Findings detected by DAST
This section lists the Common Weakness Enumerations (CWEs) for findings (flaws) detected by Veracode DAST.
To map the findings found during scanning, we reference the CWE standard.
Since its founding, Veracode has reported findings using the industry standard Common Weakness Enumeration as a taxonomy.
The CWE provides a mapping of all known types of software weakness or vulnerability, and provides supplemental information to help developers understand the cause of common weaknesses and how to fix them.
Veracode always uses the latest version of the CWE, and updates to new versions within 90 days of release.
For a complete list of CWEs detected by Veracode Static Analysis, see Findings detected by SAST.
Veracode Manual Penetration Testing scans might report any valid CWE.
You can see the full list of CWEs at the Mitre CWE website.
The listed findings are grouped according to a list of categories that Veracode uses for convenience.
The categories generally correspond to common types of attacks.
In the Veracode Platform, on the Triage Flaws page, the Flaw severity column indicates the finding severities using Veracode's severity scale.
CWEs that violate security standards provides the full list of CWEs that can prevent an application from passing policy based on the Security Standard policy rule.
Authentication Issues
| CWE ID | CWE name | Severity |
|---|
| 287 | Improper Authentication | 4 |
| 352 | Cross-Site Request Forgery (CSRF) | 3 |
Authorization Issues
| CWE ID | CWE name | Severity |
|---|
| 862 | Missing Authorization | 2 |
Code Injection
| CWE ID | CWE name | Severity |
|---|
| 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection) | 4 |
| 91 | XML Injection (Blind XPath Injection) | 3 |
| 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | 5 |
| 98 | Improper Control of Filename for Include/Require Statement in PHP Program (PHP File Inclusion) | 4 |
| 830 | Inclusion of Web Functionality from an Untrusted Source | 2 |
Code Quality
| CWE ID | CWE name | Severity |
|---|
| 477 | Use of Obsolete Functions | 0 |
Command or Argument Injection
| CWE ID | CWE name | Severity |
|---|
| 78 | Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) | 5 |
Credentials Management
| CWE ID | CWE name | Severity |
|---|
| 259 | Use of Hard-coded Password | 3 |
| 522 | Insufficiently Protected Credentials | 3 |
CRLF Injection
| CWE ID | CWE Name | Severity |
|---|
| 113 | Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Response Splitting) | 3 |
Cross-Site Scripting (XSS)
| CWE ID | CWE name | Severity |
|---|
| 79 | Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) | 3 |
| 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 3 |
| 83 | Improper Neutralization of Script in Attributes in a Web Page | 3 |
Cryptographic Issues
| CWE ID | CWE name | Severity |
|---|
| 296 | Improper Following of Chain of Trust for Certificate Validation | 3 |
| 297 | Improper Validation of Host-specific Certificate Data | 3 |
| 298 | Improper Validation of Certificate Expiration | 3 |
| 299 | Improper Check for Certificate Revocation | 3 |
| 321 | Use of Hard-coded Cryptographic Key | 3 |
| 325 | Missing Cryptographic Step | 3 |
| 326 | Inadequate Encryption Strength | 3 |
| 327 | Use of a Broken or Risky Cryptographic Algorithm | 3 |
| 345 | Insufficient Verification of Data Authenticity | 4 |
| 614 | Sensitive Cookie in HTTPS Session Without Secure Attribute | 2 |
Deployment Configuration
| CWE ID | CWE name | Severity |
|---|
| 402 | Transmission of Private Resources into a New Sphere (Resource Leak) | 3 |
| 668 | Exposure of Resource to Wrong Sphere | 3 |
Directory Traversal
| CWE ID | CWE name | Severity |
|---|
| 22 | Improper Limitation of a Pathname to a Restricted Directory (Path Traversal) | 3 |
Encapsulation
| CWE ID | CWE name | Severity |
|---|
| 502 | Deserialization of Untrusted Data | 3 |
| 693 | Protection Mechanism Failure | 3 |
| CWE ID | CWE Name | Severity |
|---|
| 200 | Information Exposure | 2 |
| 209 | Information Exposure Through an Error Message | 2 |
| 215 | Information Exposure Through Debug Information | 2 |
| 359 | Exposure of Private Information (Privacy Violation) | 2 |
| 526 | Information Exposure Through Environmental Variables | 2 |
| 530 | Exposure of Backup File to an Unauthorized Control Sphere | 2 |
| 538 | File and Directory Information Exposure | 2 |
| 548 | Information Exposure Through Directory Listing | 2 |
| 611 | Information Exposure Through XML External Entity Reference | 3 |
| 918 | Server-side Request Forgery | 3 |
Insecure Dependencies
| CWE ID | CWE name | Severity |
|---|
| 829 | Inclusion of Functionality from Untrusted Control Sphere | 3 |
| 1357 | Reliance on Insufficiently Trustworthy Component | 3 |
| CWE ID | CWE name | Severity |
|---|
| 115 | Misinterpretation of Input | 4 |
| 434 | Unrestricted Upload of File with Dangerous Type | 4 |
| 601 | URL Redirection to Untrusted Site (Open Redirect) | 3 |
Server Configuration
| CWE ID | CWE name | Severity |
|---|
| 16 | Configuration | 0 |
| 642 | External Control of Critical State Data | 2 |
| 757 | Selection of Less-Secure Algorithm During Negotiation (Algorithm Downgrade) | 3 |
| 1125 | Excessive Attack Surface | 0 |
Session Fixation
| CWE ID | CWE name | Severity |
|---|
| 384 | Session Fixation | 3 |
SQL Injection
| CWE ID | CWE name | Severity |
|---|
| 89 | Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) | 4 |
| 943 | Improper Neutralization of Special Elements in Data Query Logic | 4 |