The patterns behind every CVE

A CVE is one bug. A CWE is the root-cause pattern that let it happen — learn one and you’ll recognise it the next time it shows up wearing a different CVE ID.

969
Weaknesses catalogued
CWENameAbstractionCVEs mapped
CWE-24Path Traversal: '../filedir'Variant113
CWE-240Improper Handling of Inconsistent Structural ElementsBase4
CWE-241Improper Handling of Unexpected Data TypeBase31
CWE-242Use of Inherently Dangerous FunctionBase11
CWE-243Creation of chroot Jail Without Changing Working DirectoryVariant0
CWE-244Improper Clearing of Heap Memory Before Release ('Heap Inspection')Variant19
CWE-245J2EE Bad Practices: Direct Management of ConnectionsVariant0
CWE-246J2EE Bad Practices: Direct Use of SocketsVariant0
CWE-247DEPRECATED: Reliance on DNS Lookups in a Security DecisionBase0
CWE-248Uncaught ExceptionBase338
CWE-249DEPRECATED: Often Misused: Path ManipulationVariant6
CWE-25Path Traversal: '/../filedir'Variant13
CWE-250Execution with Unnecessary PrivilegesBase349
CWE-252Unchecked Return ValueBase118
CWE-253Incorrect Check of Function Return ValueBase24
CWE-256Plaintext Storage of a PasswordBase192
CWE-257Storing Passwords in a Recoverable FormatBase67
CWE-258Empty Password in Configuration FileVariant11
CWE-259Use of Hard-coded PasswordVariant181
CWE-26Path Traversal: '/dir/../filename'Variant15
Page 20 of 49 · 969 total
PreviousNext