CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Yes

Yes

Yes

CWE-73

External Control of File Name or Path

Yes

Yes

CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Yes

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Yes

Yes

Yes

CWE-88

Argument Injection or Modification

Yes

CWE-90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

Yes

CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

Yes

Yes

CWE-103

Struts: Incomplete validate() Method Definition

Yes

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

Yes

CWE-117

Improper Output Neutralization for Logs

Yes

CWE-120

Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

Yes

CWE-122

Heap-based Buffer Overflow

Yes

CWE-125

Out-of-bounds Read

Yes

Yes

CWE-129

Improper Validation of Array Index

Yes

Yes

CWE-134

Use of Externally-Controlled Format String

Yes

CWE-170

Improper NULL termination

Yes

CWE-190

Integer Overflow or Wraparound

Yes

Yes

Yes

CWE-193

Off-by-one Error

Yes

CWE-196

Unsigned to Signed Conversion Error

Yes

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

Yes

Yes

Yes

CWE-242

Use of Inherently Dangerous Function

Yes

CWE-246

J2EE Bad Practices: Direct Use of Sockets

Yes

CWE-250

Execution with Unnecessary Privileges

Yes

CWE-252

Unchecked Return Value

Yes

CWE-256

Plaintext Storage of a Password

Yes

CWE-269

Improper Privilege Management

Yes

Yes

Yes

CWE-273

Improper Check for Dropped Privileges

Yes

CWE-284

Improper Access Control

Yes

CWE-290

Authentication Bypass by Spoofing

Yes

CWE-306

Missing Authentication for Critical Function

Yes

CWE-311

Missing Encryption of Sensitive Data

Yes

Yes

CWE-315

Cleartext Storage of Sensitive Information in a Cookie

Yes

CWE-326

Inadequate Encryption Strength

Yes

Yes

CWE-330

Use of Insufficiently Random Values

Yes

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Yes

CWE-369

Divide By Zero

Yes

Yes

CWE-377

Insecure Temporary File

Yes

CWE-383

J2EE Bad Practices: Direct Use of Threads

Yes

CWE-390

Detection of Error Condition Without Action

Yes

CWE-394

Unexpected Status Code or Return Value

Yes

CWE-398

Indicator of Poor Code Quality

Yes

CWE-401

Missing Release of Memory after Effective Lifetime

Yes

CWE-404

Improper Resource Shutdown or Release

Yes

Yes

Yes

CWE-413

Improper Resource Locking

Yes

CWE-416

Use After Free

Yes

Yes

CWE-426

Untrusted Search Path

Yes

Yes

Yes

CWE-457

Use of Uninitialized Variable

Yes

CWE-464

Addition of Data Structure Sentinel

Yes

CWE-468

Incorrect Pointer Scaling

Yes

CWE-476

NULL Pointer Dereference

Yes

Yes

Yes

CWE-480

Use of Incorrect Operator

Yes

CWE-482

Comparing instead of Assigning

Yes

CWE-486

Comparison of Classes by Name

Yes

CWE-493

Critical Public Variable Without Final Modifier

Yes

CWE-500

Public Static Field Not Marked Final

Yes

CWE-502

Deserialization of Untrusted Data

Yes

Yes

CWE-539

Use of Persistent Cookies Containing Sensitive Information

Yes

CWE-561

Dead Code

Yes

CWE-563

Assignment to Variable without Use

Yes

CWE-568

finalize() Method Without super.finalize()

Yes

CWE-571

Expression is Always True

Yes

Yes

CWE-580

clone() Method Without super.clone()

Yes

CWE-583

finalize() Method Declared Public

Yes

CWE-595

Comparison of Object References Instead of Object Contents

Yes

CWE-606

Unchecked Input for Loop Condition

Yes

CWE-614

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute

Yes

Yes

CWE-665

Improper Initialization

Yes

CWE-672

Operation on a Resource after Expiration or Release

Yes

Yes

CWE-681

Incorrect Conversion between Numeric Types

Yes

CWE-686

Function Call With Incorrect Argument Type

Yes

CWE-704

Incorrect Type Conversion or Cast

Yes

Yes

CWE-754

Improper Check for Unusual or Exceptional Conditions

Yes

CWE-762

Mismatched Memory Management Routines

Yes

CWE-765

Multiple Unlocks of a Critical Resource

Yes

CWE-772

Missing Release of Resource after Effective Lifetime

Yes

Yes

Yes

CWE-786

Access of Memory Location Before Start of Buffer

Yes

CWE-788

Access of Memory Location After End of Buffer

Yes

CWE-805

Buffer Access with Incorrect Length Value

Yes

CWE-807

Reliance on Untrusted Inputs in a Security Decision

Yes

CWE-829

Inclusion of Functionality from Untrusted Control Sphere

Yes

CWE-833

Deadlock

Yes

CWE-843

Access of Resource Using Incompatible Type ('Type Confusion')

Yes

CWE-896

SFP Primary Cluster: Tainted Input

Yes

Yes

CWE-918

Server-Side Request Forgery (SSRF)

Yes

CWE-1032

Security Misconfiguration

Yes

CWE-1037

Processor Optimization Removal or Modification of Security-critical Code

Yes

CWE-1335

Incorrect Bitwise Shift of Integer

Yes