CWE
Introduction
CWE™(Common Weakness Enumeration) aims to provide a common base to identify the type of software weakness (vulnerability).. International in scope and free for public use, CWE™ provides a unified, measurable set of software weaknesses that will enable more effective discussion, description, selection, and use of software security tools and services that can find these weaknesses in source code. CWE™ gives a hierarchically structured list of weakness types to help identifying software vulnerabilities that come in a wide variety, such as SQL injection, cross-site scripting and buffer overflow.
CWE Compatible Certification
Security Reviewer Suite is CWE Compatible Certified. We have achieved the final stage of MITRE's formal CWE Compatibility Program and are now "Officially CWE-Compatible." We are now eligible to use the CWE-Compatible Product/Service logo, and we completed and reviewed "CWE Compatibility Requirements Evaluation" questionnaires are posted here and on the Organizations Participating page as part of their product listings
CWE for Software Resilience Analysis
Security Reviewer SRA analyzes applications for discovering Security, Dead code and Best Practices vulnerabilities, both for Static Analysis and for Software Resilience Analysis.
Automated Source Code Reliability Measure
The quality measure elements (weaknesses violating software quality rules) that compose the Automated
Source Code Reliability Measure are presented in the following table.
This measure contains 35 parent weaknesses and 39 contributing weaknesses (children in the CWE) that represent variants of these weaknesses. The CWE
numbers for contributing weaknesses is presented in light blue cells immediately below the parent weakness
whose CWE number is in a dark blue cell.
For a complete list of covered CWE issues, see CISQ Riability Weakeness doc.
CWE for Security, Dead code and Best Practices Rules
Security Reviewer provides a consistent number of CWE 4.9 rules designed for detecting vulnerabilities inside source code. Each rule defines up to 12 variants and up to 50 API on which will applied, ande has its own CWE™ Identifier and Description, with related MITRE™ web site link, on which you can do a Search:
You can Export the rules list in Excel CSV format with CWE™ details:
CWE™ Ruleset
You can execute the Static Analysis with CWE™ ruleset:
CWE™ Results
After Static Analysis completion, even you chose a different RuleSet, each vulnerability detected has always its own CWE™ ID with the related web link:
You can list and export in Excel CSV all CWEs found during the Static Analysis:
In the Static Analysis Reports, each rule's violation shows the related clickable CWE™ ID:
CWE™ Capabilities
Requirement | Capability | Fulfillment Method |
CWE | Security, Dead code, Best practices Rules, Analysis Results and Reports | By using the search function in Security Reviewer, the vulnerability countermeasure information database, users are able to conduct a search using CWE identifiers as the keyword. |
CWE | Analysis Results | CWE identifiers are displayed in the “Results” section within each vulnerability countermeasure information pages. |
Reports | CWE identifier is displayed in the “Violations” section of the detailed information window of each vulnerability countermeasure information. | |
CWE | Security Reviewer Knowledge Center, User Guide | This material document will become the documentation necessary to describe and demonstrate CWE, CWE association and methods used to satisfy the compatibility requirements. |
Mapping | Security, Dead code, Best practices Rules, Analysis Results and Reports | Security Reviewer supports many of CWE 4.4 IDs related to Static Analysis |
Supported CWE™ per Programming Language (Tiobe Index Top 10)
CWE ID | Description | Language | Rule | Severity |
111 | Avoid invoking a native method | .NET | NativeNET | 3 |
113 | Header Checking Disabled | .NET | Header_Checking_Disabled | 3 |
119 | Array Index Out Of Bounds | .NET | C67VB | 1 |
200 | Deprecated use of Functions returning a Variant | .NET | DEPRECATED_VB_Variant | 2 |
200 | Avoid using of System.Console 'Write()' or 'WriteLine()' statements | .NET | Securitymisc07 | 3 |
200 | Use of deprecated ActiveX/OCX components | .NET | DEPRECATED_VB | 3 |
200 | Deprecated type or function | .NET | deprecatedObjectVB | 3 |
200 | Deprecated Variable type | .NET | deprecatedVariableVB | 3 |
200 | Use of deprecated win32 API | .NET | DEPRECATED_API | 3 |
200 | Deprecated Win32 API returning ANY | .NET | DEPRECATED_API_ANY | 3 |
209 | Improper call of 'StackTrace' property of System.Exception | .NET | Securitymisc08 | 3 |
209 | ASP.NET Misconfiguration (Impersonation) | .NET | ACIdentity | 1 |
209 | ASP.NET Misconfiguration (ViewStateMac Disabled) | .NET | ACStateMac | 1 |
209 | ASP.NET Misconfiguration (Header Checking Disabled) | .NET | ACHeaderChecking | 1 |
212 | public instance fields accessed by untrusted class | .NET | Idor06 | 4 |
212 | public inner classes accessed from untrusted classes | .NET | Idor08 | 4 |
215 | WCF Misconfiguration (Debug Information) | .NET | WCF_Debug_Information | 3 |
248 | Improper invoking of an exception filtering method | .NET | Securitymisc09 | 3 |
254 | WCF Misconfiguration (Unsafe Revocation Mode) | .NET | WCF_Unsafe_Revocation_Mode | 2 |
254 | WCF Misconfiguration (Weak Token) | .NET | WCF_Weak_Token | 2 |
257 | Avoid recreating string from SecureString | .NET | Ftorurla01 | 2 |
257 | Avoid using of String for password | .NET | Ics04 | 2 |
285 | WCF Misconfiguration (Anonymous MSMQ) | .NET | WCF_Anonymous_MSMQ | 1 |
327 | Hardcoded connection strings | .NET | Itl02 | 3 |
327 | Static Random Number Generator | .NET | Ics07VB | 2 |
327 | Static Random Number Generator | .NET | Ics07 | 2 |
327 | Poor Seeding | .NET | PoorSeeding | 2 |
327 | Improper change of RSA/DSA KeySize property | .NET | Ics03 | 1 |
327 | Hardcoded connection strings VB | .NET | Itl02VB | 3 |
352 | Unsecure local 'Cookie' object (XML) | .NET | cookieXML_NET | 3 |
388 | Ensure all exceptions are logged in the error blocks | .NET | Securitymisc03 | 2 |
388 | Avoid using of 'throw' exceptions inside destructors | .NET | Securitymisc06 | 3 |
388 | WCF Misconfiguration (Insufficient Audit Failure Handling) | .NET | WCF_Insufficient_Audit | 3 |
388 | Poor error handling | .NET | OnErrorVB | 2 |
400 | Denial of Service (Sleep) | .NET | C14VB | 1 |
400 | Denial of Service Threat | .NET | Injection23VB | 1 |
404 | Close DB connections in 'finally' block | .NET | Injection15 | 2 |
404 | Unreleased Resource | .NET | Unreleased | 1 |
404 | Unreleased Resource | .NET | Injection14VB | 1 |
404 | Close DB objects in 'finally' block | .NET | Injection14 | 1 |
495 | Static fields that are not readonly | .NET | Idor07 | 4 |
495 | public instance fields accessed by untrusted classes | .NET | Idor02 | 3 |
497 | Information Leakage (DDE) | .NET | VBDDE | 3 |
497 | LSET and RSET functions are deprecated fields not string | .NET | VBLRSET | 3 |
511 | Logic-Time Bomb (.NET) | .NET | TIMEBOMB_NET | 2 |
532 | Improper using of System.Console.Write() or WriteLine() in Catch blocks | .NET | Securitymisc05 | 2 |
581 | Improper equality using hash codes | .NET | Ics01 | 1 |
639 | System Error printed out | .NET | CE6VB | 3 |
651 | WCF Misconfiguration (Service Enumeration) | .NET | WCF_Service_Enumeration | 3 |
665 | Readonly Array fields should be cloned | .NET | Idor01 | 3 |
665 | Improper 'virtual' declaration of a 'Clone()' method | .NET | Securitymisc11 | 3 |
667 | Improrer locking of typed Objects | .NET | Idor10 | 3 |
671 | Improper modification to security settings | .NET | Securitymisc15 | 4 |
676 | Avoid using System Milliseconds | .NET | Securitymisc14 | 4 |
676 | Setting Timer Interval to zero is deprecated | .NET | Securitymisc14VB | 4 |
73 | Setting Manipulation | .NET | Injection04SM | 1 |
732 | Improper deny of SkipVerification security permission | .NET | Ics02 | 1 |
77 | [RunPE-Packed] Malware Suspicious behaviour | .NET | PEPacked | 1 |
77 | [RunPE] Malware Suspicious behaviour | .NET | PE | 1 |
778 | WCF Misconfiguration (Insufficient Logging) | .NET | WCF_Insufficient_Logging | 3 |
78 | Improper call to late-binding methods | .NET | Securitymisc10 | 3 |
79 | Reflected XSS ASP-ASPX / Security Decisions Via Untrusted Inputs | .NET | Injection26 | 3 |
798 | Avoid using of hardcoded string for password related parameters | .NET | Ics05 | 2 |
822 | Exposing Pointer type fields | .NET | Idor03 | 2 |
822 | Deprecated ObjPtr VarPtr StrPtr | .NET | idor03VB | 2 |
829 | Class outside namespace | .NET | Securitymisc02 | 2 |
863 | Access Control: Database (VB) | .NET | accessControlVB | 1 |
89 | SQL Connection Injection | .NET | Injection11 | 1 |
111 | Avoid user-defined Native methods (JSNI) | ALL | NativeJS | 3 |
117 | Log Forging | ALL | Injection19 | 1 |
15 | External Control of System or Configuration Setting | ALL | ExternalSCS | 2 |
190 | Integer Overflow | ALL | IntegerOverflow | 1 |
200 | Deprecated DOS command | ALL | DeprecatedDOScommand | 1 |
200 | toString on Array | ALL | ArrayToString | 1 |
200 | Reflected Exposing of Sensitive data | ALL | Securitymisc17 | 3 |
209 | Hardcoded credentials (JavaScript) | ALL | Hardcodedjs | 1 |
213 | Exposing of Sensitive data | ALL | Securitymisc01 | 1 |
22 | Path Traversal | ALL | Injection05 | 1 |
242 | Dangerous Function | ALL | deprecatedObjectFunction | 1 |
311 | Hardcoded credentials | ALL | HardcodedCredentials | 1 |
326 | Insecure algorithms for cryptography | ALL | Ics06 | 2 |
327 | Weak Cryptography (JavaScript) | ALL | Cryptographic_JS | 2 |
327 | Weak Cryptography (SQL) | ALL | Cwe327SQL | 2 |
327 | Insecure TLS configuration | ALL | TLS_XML | 2 |
328 | Insecure TLS Cipher (Medium) | ALL | TLS_MEDIUM | 3 |
328 | Insecure SSL Cipher/Protocol | ALL | SSL | 1 |
328 | Insecure SSL Cipher (Medium) | ALL | SSL_MEDIUM | 3 |
328 | Insecure SSL configuration | ALL | SSL_XML | 1 |
328 | Weak TLS Cipher/Protocol | ALL | TLS | 2 |
330 | Use window.Crypto.getRandomValues() | ALL | Ics07JS | 2 |
344 | Hardcoded IP address | ALL | Itl03 | 1 |
349 | JavaScript DB Injection | ALL | DBInjectionJS | 1 |
352 | Cross Site Request Forgery (JavaScript) - Missed datafilter | ALL | Csrfjs | 2 |
352 | HTTP Response Splitting | ALL | Csrf01 | 1 |
352 | Cross Site Request Forgery (JavaScript) | ALL | Csrfjs_2 | 2 |
359 | e-mail address in Source Code | ALL | EmailCode | 3 |
36 | Absolute Path in comment | ALL | Securitymisc19 | 4 |
36 | Absolute path to a Shared Resource in source code | ALL | AbsoluteResource | 3 |
36 | Absolute Path in Source Code | ALL | Securitymisc18 | 3 |
388 | Missing Custom Errors Page(s) | ALL | PageXML | 3 |
388 | Excessive Session Timeout | ALL | ExcessiveTimeOutXML | 3 |
388 | Avoid return break continue or throw in finally block | ALL | FinallyReturn | 3 |
395 | Denial of Service Threat - Resource consumption (CPU) | ALL | Sr_NullPointerException | 1 |
400 | Denial of Service (JavaScript) | ALL | DenialOfService_JS | 1 |
434 | Unrestricted Upload | ALL | InjectionUnrestricted | 1 |
447 | Unsupported Feature | ALL | UnsupportedIEW7 | 1 |
448 | Deprecated Element | ALL | deprecatedBrowserIE | 2 |
465 | Second order Injection / Security Decisions Via Untrusted Inputs | ALL | Injection18 | 3 |
476 | Null Pointer Deference (Nullable object) | ALL | NullableObject | 1 |
476 | Numeric method returns null | ALL | ReturnNumberNull | 3 |
476 | Null Pointer Deference (throw null) | ALL | NullableThrow | 1 |
476 | Null Pointer Deference (Nullable formal parameter) | ALL | NullableFormalParameter | 1 |
476 | Boolean Method returns null | ALL | NullableReturns | 2 |
477 | Statement is Deprecated (JavaScript) | ALL | deprecatedJS | 3 |
478 | switch/Select' statement should have a 'default'/'case else' condition | ALL | CWE200SC | 4 |
494 | Download of Code Without Integrity Check | ALL | Idor494 | 2 |
501 | Cross-Session Contamination (JavaSCript) | ALL | CrossSessionContamination_JS | 1 |
501 | Trusted Bound Violation | ALL | Injection24 | 1 |
501 | Trust Boundary Violation | ALL | Injection24_2 | 1 |
511 | Logic-Time Bomb (DOS Command) | ALL | DangerousDOSCommand_BOMB | 2 |
522 | Password in Configuration file | ALL | Pcf | 1 |
531 | Unit Test Libraries should be used in a separate source file | ALL | CWE395TEST_2 | 3 |
531 | TestCase should be in a separate source file | ALL | CWE395TEST_1 | 2 |
564 | SQL Injection (HibernateJS) | ALL | Injection564 | 1 |
601 | HTTP Redirect | ALL | Csrf03 | 1 |
610 | File or Directory Name Manipulation (JavaScript) | ALL | FileManipulation_JS | 1 |
612 | JavaScript IndexedDB Injection | ALL | IndexedDBInjectionJS | 1 |
614 | Insecure Cookie (JavaScript) | ALL | idorjs_unsecure_cookie | 1 |
614 | Cookie Session too long (JavaScript) | ALL | idorjs_cookie | 2 |
614 | Insecure Cookie | ALL | IdorCOOKIE | 3 |
614 | Insecure Cookie Path (JavaScript) | ALL | idorjs_unsecure_cookie_path | 2 |
639 | Avoid Debug/Trace mode in production | ALL | BrokenauthXML | 5 |
642 | Improper Granting of all privileges on an object | ALL | idorjs | 1 |
664 | Unsecure XML setting | ALL | IdorXML | 3 |
668 | Improper Logger (JavaScript) | ALL | Securitymisc12js | 3 |
669 | Avoid using Components NW.js | ALL | NWJS | 1 |
669 | Avoid using Components with Known Vulnerabilities in POM-JAR or Project File (Low) | ALL | Uckv08 | 3 |
669 | Avoid using Components with Known Vulnerabilities (Medium) | ALL | Uckv02 | 2 |
669 | Avoid using Components with Known Vulnerabilities in POM-JAR or Project File (Medium) | ALL | Uckv07 | 2 |
669 | Avoid using Components with Known Vulnerabilities (Low) | ALL | Uckv03 | 3 |
669 | Avoid using Components with Known Vulnerabilities (High) | ALL | Uckv01 | 1 |
669 | No Project Files were found | ALL | Uckv04 | 1 |
669 | No POM.XML Files were found | ALL | Uckv05 | 1 |
669 | Avoid using Components with Known Vulnerabilities in POM-JAR or Project File (High) | ALL | Uckv06 | 1 |
676 | Dangerous DOS command | ALL | DangerousDOScommand | 1 |
676 | Missing wrapping of 'dangerous' functions | ALL | Securitymisc13 | 3 |
676 | Dangerous Linux command | ALL | DangerousLinuxcommand | 1 |
77 | Code Injection - Tag | ALL | Injection01Tag | 1 |
77 | Command Injection | ALL | Injection01 | 1 |
78 | OS Command Injection (JavaScript) | ALL | OSINJECTION_JS | 1 |
79 | Reflected XSS (JavaScript) / Security Decisions Via Untrusted Inputs | ALL | XSS_JS | 3 |
79 | Cross-Site Scripting (Web2py) | ALL | PYTHON_S60 | 1 |
79 | Cross Site Scripting / Security Decisions Via Untrusted Inputs | ALL | Xss01 | 1 |
798 | User-Password-Profile-ID in Comment | ALL | Uohcc01 | 4 |
798 | Hardcoded IP address in comment | ALL | Itl04 | 4 |
798 | Suspicious Hardcoded URL/URI | ALL | Dangerous_Hardcoded_URL | 3 |
863 | Access Control: Database (JavaScript) | ALL | accessControl_JS | 1 |
88 | Avoid SELECT * statements | ALL | Injection17 | 3 |
88 | NET injection | ALL | Injection20 | 1 |
89 | SQL Query Injection | ALL | Injection10 | 1 |
90 | LDAP Injection | ALL | Injection07 | 1 |
90 | Possible LDAP Injection | ALL | InjectionCert | 3 |
91 | Weak XML Schema (tag Any) | ALL | XSDAny | 3 |
91 | Weak XML Schema (type Unbounded) | ALL | XSDmaxOccurs | 3 |
91 | XPath Injection | ALL | Injection13 | 1 |
91 | Weak XML Schema (Lax-Skip tags) | ALL | LaxSkip | 1 |
94 | CORS - Overly permissive target origin | ALL | CodeInjection_JS3 | 1 |
94 | JQuery Code Injection (JavaScript) | ALL | jqueryjs | 1 |
94 | Second Order Code Injection (JavaScript) | ALL | MooToolsjs | 1 |
94 | Overly permissive target origin | ALL | CodeInjection_JS2 | 1 |
94 | HTML Injection (JavaScript) | ALL | HTMLInjectionJS | 1 |
94 | Code Injection (JavaScript) | ALL | CodeInjection_JS | 1 |
94 | Second Order File Injection (JavaScript) | ALL | MooToolsFilejs | 1 |
94 | Second Order Unsecure JSON decoding (JavaScript) | ALL | MooToolsJsonjs | 1 |
95 | Eval Injection (JavaScript) | ALL | EvalInjection | 1 |
96 | SQL Injection (JavaScript) | ALL | SQL_Injection_JS | 1 |
97 | Server Side Include (SSI) Injection | ALL | SSI | 1 |
99 | Resource Injection (JavaScript) | ALL | ResourceInjection_JS | 1 |
119 | Array Index Out Of Bounds | CCPP | C67 | 1 |
119 | Buffer Overflow (Containers) | CCPP | C03 | 1 |
120 | Second order Buffer Overflow (sizeof of sizeof) | CCPP | C46 | 3 |
120 | Buffer Overflow (Buffer) | CCPP | C08 | 1 |
120 | Buffer Overflow (Array pointer) | CCPP | C04 | 1 |
120 | Memory Leak (ctype isalnum|isalpha|isascii|is..) | CCPP | C35 | 2 |
120 | Buffer Overflow (Array Index) | CCPP | C02 | 2 |
121 | scanf without field width limits | CCPP | C86 | 3 |
122 | Buffer Overflow (strncpy/memset/memcpy) | CCPP | C10 | 1 |
125 | Buffer Access Out Of Bounds | CCPP | C68 | 1 |
125 | Buffer Overflow (Array) | CCPP | C07 | 1 |
125 | Second order Buffer Overflow (Array) | CCPP | C49 | 3 |
126 | Second order Buffer Overflow (strncpy) | CCPP | C50 | 2 |
126 | Buffer Overlap (s[n]printf()) | CCPP | C11 | 2 |
129 | Buffer Overflow (Index is out of range) | CCPP | C06 | 1 |
131 | Avoid using of Unitialized Variable (Wrong buffer write) | CCPP | C62 | 1 |
134 | sprintf: insufficient format string parameters | CCPP | C87 | 3 |
134 | Stack Overflow (scanf) | CCPP | C81 | 3 |
135 | Incorrect Calculation of Multi-Byte String Length | CCPP | C135 | 3 |
170 | Buffer Not Zero Terminated (After a call to a function) | CCPP | C70 | 1 |
190 | Buffer Overflow (strncat) | CCPP | C09 | 1 |
195 | Stack Overflow (printf sint) | CCPP | C79 | 3 |
196 | Stack Overflow (printf uint) | CCPP | C80 | 3 |
20 | Memory Leak (Same iterator) | CCPP | C24 | 2 |
200 | Information Leakage (#pragma ibm critical) | CCPP | CE11 | 3 |
214 | Information Leakage (#pragma ibm parallel_loop) | CCPP | CE12 | 3 |
233 | Invalid Length Modifier (printf) | CCPP | C73 | 3 |
243 | Creation of chroot Jail Without Changing Working Directory | CCPP | CE243 | 1 |
256 | Plaintext Storage of a Password | CCPP | CE256 | 2 |
257 | Avoid using of String for password | CCPP | CE7 | 2 |
311 | Memory Leak (Unsafe root Class) | CCPP | C29 | 2 |
327 | Cryptographic key too short | CCPP | CE8 | 3 |
344 | Hardcoded IP address | CCPP | CE9 | 1 |
369 | Division by zero | CCPP | C15 | 1 |
369 | Potential division by zero | CCPP | C42 | 2 |
388 | Invalid c_str() after a call | CCPP | C20 | 2 |
388 | Invalid c_str() after throwing exception | CCPP | C21 | 2 |
396 | Improper Logger (Rethrow) | CCPP | C41 | 1 |
398 | Memory Leak (Missing virtual destructor) | CCPP | C34 | 2 |
399 | Memory Leak (Class provides constructors) | CCPP | C27 | 2 |
400 | Denial of Service (usleep) | CCPP | C14 | 1 |
401 | Memory Leak (Copy 'auto_ptr' pointer) | CCPP | C33 | 2 |
401 | Memory Leak (when executing) | CCPP | C39 | 1 |
404 | Resource Leak (when executing) | CCPP | C40 | 1 |
456 | Avoid using of Unitialized Variable (Leak) | CCPP | C60 | 1 |
457 | Avoid using of Unitialized Variable (Member Variable) | CCPP | C59 | 1 |
457 | Memory Leak (Data not initialized) | CCPP | C28 | 2 |
466 | Stack Overflow (Wrong returning reference) | CCPP | C57 | 2 |
467 | Buffer Overflow (pointer) | CCPP | C01 | 1 |
467 | Second order Buffer Overflow (sizeof for Array) | CCPP | C48 | 3 |
468 | Stack Overflow (printf *) | CCPP | C77 | 3 |
476 | Second order null Pointer Dereference (null Pointer) | CCPP | C51 | 2 |
476 | Second order null Pointer Dereference (shifting negative) | CCPP | C53 | 2 |
476 | Memory Leak (New) | CCPP | C37 | 1 |
477 | Obsolete Functions | CCPP | C32 | 3 |
480 | Assign Bool To Pointer (converting bool value to address) | CCPP | C69 | 3 |
487 | Invalid Scope Object ('auto-ptr' pointer) | CCPP | C23 | 1 |
495 | Stack Overflow (local Array variable) | CCPP | C56 | 2 |
497 | Information Leakage (#pragma ibm schedule) | CCPP | CE13 | 3 |
511 | Logic-Time Bomb (C/C++) | CCPP | TIMEBOMB_C | 2 |
523 | Avoid using of non-SSL communications | CCPP | CE4 | 2 |
531 | Unit Test Libraries should be used in a separate source file | CCPP | CWE395TEST_2_CPP | 3 |
532 | Improper Logger (Destructor) | CCPP | C30 | 1 |
534 | Ensure all exceptions are either logged with a standard logger or rethrow | CCPP | C31 | 2 |
562 | Stack Overflow (auto-variable) | CCPP | C55 | 2 |
562 | Stack Overflow (temporary) | CCPP | C58 | 2 |
569 | Memory Leak (Class contains a std::string) | CCPP | C26 | 2 |
569 | Second order Buffer Overflow (strlen/sizeof) | CCPP | C44 | 3 |
569 | Second order Buffer Overflow (sizeof) | CCPP | C45 | 3 |
590 | Memory Leak (Memory allocated not freed) | CCPP | C25 | 2 |
617 | Call Settings manipulation (Assert) | CCPP |