The patterns behind every CVE

A CVE is one bug. A CWE is the root-cause pattern that let it happen — learn one and you’ll recognise it the next time it shows up wearing a different CVE ID.

969
Weaknesses catalogued
CWENameAbstractionCVEs mapped
CWE-546Suspicious CommentVariant0
CWE-547Use of Hard-coded, Security-relevant ConstantsBase11
CWE-548Exposure of Information Through Directory ListingVariant52
CWE-549Missing Password Field MaskingBase13
CWE-55Path Equivalence: '/./' (Single Dot Directory)Variant0
CWE-550Server-generated Error Message Containing Sensitive InformationVariant4
CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationBase20
CWE-552Files or Directories Accessible to External PartiesBase276
CWE-553Command Shell in Externally Accessible DirectoryVariant1
CWE-554ASP.NET Misconfiguration: Not Using Input Validation FrameworkVariant0
CWE-555J2EE Misconfiguration: Plaintext Password in Configuration FileVariant1
CWE-556ASP.NET Misconfiguration: Use of Identity ImpersonationVariant0
CWE-558Use of getlogin() in Multithreaded ApplicationVariant0
CWE-56Path Equivalence: 'filedir*' (Wildcard)Variant0
CWE-560Use of umask() with chmod-style ArgumentVariant0
CWE-561Dead CodeBase9
CWE-562Return of Stack Variable AddressBase6
CWE-563Assignment to Variable without UseBase2
CWE-564SQL Injection: HibernateVariant10
CWE-565Reliance on Cookies without Validation and Integrity CheckingBase33
Page 35 of 49 · 969 total
PreviousNext