The patterns behind every CVE

A CVE is one bug. A CWE is the root-cause pattern that let it happen — learn one and you’ll recognise it the next time it shows up wearing a different CVE ID.

969
Weaknesses catalogued
CWENameAbstractionCVEs mapped
CWE-281Improper Preservation of PermissionsBase123
CWE-282Improper Ownership ManagementClass30
CWE-283Unverified OwnershipBase34
CWE-284Improper Access ControlPillar6,385
CWE-285Improper AuthorizationClass1,593
CWE-286Incorrect User ManagementClass26
CWE-287Improper AuthenticationClass2,359
CWE-288Authentication Bypass Using an Alternate Path or ChannelBase658
CWE-289Authentication Bypass by Alternate NameBase44
CWE-29Path Traversal: '\..\filename'Variant63
CWE-290Authentication Bypass by SpoofingBase547
CWE-291Reliance on IP Address for AuthenticationVariant10
CWE-292DEPRECATED: Trusting Self-reported DNS NameVariant0
CWE-293Using Referer Field for AuthenticationVariant1
CWE-294Authentication Bypass by Capture-replayBase183
CWE-295Improper Certificate ValidationBase847
CWE-296Improper Following of a Certificate's Chain of TrustBase18
CWE-297Improper Validation of Certificate with Host MismatchVariant81
CWE-298Improper Validation of Certificate ExpirationVariant6
CWE-299Improper Check for Certificate RevocationBase20
Page 22 of 49 · 969 total
PreviousNext