Join our subscribers
CWE Knowledge Base
ImmuniWeb CWE (Common Weakness Enumeration by MITRE) Knowledge Base covers all CWE vulnerabilities that are encountered in ImmuniWeb Security Advisories or detected by ImmuniWeb®. For each entry we try to provide as much information, examples and internal research as possible. Records are being regularly updated.
Some security weaknesses and misconfiguration related to web application that do not really fall under vulnerability section are grouped on the Common Web Application Security Weaknesses page. You can also view our CVSS calculator.
CWE-22 Path Traversal
This weakness describes improper filtering of pathname to a restricted directory.
CWE-78 OS Command Injection
This weakness describes improper neutralization of special elements which results in modification of the OS command.
CWE-79 Cross-Site Scripting
This weakness describes improper neutralization of input during web page generation.
CWE-89 SQL Injection
This weakness type describes improper neutralization of special elements used in an SQL query.
CWE-90 LDAP Injection
This weakness describes improper neutralization of special elements used in LDAP queries.
CWE-91 XML Injection
This weakness describes improper neutralization of special elements used in XML queries.
CWE-94 Code Injection
This weakness describes improper control of code generation.
CWE-98 PHP File Inclusion
This weakness describes improper control of filename within Include or Require statements in a PHP program.
CWE-113 HTTP Response Splitting
This weakness describes improper neutralization of CRLF sequences in HTTP headers.
CWE-119 Buffer Errors
This weakness describes improper restriction of operations within the bounds of a memory buffer.
CWE-130 Improper Handling of Length Parameter Inconsistency
This weakness describes improper handling of a length field for associated data.
CWE-193 Off-by-one Error
This weakness occurs when a program uses an improper maximum or minimum value that is one more or one less than the proper value.
CWE-200 Information Exposure
This weakness describes intentional or unintentional disclosure of information that is considered sensitive.
CWE-211 Information Exposure Through Externally-Generated Error Message
This weakness describes information exposure case, where software generates a message with potentially sensitive data and outputs it.
CWE-236 Improper Handling of Undefined Parameters
This weakness describes a case when application uses undefined parameter, field, or argument.
CWE-276 Incorrect Default Permissions
This weakness describes a case where software sets insecure permissions to objects on a system.
CWE-284 Improper Access Control
This weakness describes a failure in the AAA security model.
CWE-285 Improper Authorization
This weakness describes improper mechanisms of user's authorization.
CWE-287 Improper Authentication
This weakness describes improper mechanisms of user's identity verification.
CWE-297 Improper Validation of Certificate with Host Mismatch
This weakness describes Improper Validation of Certificate with Host Mismatch.
CWE-306 Missing Authentication for Critical Function
This weakness describes Missing Authentication for Critical Function.
CWE-312 Cleartext Storage of Sensitive Information
This weakness describes a case where sensitive information is stored in clear text in location, accessible by other users.
CWE-345 Insufficient Verification of Data Authenticity
This weakness describes improper or absent verification of input data authenticity.
CWE-352 Cross-Site Request Forgery
This weakness describes improper or absent verification of the HTTP request origin.
CWE-384 Session Fixation
This weakness describes a case where application incorrectly handles session identifiers when establishing new sessions.
CWE-427 Uncontrolled Search Path Element
This weakness is caused by applications passing an insufficiently qualified path when loading an external library.
CWE-434 Unrestricted Upload of File with Dangerous Type
This weakness describes improper validation of file types when uploading files.
CWE-476 NULL Pointer Dereference
This weakness describes an application who dereferences a pointer that ought to be valid but indeed is NULL.
CWE-521 Weak Password Requirements
This weakness described a case where application implements a poor password policy allowing users to create short or very simple passwords.
CWE-601 Open Redirect
This weakness describes improper sanitization of input that is used to redirect users to external websites.
CWE-611 Improper Restriction of XML External Entity Reference ('XXE')
The weakness describes the case where XML parser is not correctly configured and allows the attacker to directly interact with local or external files.
CWE-613 Insufficient Session Expiration
This weakness describes a case of insufficient session expiration, which allows an attacker to use existing session identifier to log in into the application.
CWE-618 Exposed Unsafe ActiveX Method
This weakness describes exposure of dangerous ActiveX methods that perform actions outside the browser's security model.
CWE-671 Lack of Administrator Control over Security
This weakness describes a case where implemented security features do not grant administrators full control over product security.
CWE-798 Use of Hard-coded Credentials
The weakness describes a case where hardcoded access credentials are stored within application code.
CWE-799 Improper Control of Interaction Frequency
This vulnerability described the case where the application does not control the number and frequency of unsuccessful requests allowing brute-force attack.
CWE-822 Untrusted Pointer Dereference
This weakness occurs where software uses untrusted input as a pointer value.
CWE-835 Infinite Loop
This weakness describes a case when a loop cannot reach an exit condition.
CWE-918 Server-Side Request Forgery (SSRF)
This weakness describes a case where the attacker can leverage the ability of a web application to perform unauthorized requests to internal or external systems.
CWE-942 Overly Permissive Cross-domain Whitelist
The weakness describes a case where software uses cross-domain policy, which includes domains that should not be trusted.
Copyright Disclaimer: Any above-mentioned content can be copied and used for non-commercial purposes only if proper credit to ImmuniWeb is given.
