CWE

Requirement

Capability

Fulfillment Method

CWE
Searchability

Security, Dead code, Best practices Rules, Analysis Results and Reports

By using the search function in Security Reviewer, the vulnerability countermeasure information database, users are able to conduct a search using CWE identifiers as the keyword.

CWE
Output

Analysis Results

CWE identifiers are displayed in the “Results” section within each vulnerability countermeasure information pages.

Reports

CWE identifier is displayed in the “Violations” section of the detailed information window of each vulnerability countermeasure information.

CWE
Documentation

Security Reviewer Knowledge Center, User Guide

This material document will become the documentation necessary to describe and demonstrate CWE, CWE association and methods used to satisfy the compatibility requirements.

Mapping
Accuracy

Security, Dead code, Best practices Rules, Analysis Results and Reports

Security Reviewer supports many of CWE 4.4 IDs related to Static Analysis

CWE ID

Description

Language

Rule

Severity

111

Avoid invoking a native method

.NET

NativeNET

3

113

Header Checking Disabled

.NET

Header_Checking_Disabled

3

119

Array Index Out Of Bounds

.NET

C67VB

1

200

Deprecated use of Functions returning a Variant

.NET

DEPRECATED_VB_Variant

2

200

Avoid using of System.Console 'Write()' or 'WriteLine()' statements

.NET

Securitymisc07

3

200

Use of deprecated ActiveX/OCX components

.NET

DEPRECATED_VB

3

200

Deprecated type or function

.NET

deprecatedObjectVB

3

200

Deprecated Variable type

.NET

deprecatedVariableVB

3

200

Use of deprecated win32 API

.NET

DEPRECATED_API

3

200

Deprecated Win32 API returning ANY

.NET

DEPRECATED_API_ANY

3

209

Improper call of 'StackTrace' property of System.Exception

.NET

Securitymisc08

3

209

ASP.NET Misconfiguration (Impersonation)

.NET

ACIdentity

1

209

ASP.NET Misconfiguration (ViewStateMac Disabled)

.NET

ACStateMac

1

209

ASP.NET Misconfiguration (Header Checking Disabled)

.NET

ACHeaderChecking

1

212

public instance fields accessed by untrusted class

.NET

Idor06

4

212

public inner classes accessed from untrusted classes

.NET

Idor08

4

215

WCF Misconfiguration (Debug Information)

.NET

WCF_Debug_Information

3

248

Improper invoking of an exception filtering method

.NET

Securitymisc09

3

254

WCF Misconfiguration (Unsafe Revocation Mode)

.NET

WCF_Unsafe_Revocation_Mode

2

254

WCF Misconfiguration (Weak Token)

.NET

WCF_Weak_Token

2

257

Avoid recreating string from SecureString

.NET

Ftorurla01

2

257

Avoid using of String for password

.NET

Ics04

2

285

WCF Misconfiguration (Anonymous MSMQ)

.NET

WCF_Anonymous_MSMQ

1

327

Hardcoded connection strings

.NET

Itl02

3

327

Static Random Number Generator

.NET

Ics07VB

2

327

Static Random Number Generator

.NET

Ics07

2

327

Poor Seeding

.NET

PoorSeeding

2

327

Improper change of RSA/DSA KeySize property

.NET

Ics03

1

327

Hardcoded connection strings VB

.NET

Itl02VB

3

352

Unsecure local 'Cookie' object (XML)

.NET

cookieXML_NET

3

388

Ensure all exceptions are logged in the error blocks

.NET

Securitymisc03

2

388

Avoid using of 'throw' exceptions inside destructors

.NET

Securitymisc06

3

388

WCF Misconfiguration (Insufficient Audit Failure Handling)

.NET

WCF_Insufficient_Audit

3

388

Poor error handling

.NET

OnErrorVB

2

400

Denial of Service (Sleep)

.NET

C14VB

1

400

Denial of Service Threat

.NET

Injection23VB

1

404

Close DB connections in 'finally' block

.NET

Injection15

2

404

Unreleased Resource

.NET

Unreleased

1

404

Unreleased Resource

.NET

Injection14VB

1

404

Close DB objects in 'finally' block

.NET

Injection14

1

495

Static fields that are not readonly

.NET

Idor07

4

495

public instance fields accessed by untrusted classes

.NET

Idor02

3

497

Information Leakage (DDE)

.NET

VBDDE

3

497

LSET and RSET functions are deprecated fields not string

.NET

VBLRSET

3

511

Logic-Time Bomb (.NET)

.NET

TIMEBOMB_NET

2

532

Improper using of System.Console.Write() or WriteLine() in Catch blocks

.NET

Securitymisc05

2

581

Improper equality using hash codes

.NET

Ics01

1

639

System Error printed out

.NET

CE6VB

3

651

WCF Misconfiguration (Service Enumeration)

.NET

WCF_Service_Enumeration

3

665

Readonly Array fields should be cloned

.NET

Idor01

3

665

Improper 'virtual' declaration of a 'Clone()' method

.NET

Securitymisc11

3

667

Improrer locking of typed Objects

.NET

Idor10

3

671

Improper modification to security settings

.NET

Securitymisc15

4

676

Avoid using System Milliseconds

.NET

Securitymisc14

4

676

Setting Timer Interval to zero is deprecated

.NET

Securitymisc14VB

4

73

Setting Manipulation

.NET

Injection04SM

1

732

Improper deny of SkipVerification security permission

.NET

Ics02

1

77

[RunPE-Packed] Malware Suspicious behaviour

.NET

PEPacked

1

77

[RunPE] Malware Suspicious behaviour

.NET

PE

1

778

WCF Misconfiguration (Insufficient Logging)

.NET

WCF_Insufficient_Logging

3

78

Improper call to late-binding methods

.NET

Securitymisc10

3

79

Reflected XSS ASP-ASPX / Security Decisions Via Untrusted Inputs

.NET

Injection26

3

798

Avoid using of hardcoded string for password related parameters

.NET

Ics05

2

822

Exposing Pointer type fields

.NET

Idor03

2

822

Deprecated ObjPtr VarPtr StrPtr

.NET

idor03VB

2

829

Class outside namespace

.NET

Securitymisc02

2

863

Access Control: Database (VB)

.NET

accessControlVB

1

89

SQL Connection Injection

.NET

Injection11

1

111

Avoid user-defined Native methods (JSNI)

ALL

NativeJS

3

117

Log Forging

ALL

Injection19

1

15

External Control of System or Configuration Setting

ALL

ExternalSCS

2

190

Integer Overflow

ALL

IntegerOverflow

1

200

Deprecated DOS command

ALL

DeprecatedDOScommand

1

200

toString on Array

ALL

ArrayToString

1

200

Reflected Exposing of Sensitive data

ALL

Securitymisc17

3

209

Hardcoded credentials (JavaScript)

ALL

Hardcodedjs

1

213

Exposing of Sensitive data

ALL

Securitymisc01

1

22

Path Traversal

ALL

Injection05

1

242

Dangerous Function

ALL

deprecatedObjectFunction

1

311

Hardcoded credentials

ALL

HardcodedCredentials

1

326

Insecure algorithms for cryptography

ALL

Ics06

2

327

Weak Cryptography (JavaScript)

ALL

Cryptographic_JS

2

327

Weak Cryptography (SQL)

ALL

Cwe327SQL

2

327

Insecure TLS configuration

ALL

TLS_XML

2

328

Insecure TLS Cipher (Medium)

ALL

TLS_MEDIUM

3

328

Insecure SSL Cipher/Protocol

ALL

SSL

1

328

Insecure SSL Cipher (Medium)

ALL

SSL_MEDIUM

3

328

Insecure SSL configuration

ALL

SSL_XML

1

328

Weak TLS Cipher/Protocol

ALL

TLS

2

330

Use window.Crypto.getRandomValues()

ALL

Ics07JS

2

344

Hardcoded IP address

ALL

Itl03

1

349

JavaScript DB Injection

ALL

DBInjectionJS

1

352

Cross Site Request Forgery (JavaScript) - Missed datafilter

ALL

Csrfjs

2

352

HTTP Response Splitting

ALL

Csrf01

1

352

Cross Site Request Forgery (JavaScript)

ALL

Csrfjs_2

2

359

e-mail address in Source Code

ALL

EmailCode

3

36

Absolute Path in comment

ALL

Securitymisc19

4

36

Absolute path to a Shared Resource in source code

ALL

AbsoluteResource

3

36

Absolute Path in Source Code

ALL

Securitymisc18

3

388

Missing Custom Errors Page(s)

ALL

PageXML

3

388

Excessive Session Timeout

ALL

ExcessiveTimeOutXML

3

388

Avoid return break continue or throw in finally block

ALL

FinallyReturn

3

395

Denial of Service Threat - Resource consumption (CPU)

ALL

Sr_NullPointerException

1

400

Denial of Service (JavaScript)

ALL

DenialOfService_JS

1

434

Unrestricted Upload

ALL

InjectionUnrestricted

1

447

Unsupported Feature

ALL

UnsupportedIEW7

1

448

Deprecated Element

ALL

deprecatedBrowserIE

2

465

Second order Injection / Security Decisions Via Untrusted Inputs

ALL

Injection18

3

476

Null Pointer Deference (Nullable object)

ALL

NullableObject

1

476

Numeric method returns null

ALL

ReturnNumberNull

3

476

Null Pointer Deference (throw null)

ALL

NullableThrow

1

476

Null Pointer Deference (Nullable formal parameter)

ALL

NullableFormalParameter

1

476

Boolean Method returns null

ALL

NullableReturns

2

477

Statement is Deprecated (JavaScript)

ALL

deprecatedJS

3

478

switch/Select' statement should have a 'default'/'case else' condition

ALL

CWE200SC

4

494

Download of Code Without Integrity Check

ALL

Idor494

2

501

Cross-Session Contamination (JavaSCript)

ALL

CrossSessionContamination_JS

1

501

Trusted Bound Violation

ALL

Injection24

1

501

Trust Boundary Violation

ALL

Injection24_2

1

511

Logic-Time Bomb (DOS Command)

ALL

DangerousDOSCommand_BOMB

2

522

Password in Configuration file

ALL

Pcf

1

531

Unit Test Libraries  should be used in a separate source file

ALL

CWE395TEST_2

3

531

TestCase should be in a separate source file

ALL

CWE395TEST_1

2

564

SQL Injection (HibernateJS)

ALL

Injection564

1

601

HTTP Redirect

ALL

Csrf03

1

610

File or Directory Name Manipulation (JavaScript)

ALL

FileManipulation_JS

1

612

JavaScript IndexedDB Injection

ALL

IndexedDBInjectionJS

1

614

Insecure Cookie (JavaScript)

ALL

idorjs_unsecure_cookie

1

614

Cookie Session too long (JavaScript)

ALL

idorjs_cookie

2

614

Insecure Cookie

ALL

IdorCOOKIE

3

614

Insecure Cookie Path (JavaScript)

ALL

idorjs_unsecure_cookie_path

2

639

Avoid Debug/Trace mode in production

ALL

BrokenauthXML

5

642

Improper Granting of all privileges on an object

ALL

idorjs

1

664

Unsecure XML setting

ALL

IdorXML

3

668

Improper Logger (JavaScript)

ALL

Securitymisc12js

3

669

Avoid using Components NW.js

ALL

NWJS

1

669

Avoid using Components with Known Vulnerabilities  in POM-JAR  or Project File (Low)

ALL

Uckv08

3

669

Avoid using Components with Known Vulnerabilities  (Medium)

ALL

Uckv02

2

669

Avoid using Components with Known Vulnerabilities  in POM-JAR  or Project File (Medium)

ALL

Uckv07

2

669

Avoid using Components with Known Vulnerabilities  (Low)

ALL

Uckv03

3

669

Avoid using Components with Known Vulnerabilities  (High)

ALL

Uckv01

1

669

No Project Files were found

ALL

Uckv04

1

669

No POM.XML Files were found

ALL

Uckv05

1

669

Avoid using Components with Known Vulnerabilities  in POM-JAR  or Project File (High)

ALL

Uckv06

1

676

Dangerous DOS command

ALL

DangerousDOScommand

1

676

Missing wrapping of 'dangerous' functions

ALL

Securitymisc13

3

676

Dangerous Linux command

ALL

DangerousLinuxcommand

1

77

Code Injection - Tag

ALL

Injection01Tag

1

77

Command Injection

ALL

Injection01

1

78

OS Command Injection (JavaScript)

ALL

OSINJECTION_JS

1

79

Reflected XSS (JavaScript) / Security Decisions Via Untrusted Inputs

ALL

XSS_JS

3

79

Cross-Site Scripting (Web2py)

ALL

PYTHON_S60

1

79

Cross Site Scripting / Security Decisions Via Untrusted Inputs

ALL

Xss01

1

798

User-Password-Profile-ID in Comment

ALL

Uohcc01

4

798

Hardcoded IP address in comment

ALL

Itl04

4

798

Suspicious  Hardcoded  URL/URI

ALL

Dangerous_Hardcoded_URL

3

863

Access Control: Database (JavaScript)

ALL

accessControl_JS

1

88

Avoid SELECT * statements

ALL

Injection17

3

88

NET injection

ALL

Injection20

1

89

SQL Query Injection

ALL

Injection10

1

90

LDAP Injection

ALL

Injection07

1

90

Possible LDAP Injection

ALL

InjectionCert

3

91

Weak XML Schema (tag Any)

ALL

XSDAny

3

91

Weak XML Schema (type Unbounded)

ALL

XSDmaxOccurs

3

91

XPath Injection

ALL

Injection13

1

91

Weak XML Schema (Lax-Skip tags)

ALL

LaxSkip

1

94

CORS - Overly permissive target origin

ALL

CodeInjection_JS3

1

94

JQuery Code Injection (JavaScript)

ALL

jqueryjs

1

94

Second Order Code Injection (JavaScript)

ALL

MooToolsjs

1

94

Overly permissive target origin

ALL

CodeInjection_JS2

1

94

HTML Injection (JavaScript)

ALL

HTMLInjectionJS

1

94

Code Injection (JavaScript)

ALL

CodeInjection_JS

1

94

Second Order File Injection (JavaScript)

ALL

MooToolsFilejs

1

94

Second Order Unsecure JSON decoding (JavaScript)

ALL

MooToolsJsonjs

1

95

Eval Injection (JavaScript)

ALL

EvalInjection

1

96

SQL Injection (JavaScript)

ALL

SQL_Injection_JS

1

97

Server Side Include (SSI) Injection

ALL

SSI

1

99

Resource Injection (JavaScript)

ALL

ResourceInjection_JS

1

119

Array Index Out Of Bounds

CCPP

C67

1

119

Buffer Overflow (Containers)

CCPP

C03

1

120

Second order Buffer Overflow (sizeof of sizeof)

CCPP

C46

3

120

Buffer Overflow (Buffer)

CCPP

C08

1

120

Buffer Overflow (Array pointer)

CCPP

C04

1

120

Memory Leak (ctype isalnum|isalpha|isascii|is..)

CCPP

C35

2

120

Buffer Overflow (Array Index)

CCPP

C02

2

121

scanf without field width limits

CCPP

C86

3

122

Buffer Overflow (strncpy/memset/memcpy)

CCPP

C10

1

125

Buffer Access Out Of Bounds

CCPP

C68

1

125

Buffer Overflow (Array)

CCPP

C07

1

125

Second order Buffer Overflow (Array)

CCPP

C49

3

126

Second order Buffer Overflow (strncpy)

CCPP

C50

2

126

Buffer Overlap (s[n]printf())

CCPP

C11

2

129

Buffer Overflow (Index is out of range)

CCPP

C06

1

131

Avoid using of Unitialized Variable (Wrong buffer write)

CCPP

C62

1

134

sprintf: insufficient format string parameters

CCPP

C87

3

134

Stack Overflow (scanf)

CCPP

C81

3

135

Incorrect Calculation of Multi-Byte String Length

CCPP

C135

3

170

Buffer Not Zero Terminated (After a call to a function)

CCPP

C70

1

190

Buffer Overflow (strncat)

CCPP

C09

1

195

Stack Overflow (printf sint)

CCPP

C79

3

196

Stack Overflow (printf uint)

CCPP

C80

3

20

Memory Leak (Same iterator)

CCPP

C24

2

200

Information Leakage (#pragma ibm critical)

CCPP

CE11

3

214

Information Leakage (#pragma ibm parallel_loop)

CCPP

CE12

3

233

Invalid Length Modifier (printf)

CCPP

C73

3

243

Creation of chroot Jail Without Changing Working Directory

CCPP

CE243

1

256

Plaintext Storage of a Password

CCPP

CE256

2

257

Avoid using of String for password

CCPP

CE7

2

311

Memory Leak (Unsafe root Class)

CCPP

C29

2

327

Cryptographic key too short

CCPP

CE8

3

344

Hardcoded IP address

CCPP

CE9

1

369

Division by zero

CCPP

C15

1

369

Potential division by zero

CCPP

C42

2

388

Invalid c_str() after a call

CCPP

C20

2

388

Invalid c_str() after throwing exception

CCPP

C21

2

396

Improper Logger (Rethrow)

CCPP

C41

1

398

Memory Leak (Missing virtual destructor)

CCPP

C34

2

399

Memory Leak (Class provides constructors)

CCPP

C27

2

400

Denial of Service (usleep)

CCPP

C14

1

401

Memory Leak (Copy 'auto_ptr' pointer)

CCPP

C33

2

401

Memory Leak (when executing)

CCPP

C39

1

404

Resource Leak (when executing)

CCPP

C40

1

456

Avoid using of Unitialized Variable (Leak)

CCPP

C60

1

457

Avoid using of Unitialized Variable (Member Variable)

CCPP

C59

1

457

Memory Leak (Data not initialized)

CCPP

C28

2

466

Stack Overflow (Wrong returning reference)

CCPP

C57

2

467

Buffer Overflow (pointer)

CCPP

C01

1

467

Second order Buffer Overflow (sizeof for Array)

CCPP

C48

3

468

Stack Overflow (printf *)

CCPP

C77

3

476

Second order null Pointer Dereference (null Pointer)

CCPP

C51

2

476

Second order null Pointer Dereference (shifting negative)

CCPP

C53

2

476

Memory Leak (New)

CCPP

C37

1

477

Obsolete Functions

CCPP

C32

3

480

Assign Bool To Pointer (converting bool value to address)

CCPP

C69

3

487

Invalid Scope Object ('auto-ptr' pointer)

CCPP

C23

1

495

Stack Overflow (local Array variable)

CCPP

C56

2

497

Information Leakage (#pragma ibm schedule)

CCPP

CE13

3

511

Logic-Time Bomb (C/C++)

CCPP

TIMEBOMB_C

2

523

Avoid using of non-SSL communications

CCPP

CE4

2

531

Unit Test Libraries  should be used in a separate source file

CCPP

CWE395TEST_2_CPP

3

532

Improper Logger (Destructor)

CCPP

C30

1

534

Ensure all exceptions are either logged with a standard logger or rethrow

CCPP

C31

2

562

Stack Overflow (auto-variable)

CCPP

C55

2

562

Stack Overflow (temporary)

CCPP

C58

2

569

Memory Leak (Class contains a std::string)

CCPP

C26

2

569

Second order Buffer Overflow (strlen/sizeof)

CCPP

C44

3

569

Second order Buffer Overflow (sizeof)

CCPP

C45

3

590

Memory Leak (Memory allocated not freed)

CCPP

C25

2

617

Call Settings manipulation (Assert)

CCPP