Page History

CWE-116, Improper Encoding or Escaping of Output

CWE-289, Authentication bypass by alternate name
CWE-180, Incorrect behavior order: Validate before canonicalize

CWE-144, Improper neutralization of line delimiters
CWE-150, Improper neutralization of escape, meta, or control sequences
CWE-117, Improper Output Neutralization for Logs 

CWE-409, Improper Handling of Highly Compressed Data (Data Amplification)

CWE-134, Uncontrolled Format String

CWE-78, Improper Neutralization of Special Elements Used in an OS Command ("OS Command Injection")

CWE-182, Collapse of Data into Unsafe Value

CWE-116, Improper Encoding or Escaping of Output

CWE-116, Improper Encoding or Escaping of Output

CWE-252, Unchecked Return Value

CWE-476, NULL Pointer Dereference

CWE-595, Comparison of Object References Instead of Object Contents

CWE-595, Comparison of Object References Instead of Object Contents
CWE-597, Use of Wrong Operator in String Comparison

CWE-682, Incorrect Calculation
CWE-190, Integer Overflow or Wraparound
CWE-191, Integer Underflow (Wrap or Wraparound)

CWE-369, Divide by Zero

CWE-681, Incorrect Conversion between Numeric Types
CWE-197, Numeric Truncation Error

CWE-838, Inappropriate Encoding for Output Context

CWE-766, Critical Variable Declared Public

CWE-374, Passing Mutable Objects to an Untrusted Method
CWE-375, Returning a Mutable Object to an Untrusted Caller

CWE-375, Returning a Mutable Object to an Untrusted Caller

CWE-492, Use of Inner Class Containing Sensitive Data

CWE-486, Comparison of Classes by Name

CWE-493, Critical Public Variable without Final Modifier
CWE-500, Public Static Field Not Marked Final

CWE-617, Reachable Assertion

CWE-589, Call to Non-ubiquitous API

CWE-487, Reliance on Package-Level Scope

CWE-697, Insufficient Comparison

CWE-581, Object Model Violation: Just One of equals and hashcode Defined

CWE-573, Improper Following of Specification by Caller

CWE-586, Explicit call to Finalize()
CWE-583, finalize() Method Declared Public
CWE-568, finalize() Method without super.finalize()

CWE-390, Detection of Error Condition without Action

CWE-209, Information Exposure through an Error Message
CWE-497, Exposure of System Data to an Unauthorized Control Sphere
CWE-600, Uncaught Exception in Servlet

CWE-460, Improper Cleanup on Thrown Exception

CWE-459, Incomplete Cleanup
CWE-584, Return Inside finally Block

CWE-248, Uncaught Exception
CWE-460, Improper Cleanup on Thrown Exception
CWE-584, Return inside finally Block
CWE-705, Incorrect Control Flow Scoping
CWE-754, Improper Check for Unusual or Exceptional Conditions 

CWE-703, Improper Check or Handling of Exceptional Conditions
CWE-248, Uncaught Exception

CWE-397, Declaration of Throws for Generic Exception

CWE-382, J2EE Bad Practices: Use of System.exit()

CWE-413, Improper Resource Locking
CWE-567, Unsynchronized Access to Shared Data in a Multithreaded Context
CWE-667, Improper Locking

CWE-362, Concurrent Execution Using Shared Resource with Improper Synchronization ("Race Condition")
CWE-366, Race Condition within a Thread
CWE-662, Improper Synchronization

CWE-667, Improper Locking

CWE-412. Unrestricted externally accessible lock

CWE-820, Missing Synchronization

CWE-667, Improper Locking

CWE-833, Deadlock

CWE-883, Deadlock

CWE-609, Double-checked Locking

CWE-572, Call to Thread run() instead of start()

CWE-705, Incorrect Control Flow Scoping

CWE-405, Asymmetric Resource Consumption (Amplification)
CWE-410, Insufficient Resource Pool

CWE-392, Missing Report of Error Condition

CWE-67, Improper Handling of Windows Device Names

CWE-279, Incorrect Execution-Assigned Permissions
CWE-276, Incorrect Default Permissions
CWE-732, Incorrect Permission Assignment for Critical Resource

CWE-377, Insecure Temporary File
CWE-459, 

Incomplete Cleanup

CWE-404, Improper Resource Shutdown or Release
CWE-405, Asymmetric Resource Consumption (Amplification)
CWE-459, Incomplete Cleanup
CWE-770, Allocation of Resources without Limits or Throttling

CWE-252, Unchecked Return Value

CWE-135, Incorrect Calculation of Multi-byte String Length

CWE-198, Use of Incorrect Byte Ordering

CWE-359, Privacy Violation
CWE-532, Information Exposure through Log Files
CWE-533, Information Exposure through Server Log Files
CWE-542, Information Exposure through Cleanup Log Files

CWE-705, Incorrect Control Flow Scoping

CWE-171, Cleansing, Canonicalization, and Comparison Errors
CWE-647, Use of Non-canonical URL Paths for Authorization Decisions

CWE-589, Call to Non-ubiquitous API

CWE-502, Deserialization of Untrusted Data

CWE-319, Cleartext Transmission of Sensitive Information

CWE-499, Serializable Class Containing Sensitive Data
CWE-502, Deserialization of Untrusted Data

CWE-499, Serializable Class Containing Sensitive Data

CWE-502, Deserialization of Untrusted Data

CWE-502, "Deserialization of Untrusted Data"

CWE-250, Execution with Unnecessary Privileges

CWE-400, Uncontrolled Resource Consumption (aka "Resource Exhaustion")
CWE-770, Allocation of Resources without Limits or Throttling

CWE-502, Deserialization of Untrusted Data

CWE-502, Deserialization of Untrusted Data

CWE-266, Incorrect Privilege Assignment
CWE-272, Least Privilege Violation

CWE-266, Incorrect Privilege Assignment
CWE-272, Least Privilege Violation
CWE-732, Incorrect Permission Assignment for Critical Resource

CWE-302, Authentication Bypass by Assumed-Immutable Data
CWE-470, Use of Externally-Controlled Input to Select Classes or Code ("Unsafe Reflection")

CWE-300, Channel Accessible by Non-endpoint (aka "Man-in-the-Middle")
CWE-319, Cleartext Transmission of Sensitive Information
CWE-347, Improper Verification of Cryptographic Signature
CWE-494, Download of Code without Integrity Check

CWE-349, Acceptance of Extraneous Untrusted Data with Trusted Data

CWE-732, Incorrect Permission Assignment for Critical Resource

CWE-111, Direct Use of Unsafe JNI

CWE-311, Failure to Encrypt Sensitive Data

CWE-327, Use of a Broken or Risky Cryptographic Algorithm
CWE-330, Use of Insufficiently Random Values
CWE-332, Insufficient Entropy in PRNG
CWE-336, Same Seed in PRNG
CWE-337, Predictable Seed in PRNG

CWE-259, Use of Hard-Coded Password
CWE-798, Use of Hard-Coded Credentials

CWE-401, Improper Release of Memory before Removing Last Reference ("Memory Leak")

CWE-400, Uncontrolled Resource Consumption ("Resource Exhaustion")
CWE-770, Allocation of Resources without Limits or Throttling

CWE-116, Improper encoding or escaping of output

CWE-838. Inappropriate Encoding for Output Context