Out-of-bounds Write
The product writes data past the end, or before the beginning, of the intended buffer.
MITRE Common Weakness Enumeration
CWE catalog
Software weakness types referenced by NVD CVE records. Includes the MITRE Top 25 most dangerous weaknesses and other commonly seen entries.
Cross-site Scripting (XSS)
Improper neutralization of input during web page generation lets attackers inject client-side scripts.
SQL Injection
User-controlled input is concatenated into SQL queries, allowing attackers to alter query semantics.
Use After Free
Referencing memory after it has been freed can lead to crashes, data corruption, or arbitrary code execution.
OS Command Injection
User input is incorporated into a command passed to a shell or OS, enabling command execution.
Improper Input Validation
Input is not validated or is incorrectly validated, leading to unexpected control or data flow.
Out-of-bounds Read
The product reads data past the end, or before the beginning, of the intended buffer.
Path Traversal
User input is used to construct a pathname that resolves outside the intended directory.
Cross-Site Request Forgery (CSRF)
The product does not verify that requests came from the user, allowing forged actions.
Unrestricted Upload of File with Dangerous Type
Files of dangerous types are uploaded without proper validation, leading to remote execution.
Missing Authorization
Sensitive functionality lacks authorization checks, letting unauthenticated users perform privileged actions.
NULL Pointer Dereference
A pointer expected to be valid is NULL when dereferenced, typically causing a crash.
Improper Authentication
The product does not properly verify the identity of an actor, enabling impersonation.
Integer Overflow or Wraparound
Arithmetic operations produce a value outside the valid range, leading to incorrect logic.
Deserialization of Untrusted Data
Untrusted serialized data is deserialized, often leading to remote code execution.
Command Injection
User input is included in a constructed command, allowing attackers to modify the command.
Improper Restriction of Operations within the Bounds of a Memory Buffer
Operations on a buffer can read or write outside its bounds.
Use of Hard-coded Credentials
Hard-coded credentials embedded in code create a backdoor for attackers.
Server-Side Request Forgery (SSRF)
A server fetches a URL on behalf of a user, allowing access to internal resources.
Missing Authentication for Critical Function
Critical functions are exposed without requiring authentication.
Race Condition
Concurrent code paths can interleave in ways that produce incorrect or insecure behavior.
Improper Privilege Management
Privileges are assigned or maintained incorrectly, enabling privilege escalation.
Improper Control of Generation of Code (Code Injection)
User-controlled input is interpreted as code, allowing arbitrary code execution.
Incorrect Authorization
Authorization is performed but does not correctly enforce the intended policy.
Incorrect Default Permissions
Default file or resource permissions are too permissive, exposing data or capabilities.
Exposure of Sensitive Information
Sensitive information is exposed to an actor not explicitly authorized.
Uncontrolled Resource Consumption (DoS)
The product does not properly restrict resource use, enabling denial of service.
Open Redirect
User input is used to construct a redirect URL, enabling phishing.
XML External Entity (XXE)
An XML parser is configured to resolve external entities, exposing files or SSRF.
Incorrect Permission Assignment for Critical Resource
A critical resource has permissions that allow unintended access.
Insecure Temporary File
A temporary file is created in a way that allows attackers to predict or hijack it.
Missing Encryption of Sensitive Data
Sensitive data is not encrypted at rest or in transit.
Improper Certificate Validation
Certificates are not validated, enabling MITM attacks.
Use of Insufficiently Random Values
Predictable random values are used in security contexts.
Untrusted Search Path
Resources are loaded from a path that an attacker can control.
Feedback
How was this page?
Spotted something off, or have an idea? Let us know.