CWEs that violate the OWASP standard
The following table lists the CWEs that violate the OWASP Top 10 standard. Only the supported CWEs on the most recent list will cause an application to fail a policy that includes the Auto-Update OWASP policy rule.
| CWE ID | CWE name | SAST support | DAST support | Veracode severity | Years on list |
|---|---|---|---|---|---|
| 15 | External Control of System or Configuration Setting | Yes | No | 4 - High | 2021, 2025 |
| 22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 73 | External Control of File Name or Path | Yes | No | 3 - Medium | 2021, 2025 |
| 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | No | Yes | 4 - High | 2017, 2021, 2025 |
| 77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | Yes | No | 5 - Very High (Critical) | 2017, 2021, 2025 |
| 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | Yes | Yes | 5 - Very High (Critical) | 2017, 2021, 2025 |
| 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 83 | Improper Neutralization of Script in Attributes in a Web Page | No | Yes | 3 - Medium | 2017, 2021, 2025 |
| 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Yes | Yes | 4 - High | 2017, 2021, 2025 |
| 90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 91 | XML Injection (aka Blind XPath Injection) | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 94 | Improper Control of Generation of Code ('Code Injection') | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | Yes | Yes | 5 - Very High (Critical) | 2017, 2021, 2025 |
| 98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | Yes | Yes | 4 - High | 2017, 2021, 2025 |
| 99 | Improper Control of Resource Identifiers ('Resource Injection') | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 103 | Struts: Incomplete validate() Method Definition | Yes | No | 3 - Medium | 2025 |
| 104 | Struts: Form Bean Does Not Extend Validation Class | Yes | No | 3 - Medium | 2025 |
| 112 | Missing XML Validation | Yes | No | 3 - Medium | 2021, 2025 |
| 113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 114 | Process Control | Yes | No | 5 - Very High (Critical) | 2021, 2025 |
| 115 | Misinterpretation of Input | No | Yes | 4 - High | 2025 |
| 117 | Improper Output Neutralization for Logs | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 129 | Improper Validation of Array Index | Yes | No | 3 - Medium | 2021, 2025 |
| 134 | Use of Externally-Controlled Format String | Yes | No | 5 - Very High (Critical) | 2021, 2025 |
| 183 | Permissive List of Allowed Inputs | Yes | No | 3 - Medium | 2021, 2025 |
| 200 | Exposure of Sensitive Information to an Unauthorized Actor | Yes | Yes | 2 - Low | 2021, 2025 |
| 201 | Insertion of Sensitive Information Into Sent Data | Yes | No | 2 - Low | 2021, 2025 |
| 209 | Generation of Error Message Containing Sensitive Information | Yes | Yes | 2 - Low | 2017, 2021, 2025 |
| 215 | Insertion of Sensitive Information Into Debugging Code | Yes | Yes | 2 - Low | 2021, 2025 |
| 223 | Omission of Security-relevant Information | Yes | No | 2 - Low | 2017, 2021, 2025 |
| 234 | Failure to Handle Missing Parameter | Yes | No | 3 - Medium | 2025 |
| 248 | Uncaught Exception | Yes | No | 2 - Low | 2025 |
| 252 | Unchecked Return Value | Yes | No | 2 - Low | 2025 |
| 256 | Plaintext Storage of a Password | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 258 | Empty Password in Configuration File | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 259 | Use of Hard-coded Password | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 261 | Weak Encoding for Password | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 272 | Least Privilege Violation | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 273 | Improper Check for Dropped Privileges | Yes | No | 3 - Medium | 2025 |
| 282 | Improper Ownership Management | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 284 | Improper Access Control | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 285 | Improper Authorization | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 287 | Improper Authentication | Yes | Yes | 4 - High | 2017, 2021, 2025 |
| 295 | Improper Certificate Validation | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 296 | Improper Following of a Certificate's Chain of Trust | No | Yes | 3 - Medium | 2017, 2021, 2025 |
| 297 | Improper Validation of Certificate with Host Mismatch | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 298 | Improper Validation of Certificate Expiration | No | Yes | 3 - Medium | 2017, 2021, 2025 |
| 299 | Improper Check for Certificate Revocation | No | Yes | 3 - Medium | 2017, 2021, 2025 |
| 311 | Missing Encryption of Sensitive Data | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 312 | Cleartext Storage of Sensitive Information | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 313 | Cleartext Storage in a File or on Disk | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 316 | Cleartext Storage of Sensitive Information in Memory | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 319 | Cleartext Transmission of Sensitive Information | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 321 | Use of Hard-coded Cryptographic Key | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 323 | Reusing a Nonce, Key Pair in Encryption | Yes | No | 3 - Medium | 2021, 2025 |
| 325 | Missing Cryptographic Step | No | Yes | 3 - Medium | 2017, 2021, 2025 |
| 326 | Inadequate Encryption Strength | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 327 | Use of a Broken or Risky Cryptographic Algorithm | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 329 | Generation of Predictable IV with CBC Mode | Yes | No | 2 - Low | 2021, 2025 |
| 330 | Use of Insufficiently Random Values | Yes | No | 3 - Medium | 2021, 2025 |
| 331 | Insufficient Entropy | Yes | No | 3 - Medium | 2021, 2025 |
| 338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | Yes | No | 3 - Medium | 2021, 2025 |
| 345 | Insufficient Verification of Data Authenticity | Yes | Yes | 4 - High | 2021, 2025 |
| 346 | Origin Validation Error | Yes | No | 3 - Medium | 2021, 2025 |
| 347 | Improper Verification of Cryptographic Signature | Yes | No | 2 - Low | 2021, 2025 |
| 350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 352 | Cross-Site Request Forgery (CSRF) | Yes | Yes | 3 - Medium | 2021, 2025 |
| 354 | Improper Validation of Integrity Check Value | Yes | No | 3 - Medium | 2021, 2025 |
| 359 | Exposure of Private Personal Information to an Unauthorized Actor | Yes | Yes | 2 - Low | 2017, 2021, 2025 |
| 366 | Race Condition within a Thread | Yes | No | 3 - Medium | 2025 |
| 367 | Time-of-check Time-of-use (TOCTOU) Race Condition | Yes | No | 3 - Medium | 2025 |
| 377 | Insecure Temporary File | Yes | No | 3 - Medium | 2021, 2025 |
| 382 | J2EE Bad Practices: Use of System.exit() | Yes | No | 2 - Low | 2025 |
| 384 | Session Fixation | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 402 | Transmission of Private Resources into a New Sphere ('Resource Leak') | No | Yes | 3 - Medium | 2021, 2025 |
| 421 | Race Condition During Access to Alternate Channel | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 426 | Untrusted Search Path | Yes | No | 3 - Medium | 2021, 2025 |
| 427 | Uncontrolled Search Path Element | Yes | No | 3 - Medium | 2021, 2025 |
| 434 | Unrestricted Upload of File with Dangerous Type | No | Yes | 4 - High | 2021, 2025 |
| 441 | Unintended Proxy or Intermediary ('Confused Deputy') | Yes | No | 3 - Medium | 2021, 2025 |
| 451 | User Interface (UI) Misrepresentation of Critical Information | Yes | No | 3 - Medium | 2021, 2025 |
| 470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | Yes | No | 3 - Medium | 2021, 2025 |
| 472 | External Control of Assumed-Immutable Web Parameter | Yes | No | 3 - Medium | 2021, 2025 |
| 479 | Signal Handler Use of a Non-reentrant Function | Yes | No | 3 - Medium | 2025 |
| 489 | Active Debug Code | Yes | No | 3 - Medium | 2025 |
| 497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | Yes | No | 2 - Low | 2021, 2025 |
| 502 | Deserialization of Untrusted Data | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 506 | Embedded Malicious Code | Yes | No | 4 - High | 2025 |
| 511 | Logic/Time Bomb | Yes | No | 5 - Very High (Critical) | 2025 |
| 522 | Insufficiently Protected Credentials | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 526 | Cleartext Storage of Sensitive Information in an Environment Variable | No | Yes | 2 - Low | 2017, 2021, 2025 |
| 530 | Exposure of Backup File to an Unauthorized Control Sphere | No | Yes | 2 - Low | 2021, 2025 |
| 532 | Insertion of Sensitive Information into Log File | Yes | No | 2 - Low | 2021, 2025 |
| 538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | No | Yes | 2 - Low | 2021, 2025 |
| 547 | Use of Hard-coded, Security-relevant Constants | Yes | No | 3 - Medium | 2021, 2025 |
| 548 | Exposure of Information Through Directory Listing | No | Yes | 2 - Low | 2017, 2021, 2025 |
| 564 | SQL Injection: Hibernate | Yes | No | 4 - High | 2017, 2021, 2025 |
| 566 | Authorization Bypass Through User-Controlled SQL Primary Key | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 601 | URL Redirection to Untrusted Site ('Open Redirect') | Yes | Yes | 3 - Medium | 2021, 2025 |
| 611 | Improper Restriction of XML External Entity Reference | Yes | Yes | 3 - Medium | 2017, 2021, 2025 |
| 614 | Sensitive Cookie in HTTPS Session Without 'Secure' Attribute | Yes | Yes | 2 - Low | 2017, 2021, 2025 |
| 615 | Inclusion of Sensitive Information in Source Code Comments | Yes | No | 2 - Low | 2021, 2025 |
| 618 | Exposed Unsafe ActiveX Method | Yes | No | 5 - Very High (Critical) | 2017, 2021, 2025 |
| 628 | Function Call with Incorrectly Specified Arguments | Yes | No | 2 - Low | 2025 |
| 639 | Authorization Bypass Through User-Controlled Key | Yes | No | 4 - High | 2017, 2021, 2025 |
| 642 | External Control of Critical State Data | No | Yes | 2 - Low | 2021, 2025 |
| 668 | Exposure of Resource to Wrong Sphere | Yes | Yes | 3 - Medium | 2021, 2025 |
| 676 | Use of Potentially Dangerous Function | Yes | No | 3 - Medium | 2025 |
| 693 | Protection Mechanism Failure | Yes | Yes | 3 - Medium | 2025 |
| 708 | Incorrect Ownership Assignment | Yes | No | 4 - High | 2017, 2021, 2025 |
| 732 | Incorrect Permission Assignment for Critical Resource | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 749 | Exposed Dangerous Method or Function | Yes | No | 4 - High | 2017, 2021, 2025 |
| 757 | Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade') | Yes | Yes | 3 - Medium | 2021, 2025 |
| 760 | Use of a One-Way Hash with a Predictable Salt | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 780 | Use of RSA Algorithm without OAEP | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 798 | Use of Hard-coded Credentials | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 829 | Inclusion of Functionality from Untrusted Control Sphere | Yes | Yes | 3 - Medium | 2021, 2025 |
| 830 | Inclusion of Web Functionality from an Untrusted Source | No | Yes | 2 - Low | 2021, 2025 |
| 862 | Missing Authorization | No | Yes | 2 - Low | 2017, 2021, 2025 |
| 915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Yes | No | 3 - Medium | 2021, 2025 |
| 916 | Use of Password Hash With Insufficient Computational Effort | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 918 | Server-Side Request Forgery (SSRF) | Yes | Yes | 3 - Medium | 2021, 2025 |
| 923 | Improper Restriction of Communication Channel to Intended Endpoints | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 926 | Improper Export of Android Application Components | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 942 | Permissive Cross-domain Security Policy with Untrusted Domains | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 943 | Improper Neutralization of Special Elements in Data Query Logic | Yes | Yes | 4 - High | 2017, 2021, 2025 |
| 1174 | ASP.NET Misconfiguration: Improper Model Validation | Yes | No | 2 - Low | 2021, 2025 |
| 1236 | Improper Neutralization of Formula Elements in a CSV File | Yes | No | 3 - Medium | 2017, 2021, 2025 |
| 1336 | Improper Neutralization of Special Elements Used in a Template Engine | Yes | No | 5 - Very High (Critical) | 2017, 2021, 2025 |
| 1427 | Improper Neutralization of Input Used for LLM Prompting | Yes | No | 4 - High | 2017, 2021, 2025 |