CWEs that violate the CERT standard

The following table lists all the CWEs that might cause an application to not pass a policy that includes a CERT policy rule.

CWE ID	CWE name	SAST support	DAST support	Veracode severity
14	Compiler Removal of Code to Clear Buffers	No	No	N/A
20	Improper Input Validation	Yes	No	0 - Informational
22	Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)	Yes	Yes	3 - Medium
37	Path Traversal: '/absolute/pathname/here'	No	No	N/A
38	Path Traversal: '\absolute\pathname\here'	No	No	N/A
39	Path Traversal: 'C:dirname'	No	No	N/A
41	Improper Resolution of Path Equivalence	No	No	N/A
59	Improper Link Resolution Before File Access (Link Following)	No	No	N/A
62	UNIX Hard Link	No	No	N/A
64	Windows Shortcut Following (.LNK)	No	No	N/A
65	Windows Hard Link	No	No	N/A
67	Improper Handling of Windows Device Names	No	No	N/A
78	Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)	Yes	Yes	5 - Very High (Critical)
88	Argument Injection or Modification	Yes	No	3 - Medium
111	Direct Use of Unsafe JNI	Yes	No	4 - High
116	Improper Encoding or Escaping of Output	No	No	N/A
117	Improper Output Neutralization for Logs	Yes	No	3 - Medium
119	Improper Restriction of Operations within the Bounds of a Memory Buffer	No	No	N/A
120	Buffer Copy without Checking Size of Input (Classic Buffer Overflow)	No	No	N/A
121	Stack-based Buffer Overflow	Yes	No	5 - Very High (Critical)
122	Heap-based Buffer Overflow	No	No	N/A
123	Write-what-where Condition	No	No	N/A
125	Out-of-bounds Read	Yes	No	3 - Medium
128	Wrap-around Error	No	No	N/A
129	Improper Validation of Array Index	Yes	No	3 - Medium
131	Incorrect Calculation of Buffer Size	No	No	N/A
134	Use of Externally-Controlled Format String	Yes	No	5 - Very High (Critical)
135	Incorrect Calculation of Multi-Byte String Length	Yes	No	5 - Very High (Critical)
144	Improper Neutralization of Line Delimiters	No	No	N/A
150	Improper Neutralization of Escape, Meta, or Control Sequences	No	No	N/A
170	Improper Null Termination	Yes	No	3 - Medium
171	Cleansing, Canonicalization, and Comparison Errors	No	No	N/A
176	Improper Handling of Unicode Encoding	No	No	N/A
180	Incorrect Behavior Order: Validate Before Canonicalize	No	No	N/A
182	Collapse of Data into Unsafe Value	No	No	N/A
190	Integer Overflow or Wraparound	Yes	No	5 - Very High (Critical)
191	Integer Underflow (Wrap or Wraparound)	Yes	No	3 - Medium
192	Integer Coercion Error	Yes	No	3 - Medium
193	Off-by-one Error	Yes	No	3 - Medium
194	Unexpected Sign Extension	No	No	N/A
195	Signed to Unsigned Conversion Error	Yes	No	3 - Medium
197	Numeric Truncation Error	Yes	No	3 - Medium
198	Use of Incorrect Byte Ordering	No	No	N/A
209	Information Exposure Through an Error Message	Yes	Yes	2 - Low
226	Sensitive Information Uncleared Before Release	No	No	N/A
227	7PK - API Abuse	No	No	N/A
230	Improper Handling of Missing Values	No	No	N/A
232	Improper Handling of Undefined Values	No	No	N/A
241	Improper Handling of Unexpected Data Type	No	No	N/A
242	Use of Inherently Dangerous Function	Yes	No	5 - Very High (Critical)
244	Improper Clearing of Heap Memory Before Release (Heap Inspection)	No	No	N/A
248	Uncaught Exception	Yes	No	2 - Low
250	Execution with Unnecessary Privileges	No	No	N/A
252	Unchecked Return Value	Yes	No	2 - Low
253	Incorrect Check of Function Return Value	No	No	N/A
259	Use of Hard-coded Password	Yes	Yes	3 - Medium
266	Incorrect Privilege Assignment	No	No	N/A
272	Least Privilege Violation	Yes	No	3 - Medium
273	Improper Check for Dropped Privileges	Yes	No	3 - Medium
276	Incorrect Default Permissions	No	No	N/A
279	Incorrect Execution-Assigned Permissions	No	No	N/A
289	Authentication Bypass by Alternate Name	No	No	N/A
300	Channel Accessible by Non-Endpoint (Man-in-the-Middle)	No	No	N/A
302	Authentication Bypass by Assumed-Immutable Data	No	No	N/A
311	Missing Encryption of Sensitive Data	Yes	No	3 - Medium
319	Cleartext Transmission of Sensitive Information	Yes	No	3 - Medium
327	Use of a Broken or Risky Cryptographic Algorithm	Yes	Yes	3 - Medium
330	Use of Insufficiently Random Values	Yes	No	3 - Medium
331	Insufficient Entropy	Yes	No	3 - Medium
332	Insufficient Entropy in PRNG	No	No	N/A
333	Improper Handling of Insufficient Entropy in TRNG	No	No	N/A
336	Same Seed in Pseudo-Random Number Generator (PRNG)	No	No	N/A
337	Predictable Seed in Pseudo-Random Number Generator (PRNG)	No	No	N/A
338	Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)	Yes	No	3 - Medium
347	Improper Verification of Cryptographic Signature	Yes	No	2 - Low
349	Acceptance of Extraneous Untrusted Data With Trusted Data	No	No	N/A
359	Exposure of Private Information (Privacy Violation)	Yes	Yes	2 - Low
362	Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition)	No	No	N/A
363	Race Condition Enabling Link Following	No	No	N/A
366	Race Condition within a Thread	Yes	No	3 - Medium
367	Time-of-check Time-of-use (TOCTOU) Race Condition	Yes	No	3 - Medium
369	Divide By Zero	No	No	N/A
374	Passing Mutable Objects to an Untrusted Method	No	No	N/A
375	Returning a Mutable Object to an Untrusted Caller	No	No	N/A
377	Insecure Temporary File	Yes	No	3 - Medium
379	Creation of Temporary File in Directory with Incorrect Permissions	No	No	N/A
382	J2EE Bad Practices: Use of System.exit()	Yes	No	2 - Low
390	Detection of Error Condition Without Action	No	No	N/A
392	Missing Report of Error Condition	No	No	N/A
395	Use of NullPointerException Catch to Detect NULL Pointer Dereference	No	No	N/A
397	Declaration of Throws for Generic Exception	No	No	N/A
400	Uncontrolled Resource Consumption	No	No	N/A
401	Improper Release of Memory Before Removing Last Reference	Yes	No	2 - Low
403	Exposure of File Descriptor to Unintended Control Sphere (File Descriptor Leak)	No	No	N/A
404	Improper Resource Shutdown or Release	Yes	No	0 - Informational
405	Asymmetric Resource Consumption (Amplification)	No	No	N/A
409	Improper Handling of Highly Compressed Data (Data Amplification)	No	No	N/A
410	Insufficient Resource Pool	No	No	N/A
412	Unrestricted Externally Accessible Lock	No	No	N/A
413	Improper Resource Locking	No	No	N/A
415	Double Free	Yes	No	3 - Medium
416	Use After Free	Yes	No	2 - Low
426	Untrusted Search Path	Yes	No	3 - Medium
456	Missing Initialization of a Variable	No	No	N/A
459	Incomplete Cleanup	No	No	N/A
460	Improper Cleanup on Thrown Exception	No	No	N/A
462	Duplicate Key in Associative List (Alist)	No	No	N/A
464	Addition of Data Structure Sentinel	No	No	N/A
466	Return of Pointer Value Outside of Expected Range	No	No	N/A
467	Use of sizeof() on a Pointer Type	No	No	N/A
468	Incorrect Pointer Scaling	No	No	N/A
469	Use of Pointer Subtraction to Determine Size	No	No	N/A
470	Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)	Yes	No	3 - Medium
476	NULL Pointer Dereference	No	No	N/A
479	Signal Handler Use of a Non-reentrant Function	Yes	No	3 - Medium
480	Use of Incorrect Operator	No	No	N/A
481	Assigning instead of Comparing	No	No	N/A
482	Comparing instead of Assigning	No	No	N/A
486	Comparison of Classes by Name	No	No	N/A
487	Reliance on Package-level Scope	No	No	N/A
491	Public cloneable() Method Without Final (Object Hijack)	No	No	N/A
492	Use of Inner Class Containing Sensitive Data	No	No	N/A
493	Critical Public Variable Without Final Modifier	No	No	N/A
497	Exposure of System Data to an Unauthorized Control Sphere	Yes	No	2 - Low
499	Serializable Class Containing Sensitive Data	No	No	N/A
500	Public Static Field Not Marked Final	No	No	N/A
502	Deserialization of Untrusted Data	Yes	No	3 - Medium
528	Exposure of Core Dump File to an Unauthorized Control Sphere	No	No	N/A
532	Insertion of Sensitive Information into Log File	Yes	No	2 - Low
543	Use of Singleton Pattern Without Synchronization in a Multithreaded Context	No	No	N/A
544	Missing Standardized Error Handling Mechanism	No	No	N/A
547	Use of Hard-coded, Security-relevant Constants	Yes	No	3 - Medium
552	Files or Directories Accessible to External Parties	No	No	N/A
561	Dead Code	No	No	N/A
562	Return of Stack Variable Address	No	No	N/A
563	Assignment to Variable without Use	No	No	N/A
567	Unsynchronized Access to Shared Data in a Multithreaded Context	No	No	N/A
568	finalize() Method Without super.finalize()	No	No	N/A
570	Expression is Always False	No	No	N/A
571	Expression is Always True	No	No	N/A
572	Call to Thread run() instead of start()	No	No	N/A
573	Improper Following of Specification by Caller	No	No	N/A
581	Object Model Violation: Just One of Equals and Hashcode Defined	No	No	N/A
582	Array Declared Public, Final, and Static	No	No	N/A
583	finalize() Method Declared Public	No	No	N/A
584	Return Inside Finally Block	No	No	N/A
586	Explicit Call to Finalize()	No	No	N/A
587	Assignment of a Fixed Address to a Pointer	No	No	N/A
589	Call to Non-ubiquitous API	No	No	N/A
590	Free of Memory not on the Heap	No	No	N/A
591	Sensitive Data Storage in Improperly Locked Memory	No	No	N/A
595	Comparison of Object References Instead of Object Contents	No	No	N/A
597	Use of Wrong Operator in String Comparison	Yes	No	2 - Low
600	Uncaught Exception in Servlet	No	No	N/A
606	Unchecked Input for Loop Condition	No	No	N/A
609	Double-Checked Locking	No	No	N/A
617	Reachable Assertion	No	No	N/A
625	Permissive Regular Expression	No	No	N/A
628	Function Call with Incorrectly Specified Arguments	Yes	No	2 - Low
647	Use of Non-Canonical URL Paths for Authorization Decisions	No	No	N/A
662	Improper Synchronization	No	No	N/A
664	Improper Control of a Resource Through its Lifetime	No	No	N/A
665	Improper Initialization	Yes	No	2 - Low
666	Operation on Resource in Wrong Phase of Lifetime	No	No	N/A
667	Improper Locking	No	No	N/A
672	Operation on a Resource after Expiration or Release	No	No	N/A
675	Duplicate Operations on Resource	Yes	No	2 - Low
676	Use of Potentially Dangerous Function	Yes	No	3 - Medium
680	Integer Overflow to Buffer Overflow	No	No	N/A
681	Incorrect Conversion between Numeric Types	No	No	N/A
682	Incorrect Calculation	No	No	N/A
684	Incorrect Provision of Specified Functionality	No	No	N/A
685	Function Call With Incorrect Number of Arguments	No	No	N/A
686	Function Call With Incorrect Argument Type	No	No	N/A
687	Function Call With Incorrectly Specified Argument Value	No	No	N/A
690	Unchecked Return Value to NULL Pointer Dereference	No	No	N/A
696	Incorrect Behavior Order	No	No	N/A
697	Incorrect Comparison	No	No	N/A
703	Improper Check or Handling of Exceptional Conditions	No	No	N/A
704	Incorrect Type Conversion or Cast	No	No	N/A
705	Incorrect Control Flow Scoping	No	No	N/A
732	Incorrect Permission Assignment for Critical Resource	Yes	No	3 - Medium
754	Improper Check for Unusual or Exceptional Conditions	No	No	N/A
758	Reliance on Undefined, Unspecified, or Implementation-Defined Behavior	No	No	N/A
762	Mismatched Memory Management Routines	No	No	N/A
766	Critical Data Element Declared Public	No	No	N/A
770	Allocation of Resources Without Limits or Throttling	No	No	N/A
771	Missing Reference to Active Allocated Resource	No	No	N/A
772	Missing Release of Resource after Effective Lifetime	No	No	N/A
773	Missing Reference to Active File Descriptor or Handle	No	No	N/A
775	Missing Release of File Descriptor or Handle after Effective Lifetime	No	No	N/A
783	Operator Precedence Logic Error	No	No	N/A
786	Access of Memory Location Before Start of Buffer	No	No	N/A
789	Uncontrolled Memory Allocation	No	No	N/A
798	Use of Hard-coded Credentials	Yes	No	3 - Medium
805	Buffer Access with Incorrect Length Value	No	No	N/A
807	Reliance on Untrusted Inputs in a Security Decision	No	No	N/A
820	Missing Synchronization	No	No	N/A
833	Deadlock	No	No	N/A
838	Inappropriate Encoding for Output Context	No	No	N/A
843	Access of Resource Using Incompatible Type (Type Confusion)	No	No	N/A
908	Use of Uninitialized Resource	No	No	N/A
910	Use of Expired File Descriptor	No	No	N/A