The patterns behind every CVE

A CVE is one bug. A CWE is the root-cause pattern that let it happen — learn one and you’ll recognise it the next time it shows up wearing a different CVE ID.

969
Weaknesses catalogued
CWENameAbstractionCVEs mapped
CWE-940Improper Verification of Source of a Communication ChannelBase46
CWE-941Incorrectly Specified Destination in a Communication ChannelBase8
CWE-942Permissive Cross-domain Security Policy with Untrusted DomainsVariant110
CWE-943Improper Neutralization of Special Elements in Data Query LogicClass89
CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')Variant174
CWE-96Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')Base22
CWE-97Improper Neutralization of Server-Side Includes (SSI) Within a Web PageVariant5
CWE-98Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')Variant1,264
CWE-99Improper Control of Resource Identifiers ('Resource Injection')Class59
Page 49 of 49 · 969 total
Previous