Weaknesses

CWE weakness types scored by proportion of linked CVEs with active exploitation.

761 weaknesses scored

critical-risk
2
high-risk
1
moderate-risk
11
low-risk
747
Weakness Score Tier
Invokable Control Element with Variadic Parameters 72/100 critical-risk
Path Equivalence: 'file.name' (Internal Dot) 72/100 critical-risk
PHP External Variable Modification 53/100 high-risk
Excessive Execution of Sequential Searches of Data Resource 41/100 moderate-risk
Improper Handling of Undefined Parameters 41/100 moderate-risk
Path Equivalence: '//multiple/leading/slash' 41/100 moderate-risk
CWE-882 41/100 moderate-risk
ASP.NET Misconfiguration: Use of Identity Impersonation 41/100 moderate-risk
Not Using Complete Mediation 41/100 moderate-risk
Path Traversal: '\..\filename' 40/100 moderate-risk
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') 37/100 moderate-risk
Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 34/100 moderate-risk
Deserialization of Untrusted Data 34/100 moderate-risk
Observable Behavioral Discrepancy 33/100 moderate-risk
Improper Restriction of Operations within the Bounds of a Memory Buffer 27/100 low-risk
Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') 26/100 low-risk
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') 26/100 low-risk
Unrestricted Upload of File with Dangerous Type 25/100 low-risk
Access of Resource Using Incompatible Type ('Type Confusion') 23/100 low-risk
CWE-19 23/100 low-risk
Improper Control of Dynamically-Managed Code Resources 22/100 low-risk
Improper Neutralization of Special Elements used in a Command ('Command Injection') 22/100 low-risk
Signal Handler Race Condition 22/100 low-risk
Improper Control of Generation of Code ('Code Injection') 21/100 low-risk
Direct Request ('Forced Browsing') 21/100 low-risk
CWE-189 21/100 low-risk
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') 20/100 low-risk
Path Traversal: 'dir\..\..\filename' 20/100 low-risk
Improper Handling of Missing Special Element 19/100 low-risk
Path Traversal: '...' (Triple Dot) 19/100 low-risk
Multiple Operations on Resource in Single-Operation Context 19/100 low-risk
Missing Authentication for Critical Function 19/100 low-risk
Improper Handling of Case Sensitivity 19/100 low-risk
XML Injection (aka Blind XPath Injection) 19/100 low-risk
Improper Neutralization of Line Delimiters 19/100 low-risk
Authentication Bypass Using an Alternate Path or Channel 18/100 low-risk
Embedded Malicious Code 18/100 low-risk
Use of Incorrectly-Resolved Name or Reference 18/100 low-risk
Improper Authentication 17/100 low-risk
Improper Restriction of XML External Entity Reference 16/100 low-risk
CWE-361 16/100 low-risk
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') 16/100 low-risk
Detection of Error Condition Without Action 16/100 low-risk
Improper Neutralization of Equivalent Special Elements 16/100 low-risk
CWE-264 15/100 low-risk
Unprotected Alternate Channel 15/100 low-risk
CWE-399 15/100 low-risk
Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') 15/100 low-risk
Out-of-bounds Write 14/100 low-risk
Absolute Path Traversal 14/100 low-risk
Exposure of Core Dump File to an Unauthorized Control Sphere 14/100 low-risk
Inclusion of Functionality from Untrusted Control Sphere 14/100 low-risk
Exposure of Sensitive Information to an Unauthorized Actor 14/100 low-risk
Improper Neutralization of Special Elements Used in a Template Engine 13/100 low-risk
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') 13/100 low-risk
Improper Check for Dropped Privileges 13/100 low-risk
Path Traversal: 'dir/../../filename' 13/100 low-risk
Server-Side Request Forgery (SSRF) 13/100 low-risk
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') 12/100 low-risk
Use of Hard-coded Credentials 12/100 low-risk
Improper Input Validation 12/100 low-risk
Function Call with Incorrectly Specified Arguments 12/100 low-risk
Use After Free 12/100 low-risk
Function Call With Incorrectly Specified Argument Value 12/100 low-risk
Incorrect Calculation of Buffer Size 11/100 low-risk
Files or Directories Accessible to External Parties 11/100 low-risk
Use of Non-Canonical URL Paths for Authorization Decisions 11/100 low-risk
Initialization of a Resource with an Insecure Default 10/100 low-risk
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') 10/100 low-risk
Off-by-one Error 10/100 low-risk
Improper Initialization 9/100 low-risk
Relative Path Traversal 9/100 low-risk
Incorrect Bitwise Shift of Integer 9/100 low-risk
Improper Protection of Alternate Path 9/100 low-risk
Improper Neutralization of Quoting Syntax 9/100 low-risk
Access to Critical Private Variable via Public Method 9/100 low-risk
Exposed Dangerous Method or Function 9/100 low-risk
Authentication Bypass by Primary Weakness 9/100 low-risk
Incorrect Type Conversion or Cast 9/100 low-risk
CWE-255 8/100 low-risk
Weak Password Recovery Mechanism for Forgotten Password 8/100 low-risk
Improperly Implemented Security Check for Standard 8/100 low-risk
CWE-254 8/100 low-risk
Protection Mechanism Failure 7/100 low-risk
Improper Neutralization of Alternate XSS Syntax 7/100 low-risk
Improper Privilege Management 7/100 low-risk
Improper Link Resolution Before File Access ('Link Following') 7/100 low-risk
Improper Encoding or Escaping of Output 7/100 low-risk
Improper Neutralization of Script in Attributes of IMG Tags in a Web Page 7/100 low-risk
Insufficient Type Distinction 7/100 low-risk
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) 7/100 low-risk
Use of Externally-Controlled Format String 7/100 low-risk
Authentication Bypass by Spoofing 7/100 low-risk
URL Redirection to Untrusted Site ('Open Redirect') 7/100 low-risk
Stack-based Buffer Overflow 6/100 low-risk
Storage of File with Sensitive Data Under Web Root 6/100 low-risk
DEPRECATED: Authentication Bypass Issues 6/100 low-risk
Heap-based Buffer Overflow 6/100 low-risk
Incomplete Internal State Distinction 6/100 low-risk
Exposure of Resource to Wrong Sphere 6/100 low-risk
1 2 3 … 8 Next »