The patterns behind every CVE

A CVE is one bug. A CWE is the root-cause pattern that let it happen — learn one and you’ll recognise it the next time it shows up wearing a different CVE ID.

969
Weaknesses catalogued
CWENameAbstractionCVEs mapped
CWE-484Omitted Break Statement in SwitchBase1
CWE-486Comparison of Classes by NameVariant0
CWE-487Reliance on Package-level ScopeBase0
CWE-488Exposure of Data Element to Wrong SessionBase34
CWE-489Active Debug CodeBase81
CWE-49Path Equivalence: 'filename/' (Trailing Slash)Variant0
CWE-491Public cloneable() Method Without Final ('Object Hijack')Variant0
CWE-492Use of Inner Class Containing Sensitive DataVariant0
CWE-493Critical Public Variable Without Final ModifierVariant0
CWE-494Download of Code Without Integrity CheckBase142
CWE-495Private Data Structure Returned From A Public MethodVariant1
CWE-496Public Data Assigned to Private Array-Typed FieldVariant0
CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereBase369
CWE-498Cloneable Class Containing Sensitive InformationVariant0
CWE-499Serializable Class Containing Sensitive DataVariant2
CWE-5J2EE Misconfiguration: Data Transmission Without EncryptionVariant0
CWE-50Path Equivalence: '//multiple/leading/slash'Variant2
CWE-500Public Static Field Not Marked FinalVariant0
CWE-501Trust Boundary ViolationBase28
CWE-502Deserialization of Untrusted DataBase2,317
Page 32 of 49 · 969 total
PreviousNext