentication

Category

hierarchy ancestor	Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java)

CWE:950 SFP Secondary Cluster: Hardcoded Sensitive Data

Category

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Filename (Java) Hardcoded IP Address (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:951 SFP Secondary Cluster: Insecure Authentication Policy

Category

hierarchy ancestor	Unsafe Session Expiration Time (Java)

CWE:957 SFP Secondary Cluster: Protocol Error

Category

hierarchy ancestor	Deprecated Transfer Protocol (Java) Tainted HTTP Response (Java)

CWE:958 SFP Secondary Cluster: Broken Cryptography

Category

hierarchy ancestor

CWE:959 SFP Secondary Cluster: Weak Cryptography

Category

hierarchy ancestor	Cryptographic Algorithm with Weak Hash (Java) Inadequate Salt (Java) Insecure Key Derivation (Java) Weak Hash Algorithm (Java) Weak Hash Algorithm Field (Java)

CWE:960 SFP Secondary Cluster: Ambiguous Exception Type

Category

hierarchy ancestor	Broad Throws Clause (Java) Generic Exception Handler (Java)

CWE:961 SFP Secondary Cluster: Incorrect Exception Behavior

Category

hierarchy ancestor

CWE:962 SFP Secondary Cluster: Unchecked Status Condition

Category

hierarchy ancestor

CWE:963 SFP Secondary Cluster: Exposed Data

Category

hierarchy ancestor

CWE:965 SFP Secondary Cluster: Insecure Session Management

Category

hierarchy ancestor	Sensitive Data Cached (Java)

CWE:966 SFP Secondary Cluster: Other Exposures

Category

hierarchy ancestor	Field Too Visible (Java) Inner Class Should be Static (Java) Insecure Cookie (Java) Static Field Too Visible (Java)

CWE:971 SFP Secondary Cluster: Faulty Pointer Use

Category

hierarchy ancestor

CWE:975 SFP Secondary Cluster: Architecture

Category

hierarchy ancestor

CWE:977 SFP Secondary Cluster: Design

Category

hierarchy ancestor

CWE:978 SFP Secondary Cluster: Implementation

Category

hierarchy ancestor

CWE:980 SFP Secondary Cluster: Link in Resource Name Resolution

Category

hierarchy ancestor	Android URL Injection (Java) DLL Injection (Java) Fragment Injection (Java) Insecure XSLT Execution (Java) Open Redirect (Java) Possible XML External Entity Reference (Java) Reflection Injection (Java) Tainted URL (Java)

CWE:981 SFP Secondary Cluster: Path Traversal

Category

hierarchy ancestor	DLL Injection (Java) Tainted Path (Java)

CWE:982 SFP Secondary Cluster: Failure to Release Resource

Category

hierarchy ancestor	Closeable Not Closed (Java) Missing Call to super (Java) Unused Object (Java)

CWE:983 SFP Secondary Cluster: Faulty Resource Use

Category

hierarchy ancestor	Unsafe Session Expiration Time (Java)

CWE:984 SFP Secondary Cluster: Life Cycle

Category

hierarchy ancestor

CWE:985 SFP Secondary Cluster: Unrestricted Consumption

Category

hierarchy ancestor	Closeable Not Stored (Java) Inefficient Box-Unbox (Java) Inefficient Instantiation (Java) Potential Infinite Recursion (Java) Single-use Random Number Generator (Java) Tainted Allocation Size (Java) Unused Object (Java)

CWE:986 SFP Secondary Cluster: Missing Lock

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:987 SFP Secondary Cluster: Multiple Locks/Unlocks

Category

hierarchy ancestor	Useless Synchronization (Java)

CWE:988 SFP Secondary Cluster: Race Condition Window

Category

hierarchy ancestor	Double-Checked Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:989 SFP Secondary Cluster: Unrestricted Lock

Category

hierarchy ancestor	Synchronization on Interned String (Java)

CWE:990 SFP Secondary Cluster: Tainted Input to Command

Category

hierarchy ancestor

CWE:991 SFP Secondary Cluster: Tainted Input to Environment

Category

hierarchy ancestor	Code Injection (Java) DLL Injection (Java) Fragment Injection (Java) Mutable Constant Field (Java) Mutable Enumeration (Java) Mutable Public Static Final Array (Java) Reflection Injection (Java) Tainted Expression Evaluation (Java)

CWE:992 SFP Secondary Cluster: Faulty Input Transformation

Category

hierarchy ancestor	Tainted Log (Java)

CWE:994 SFP Secondary Cluster: Tainted Input to Variable

Category

hierarchy ancestor

CWE:997 SFP Secondary Cluster: Information Loss

Category

hierarchy ancestor	Broad Throws Clause (Java) Generic Exception Handler (Java)

CWE:998 SFP Secondary Cluster: Glitch in Computation

Category

hierarchy ancestor

CWE:1000 Research Concepts

View

hierarchy ancestor

CWE:1001 SFP Secondary Cluster: Use of an Improper API

Category

hierarchy ancestor

CWE:1002 SFP Secondary Cluster: Unexpected Entry Points

Category

hierarchy ancestor

CWE:1003 Weaknesses for Simplified Mapping of Published Vulnerabilities

View

hierarchy ancestor

CWE:1005 7PK - Input Validation and Representation

Category

hierarchy ancestor

CWE:1006 Bad Coding Practices

Category

hierarchy ancestor

CWE:1008 Architectural Concepts

View

hierarchy ancestor

CWE:1009 Audit

Category

hierarchy ancestor	Tainted Log (Java)

CWE:1010 Authenticate Actors

Category

hierarchy ancestor

CWE:1011 Authorize Actors

Category

hierarchy ancestor

CWE:1012 Cross Cutting

Category

hierarchy ancestor

CWE:1013 Encrypt Data

Category

hierarchy ancestor

CWE:1014 Identify Actors

Category

hierarchy ancestor	Insecure Socket Factory (Java) Insecure verify Override for Certificate (Java) Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java) Untrusted Network Host (Java) Use of Insecure verify for Certificate (Java)

CWE:1015 Limit Access

Category

hierarchy ancestor	Android URL Injection (Java) DLL Injection (Java) Debug Warning (Java) Exception Information Disclosure (Java) Fragment Injection (Java) Insecure XSLT Execution (Java) Open Redirect (Java) Possible XML External Entity Reference (Java) Reflection Injection (Java) Tainted URL (Java)

CWE:1016 Limit Exposure

Category

hierarchy ancestor	Debug Warning (Java) Exception Information Disclosure (Java)

CWE:1018 Manage User Sessions

Category

hierarchy ancestor	Unsafe Session Expiration Time (Java)

CWE:1019 Validate Inputs

Category

hierarchy ancestor

CWE:1020 Verify Message Integrity

Category

hierarchy ancestor

CWE:1023 Incomplete Comparison with Missing Factors

Weakness

closely mapped	Missing Equals Override (Java)

CWE:1024 Comparison of Incompatible Types

Weakness

closely mapped	== Always Fails Because Types Always Different (Java)

CWE:1025 Comparison Using Wrong Factors

Weakness

hierarchy ancestor	Comparison to Class Names (Java) Comparison to Empty String (Java) Non-Object compareTo Parameter (Java) Should Use equals() Instead of == (Java) equals Parameter Should Be Object (Java) equals on Array (Java)

CWE:1026 Weaknesses in OWASP Top Ten (2017)

View

hierarchy ancestor

CWE:1027 OWASP Top Ten 2017 Category A1 - Injection

Category

hierarchy ancestor

CWE:1028 OWASP Top Ten 2017 Category A2 - Broken Authentication

Category

hierarchy ancestor

CWE:1029 OWASP Top Ten 2017 Category A3 - Sensitive Data Exposure

Category

hierarchy ancestor

CWE:1030 OWASP Top Ten 2017 Category A4 - XML External Entities (XXE)

Category

hierarchy ancestor	Insecure XSLT Execution (Java) Possible XML External Entity Reference (Java)

CWE:1031 OWASP Top Ten 2017 Category A5 - Broken Access Control

Category

hierarchy ancestor

CWE:1032 OWASP Top Ten 2017 Category A6 - Security Misconfiguration

Category

hierarchy ancestor

CWE:1033 OWASP Top Ten 2017 Category A7 - Cross-Site Scripting (XSS)

Category

hierarchy ancestor	Cross Site Scripting (Java) Cross Site Scripting In Error Message Web Page (Java)

CWE:1034 OWASP Top Ten 2017 Category A8 - Insecure Deserialization

Category

hierarchy ancestor	Deserializable Class (Java) Deserializing Non-Serializable Class (Java) Serialization Not Disabled (Java)

CWE:1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities

Category

hierarchy ancestor	Deprecated Cryptography Provider (Java) Deprecated Transfer Protocol (Java)

CWE:1040 Quality Weaknesses with Indirect Security Impacts

View

hierarchy ancestor

CWE:1041 Use of Redundant Code

Weakness

closely mapped	Copy-Paste Error

CWE:1061 Insufficient Encapsulation

Weakness

closely mapped	Field Too Visible (Java) Method Should be private (Java) Static Field Too Visible (Java)

CWE:1071 Empty Code Block

Weakness

closely mapped	Empty Branch Statement (Java)
hierarchy ancestor	Useless Synchronization (Java)

CWE:1076 Insufficient Adherence to Expected Conventions

Weakness

closely mapped	Ambiguous Call from Inner Class (Java) Inappropriate Instanceof (Java) Missing Serial Version Field (Java) Shadowed Identifier (Java) compareTo in Non-Comparable Class (Java) equals Parameter Should Be Object (Java)
hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Explicit Finalize (Java) Hardcoded Filename (Java) Hardcoded IP Address (Java) Non-Object compareTo Parameter (Java)

CWE:1077 Floating Point Comparison with Incorrect Operator

Weakness

closely mapped	Floating Point Equality (Java)

CWE:1078 Inappropriate Source Code Style or Formatting

Weakness

closely mapped	Approximate e Constant (Java) Approximate pi Constant (Java)
hierarchy ancestor	Hardcoded Filename (Java) Hardcoded IP Address (Java)

CWE:1081 Entries with Maintenance Notes

View

hierarchy ancestor

CWE:1097 Persistent Storable Data Element without Associated Comparison Control Element

Weakness

closely mapped	Non-Object compareTo Parameter (Java)
also related	equals Parameter Should Be Object (Java)

CWE:1126 Declaration of Variable with Unnecessarily Wide Scope

Weakness

closely mapped	Unnecessary Field (Java)

CWE:1128 CISQ Quality Measures (2016)

View

hierarchy ancestor

CWE:1129 CISQ Quality Measures (2016) - Reliability

Category

hierarchy ancestor

CWE:1130 CISQ Quality Measures (2016) - Maintainability

Category

hierarchy ancestor	Copy-Paste Error Field Too Visible (Java) Static Field Too Visible (Java) Unreachable Instruction (Java) Unused Class (Java) Unused Method (Java)

CWE:1131 CISQ Quality Measures (2016) - Security

Category

hierarchy ancestor

CWE:1133 Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java

View

hierarchy ancestor

CWE:1134 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor

CWE:1135 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL)

Category

hierarchy ancestor	Assertion Contains Side Effects (Java) Empty jar File Archived (Java) Empty zip File Archived (Java) Field Never Written (Java) Lambda Parameter may be null (Java) Null Pointer Dereference (Java) Tainted Allocation Size (Java) Useless Assignment (Java) Useless Assignment to Default (Java)

CWE:1136 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP)

Category

hierarchy ancestor

CWE:1137 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM)

Category

hierarchy ancestor	Abs on random (Java) Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java) Floating Point Equality (Java)

CWE:1139 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ)

Category

hierarchy ancestor

CWE:1140 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET)

Category

hierarchy ancestor

CWE:1141 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR)

Category

hierarchy ancestor

CWE:1142 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:1143 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:1144 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI)

Category

hierarchy ancestor	Synchronous Call to Thread Body (Java)

CWE:1145 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS)

Category

hierarchy ancestor	Single-use Random Number Generator (Java) Unused Object (Java)

CWE:1147 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO)

Category

hierarchy ancestor

CWE:1148 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER)

Category

hierarchy ancestor

CWE:1149 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC)

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Field Too Visible (Java) Permissive File Mode (Java) Reflection Bypasses Member Accessibility (Java) Reflection Modifies Member Accessibility (Java) Static Field Too Visible (Java) Tainted Message (Java)

CWE:1150 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV)

Category

hierarchy ancestor	Accessing File in Permissive Mode (Java) Class Enables Debug Features (Java) Field Too Visible (Java) LDAP Authentication Disabled (Java) Method Enables Debug Features (Java) Permissive File Mode (Java) Potential LDAP Poisoning (Java) Static Field Too Visible (Java) Tainted Data in Vulnerable Method (Java)

CWE:1152 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:1153 SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD)

Category

hierarchy ancestor

CWE:1154 Weaknesses Addressed by the SEI CERT C Coding Standard

View

hierarchy ancestor

CWE:1157 SEI CERT C Coding Standard - Guidelines 03. Expressions (EXP)

Category

hierarchy ancestor

CWE:1158 SEI CERT C Coding Standard - Guidelines 04. Integers (INT)

Category

hierarchy ancestor	Abs on random (Java) Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java) Risky Class Cast (Java) Risky array store (Java)

CWE:1159 SEI CERT C Coding Standard - Guidelines 05. Floating Point (FLP)

Category

hierarchy ancestor	Abs on random (Java) Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java)

CWE:1161 SEI CERT C Coding Standard - Guidelines 07. Characters and Strings (STR)

Category

hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Method Disables Security Setting (Java) Risky Class Cast (Java) Risky array store (Java)

CWE:1162 SEI CERT C Coding Standard - Guidelines 08. Memory Management (MEM)

Category

hierarchy ancestor	Cast: int Computation to long (Java) Closeable Not Closed (Java) Missing Call to super (Java) Tainted Allocation Size (Java) Unsafe Session Expiration Time (Java) Unused Object (Java)

CWE:1163 SEI CERT C Coding Standard - Guidelines 09. Input Output (FIO)

Category

hierarchy ancestor

CWE:1164 Irrelevant Code

Weakness

closely mapped	Field Never Read (Java) Redundant Call for String Argument (Java) Redundant Implements Clause (Java) Static Field Assigned Non-Static (Java) Unused Field (Java) Unused Object (Java) Useless Class Cast (Java) Useless null Test (Java) Useless null Test of Field (Java) Useless null Test of Parameter (Java)
hierarchy ancestor	Empty Branch Statement (Java) Unnecessary Field (Java) Unreachable Instruction (Java) Unused Class (Java) Unused Method (Java) Unused Value: Actual Parameter (Java) Unused Value: Variable (Java) Unused Value: Write to Parameter (Java) Useless Synchronization (Java)

CWE:1165 SEI CERT C Coding Standard - Guidelines 10. Environment (ENV)

Category

hierarchy ancestor	Broad Throws Clause (Java) Command Injection (Java) Debug Call (Java) Execution After Redirect (Java) Generic Exception Handler (Java) Inappropriate Exception Handler (Java) Method Disables Security Setting (Java)

CWE:1166 SEI CERT C Coding Standard - Guidelines 11. Signals (SIG)

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:1167 SEI CERT C Coding Standard - Guidelines 12. Error Handling (ERR)

Category

hierarchy ancestor	Call Might Return Null (Java) Field Never Written (Java) Ignored Return Value (Java) Ignored Return Value for Pure Function (Java) Lambda Parameter may be null (Java) Method Disables Security Setting (Java) Method Should Not Return null (Java) Null Pointer Dereference (Java) Useless null Test of Return Value (Java)

CWE:1169 SEI CERT C Coding Standard - Guidelines 14. Concurrency (CON)

Category

hierarchy ancestor

CWE:1170 SEI CERT C Coding Standard - Guidelines 48. Miscellaneous (MSC)

Category

hierarchy ancestor

CWE:1171 SEI CERT C Coding Standard - Guidelines 50. POSIX (POS)

Category

hierarchy ancestor

CWE:1173 Improper Use of Validation Framework

Weakness

closely mapped	Missing isValidFragment Override (Java)

CWE:1176 Inefficient CPU Computation

Weakness

closely mapped	Single-use Random Number Generator (Java)

CWE:1177 Use of Prohibited Code

Weakness

hierarchy ancestor	Method Disables Security Setting (Java)

CWE:1178 Weaknesses Addressed by the SEI CERT Perl Coding Standard

View

hierarchy ancestor

CWE:1179 SEI CERT Perl Coding Standard - Guidelines 01. Input Validation and Data Sanitization (IDS)

Category

hierarchy ancestor	Command Injection (Java) Format String Injection (Java) Tainted Allocation Size (Java) Tainted Expression Evaluation (Java) Tainted Log (Java) Tainted Path (Java) Tainted Regular Expression (Java)

CWE:1180 SEI CERT Perl Coding Standard - Guidelines 02. Declarations and Initialization (DCL)

Category

hierarchy ancestor	Array Parameter Empty (Java) Copy-Paste Error Debug Warning (Java) Field Never Written (Java) Lambda Parameter may be null (Java) Method Names Differ Only in Case (Java) Non-overriding Method Signature (Java) Null Pointer Dereference (Java)

CWE:1181 SEI CERT Perl Coding Standard - Guidelines 03. Expressions (EXP)

Category

hierarchy ancestor

CWE:1182 SEI CERT Perl Coding Standard - Guidelines 04. Integers (INT)

Category

hierarchy ancestor	Approximate e Constant (Java) Approximate pi Constant (Java) Cast: Integer to Floating Point (Java) Cast: int Computation to long (Java)

CWE:1186 SEI CERT Perl Coding Standard - Guidelines 50. Miscellaneous (MSC)

Category

hierarchy ancestor	Unnecessary Field (Java) Unreachable Instruction (Java) Unused Class (Java) Unused Method (Java) Unused Value: Actual Parameter (Java) Unused Value: Variable (Java) Unused Value: Write to Parameter (Java)

CWE:1194 Hardware Design

View

hierarchy ancestor

CWE:1200 Weaknesses in the 2019 CWE Top 25 Most Dangerous Software Errors

View

hierarchy ancestor

CWE:1204 Generation of Weak Initialization Vector (IV)

Weakness

closely mapped	Weak Initialization Vector Field (Java) Weak Initialization Vector Value (Java)

CWE:1205 Security Primitives and Cryptography Issues

Category

hierarchy ancestor	Missing Required Cryptographic Step (Java)

CWE:1207 Debug and Test Problems

Category

hierarchy ancestor

CWE:1208 Cross-Cutting Problems

Category

hierarchy ancestor	toString on Array (Java)

CWE:1210 Audit / Logging Errors

Category

hierarchy ancestor	Tainted Log (Java)

CWE:1211 Authentication Errors

Category

hierarchy ancestor	Insecure Socket Factory (Java) Insecure verify Override for Certificate (Java) Untrusted Network Host (Java) Use of Insecure verify for Certificate (Java)

CWE:1213 Random Number Issues

Category

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java) Use of Same Seed (Java) Weak Cryptographic Value (Java)

CWE:1214 Data Integrity Issues

Category

hierarchy ancestor	Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java)

CWE:1215 Data Validation Issues

Category

hierarchy ancestor	Missing isValidFragment Override (Java)

CWE:1217 User Session Errors

Category

hierarchy ancestor	Unsafe Session Expiration Time (Java)

CWE:1219 File Handling Issues

Category

hierarchy ancestor	Tainted Path (Java)

CWE:1228 API / Function Errors

Category

hierarchy ancestor	Debug Warning (Java) Direct Thread Usage in Http Servlet (Java) JavaScript Enabled (Java) JavaScript File Access from File URLs (Java) Method Disables Security Setting (Java) Missing JavaScript Entry Point (Java) Missing JavaScript Execution (Java) Risky JavaScript Interface (Java) Security Annotation Conflict (Java) Universal JavaScript Access to File URLs (Java)

CWE:1235 Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations

Weakness

also related	Inefficient Box-Unbox (Java)

CWE:1305 CISQ Quality Measures (2020)

View

hierarchy ancestor

CWE:1306 CISQ Quality Measures - Reliability

Category

hierarchy ancestor

CWE:1307 CISQ Quality Measures - Maintainability

Category

hierarchy ancestor

CWE:1308 CISQ Quality Measures - Security

Category

hierarchy ancestor

CWE:1309 CISQ Quality Measures - Efficiency

Category

hierarchy ancestor	Closeable Not Closed (Java) Missing Call to super (Java)

CWE:1337 Weaknesses in the 2021 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1339 Insufficient Precision or Accuracy of a Real Number

Weakness

closely mapped	Approximate e Constant (Java) Approximate pi Constant (Java)

CWE:1340 CISQ Data Protection Measures

View

hierarchy ancestor

CWE:1344 Weaknesses in OWASP Top Ten (2021)

View

hierarchy ancestor

CWE:1345 OWASP Top Ten 2021 Category A01:2021 - Broken Access Control

Category

hierarchy ancestor

CWE:1346 OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures

Category

hierarchy ancestor

CWE:1347 OWASP Top Ten 2021 Category A03:2021 - Injection

Category

hierarchy ancestor

CWE:1348 OWASP Top Ten 2021 Category A04:2021 - Insecure Design

Category

hierarchy ancestor

CWE:1349 OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration

Category

hierarchy ancestor

CWE:1350 Weaknesses in the 2020 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1352 OWASP Top Ten 2021 Category A06:2021 - Vulnerable and Outdated Components

Category

hierarchy ancestor	Deprecated Cryptography Provider (Java) Deprecated Transfer Protocol (Java)

CWE:1353 OWASP Top Ten 2021 Category A07:2021 - Identification and Authentication Failures

Category

hierarchy ancestor

CWE:1354 OWASP Top Ten 2021 Category A08:2021 - Software and Data Integrity Failures

Category

hierarchy ancestor	Deserializable Class (Java) Deserializing Non-Serializable Class (Java) Potential LDAP Poisoning (Java) Reflection Bypasses Member Accessibility (Java) Reflection Modifies Member Accessibility (Java) Serialization Not Disabled (Java) Tainted Data in Vulnerable Method (Java)

CWE:1355 OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures

Category

hierarchy ancestor	Tainted Log (Java)

CWE:1358 Weaknesses in SEI ETF Categories of Security Vulnerabilities in ICS

View

hierarchy ancestor

CWE:1359 ICS Communications

Category

hierarchy ancestor

CWE:1360 ICS Dependencies (& Architecture)

Category

hierarchy ancestor

CWE:1361 ICS Supply Chain

Category

hierarchy ancestor

CWE:1362 ICS Engineering (Constructions/Deployment)

Category

hierarchy ancestor

CWE:1363 ICS Operations (& Maintenance)

Category

hierarchy ancestor

CWE:1364 ICS Communications: Zone Boundary Failures

Category

hierarchy ancestor

CWE:1365 ICS Communications: Unreliability

Category

hierarchy ancestor	Double-Checked Locking (Java) Missing synchronized Statement (Java) Potential LDAP Poisoning (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Tainted Data in Vulnerable Method (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:1366 ICS Communications: Frail Security in Protocols

Category

hierarchy ancestor

CWE:1368 ICS Dependencies (& Architecture): External Digital Systems

Category

hierarchy ancestor

CWE:1369 ICS Supply Chain: IT/OT Convergence/Expansion

Category

hierarchy ancestor

CWE:1370 ICS Supply Chain: Common Mode Frailties

Category

hierarchy ancestor

CWE:1371 ICS Supply Chain: Poorly Documented or Undocumented Features

Category

hierarchy ancestor	Class Enables Debug Features (Java) Debug Call (Java) Method Enables Debug Features (Java)

CWE:1372 ICS Supply Chain: OT Counterfeit and Malicious Corruption

Category

hierarchy ancestor

CWE:1373 ICS Engineering (Construction/Deployment): Trust Model Problems

Category

hierarchy ancestor	Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java)

CWE:1375 ICS Engineering (Construction/Deployment): Gaps in Details/Data

Category

hierarchy ancestor

CWE:1376 ICS Engineering (Construction/Deployment): Security Gaps in Commissioning

Category

hierarchy ancestor	Double-Checked Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java)

CWE:1382 ICS Operations (& Maintenance): Emerging Energy Technologies

Category

hierarchy ancestor

CWE:1383 ICS Operations (& Maintenance): Compliance/Conformance with Regulatory Requirements

Category

hierarchy ancestor

CWE:1387 Weaknesses in the 2022 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1390 Weak Authentication

Weakness

closely mapped	Anonymous LDAP Authentication (Java) LDAP Authentication Disabled (Java)
hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Password in Property File (Java) Sensitive Data Written to External Storage (Java)

CWE:1391 Use of Weak Credentials

Weakness

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:1396 Comprehensive Categorization: Access Control

Category

hierarchy ancestor

CWE:1397 Comprehensive Categorization: Comparison

Category

hierarchy ancestor

CWE:1398 Comprehensive Categorization: Component Interaction

Category

hierarchy ancestor	Tainted HTTP Response (Java)

CWE:1399 Comprehensive Categorization: Memory Safety

Category

hierarchy ancestor	Format String Injection (Java) Method Should Not Return null (Java) Tainted Allocation Size (Java)

CWE:1400 Comprehensive Categorization for Software Assurance Trends

View

hierarchy ancestor

CWE:1401 Comprehensive Categorization: Concurrency

Category

hierarchy ancestor	Blocking in Critical Section (Java) Double-Checked Locking (Java) Impossible Client Side Locking (Java) Missing synchronized Statement (Java) Synchronization on Interned String (Java) Synchronization on static (Java) Synchronous Call to Thread Body (Java) Unguarded Field (Java) Unguarded Method (Java) Unguarded Parameter (Java) Useless volatile Modifier (Java)

CWE:1402 Comprehensive Categorization: Encryption

Category

hierarchy ancestor

CWE:1403 Comprehensive Categorization: Exposed Resource

Category

hierarchy ancestor

CWE:1404 Comprehensive Categorization: File Handling

Category

hierarchy ancestor	Tainted Path (Java)

CWE:1405 Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions

Category

hierarchy ancestor

CWE:1406 Comprehensive Categorization: Improper Input Validation

Category

hierarchy ancestor	Cast: int Computation to long (Java) DLL Injection (Java) Format String Injection (Java) Fragment Injection (Java) Missing Call to super (Java) Missing isValidFragment Override (Java) Reflection Injection (Java) Tainted HTTP Response (Java) Tainted Log (Java)

CWE:1407 Comprehensive Categorization: Improper Neutralization

Category

hierarchy ancestor

CWE:1408 Comprehensive Categorization: Incorrect Calculation

Category

hierarchy ancestor	Abs on random (Java) Approximate e Constant (Java) Approximate pi Constant (Java) Cast: int Computation to long (Java)

CWE:1409 Comprehensive Categorization: Injection

Category

hierarchy ancestor

CWE:1410 Comprehensive Categorization: Insufficient Control Flow Management

Category

hierarchy ancestor

CWE:1411 Comprehensive Categorization: Insufficient Verification of Data Authenticity

Category

hierarchy ancestor	Potential LDAP Poisoning (Java) Tainted Data in Vulnerable Method (Java)

CWE:1412 Comprehensive Categorization: Poor Coding Practices

Category

hierarchy ancestor

CWE:1413 Comprehensive Categorization: Protection Mechanism Failure

Category

hierarchy ancestor

CWE:1414 Comprehensive Categorization: Randomness

Category

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Hardcoded Random Seed (Java) Insecure Random Number Generator (Java) Legacy Random Generator (Java) Sensitive Data Written to External Storage (Java) Use of Same Seed (Java) Weak Cryptographic Value (Java) Weak Initialization Vector Field (Java) Weak Initialization Vector Value (Java)

CWE:1415 Comprehensive Categorization: Resource Control

Category

hierarchy ancestor	Deserializable Class (Java) Fragment Injection (Java) Reflection Bypasses Member Accessibility (Java) Reflection Injection (Java) Reflection Modifies Member Accessibility (Java) Serialization Not Disabled (Java) Unsafe Session Expiration Time (Java)

CWE:1416 Comprehensive Categorization: Resource Lifecycle Management

Category

hierarchy ancestor

CWE:1417 Comprehensive Categorization: Sensitive Information Exposure

Category

hierarchy ancestor	Debug Warning (Java) Exception Information Disclosure (Java) Sensitive Data Written to Local File (Java) Use of Hardware ID (Java)

CWE:1418 Comprehensive Categorization: Violation of Secure Design Principles

Category

hierarchy ancestor	Hardcoded Cryptographic Key (Java) Hardcoded Password (Java) Sensitive Data Written to External Storage (Java)

CWE:1424 Weaknesses Addressed by ISA/IEC 62443 Requirements

View

hierarchy ancestor

CWE:1425 Weaknesses in the 2023 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:1430 Weaknesses in the 2024 CWE Top 25 Most Dangerous Software Weaknesses

View

hierarchy ancestor

CWE:2000 Comprehensive CWE Dictionary

View

hierarchy ancestor