CWEs detected as flaws

This section lists the Common Weakness Enumerations (CWEs) that we search for during Veracode Static Analysis (SAST) or Veracode DAST scans. To map the findings (flaws) found during these scans, Veracode references the CWE standard.

Since its founding, Veracode has reported flaws using the industry standard Common Weakness Enumeration as a taxonomy. The CWE provides a mapping of all known types of software weakness or vulnerability, and provides supplemental information to help developers understand the cause of common weaknesses and how to fix them. Veracode always uses the latest version of the CWE, and updates to new versions within 90 days of release. This page lists the flaws that Veracode might report in automated SAST and DAST scans. If a flaw maps to several CWEs, Veracode generally reports the most general CWE that describes that particular case. For example, Veracode prefers CWE-80 for cross-site scripting over its child CWEs. Veracode updates this list frequently.

Veracode Manual Penetration Testing scans might report any valid CWE. You can see the full list of CWEs at the Mitre CWE website.

The listed flaws are grouped according to a list of categories that Veracode uses for convenience. The categories generally correspond to common types of attacks.

In the Veracode Platform, on the Triage Flaws page, the Flaw severity column indicates the flaw severities using Veracode's severity scale.

CWEs that violate security standards provides the full list of CWEs that can prevent an application from passing policy based on the Security Standard policy rule.

API Abuse

CWE ID	CWE name	Flaw severity	SAST support	DAST support
234	Failure to Handle Missing Parameter	3	Yes	No
243	Creation of Chroot Jail Without Changing Working Directory	4	Yes	No
245	J2EE Bad Practices: Direct Management of Connections	2	Yes	No
560	Use of Umask() with Chmod-Style Argument	3	Yes	No
628	Function Call with Incorrectly Specified Arguments	2	Yes	No
675	Duplicate Operations on Resource	2	Yes	No

Authentication Issues

CWE ID	CWE name	Flaw severity	SAST support	DAST support
284	Improper Access Control	3	Yes	No
287	Improper Authentication	4	Yes	Yes
350	Reliance on Reverse DNS Resolution for a Security-Critical Action	3	Yes	No
352	Cross-Site Request Forgery (CSRF)	3	Yes	Yes
923	Improper Restriction of Communication Channel to Intended Endpoints	3	Yes	No

Authorization Issues

CWE ID	CWE name	Flaw severity	SAST support	DAST support
99	Improper Control of Resource Identifiers	3	Yes	No
272	Least Privilege Violation	3	Yes	No
273	Improper Check for Dropped Privileges	3	Yes	No
274	Improper Handling of Insufficient Privileges	0	Yes	No
282	Improper Ownership Management	3	Yes	No
285	Improper Authorization	3	Yes	No
346	Origin Validation Error	3	Yes	No
451	User Interface (UI) Misrepresentation of Critical Information	3	Yes	No
566	Authorization Bypass Through User-Controlled SQL Primary Key	3	Yes	No
639	Authorization Bypass Through User-Controlled Key	4	Yes	No
708	Incorrect Ownership Assignment	4	Yes	No
732	Incorrect Permission Assignment for Critical Resource	3	Yes	No
862	Missing Authorization	2	No	Yes
942	Permissive Cross-domain Policy with Untrusted Domains	3	Yes	No

Buffer Management Errors

CWE ID	CWE name	Flaw severity	SAST support	DAST support
118	Improper Access of Indexable Resource (Range Error)	3	Yes	No
125	Out-of-Bounds Read	3	Yes	No
129	Improper Validation of Array Index	3	Yes	No
135	Incorrect Calculation of Multi-Byte String Length	5	Yes	No
170	Improper Null Termination	3	Yes	No
193	Off-by-One Error	3	Yes	No
787	Out-of-Bounds Write	3	Yes	No
823	Use of Out-of-Range Pointer Offset	3	Yes	No
824	Access of Uninitialized Pointer	3	Yes	No

Buffer Overflow

CWE ID	CWE name	Flaw severity	SAST support	DAST support
121	Stack-Based Buffer Overflow	5	Yes	No

Code Injection

CWE ID	CWE name	Flaw severity	SAST support	DAST support
74	Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection)	4	No	Yes
91	XML Injection (Blind XPath Injection)	3	Yes	Yes
94	Improper Control of Generation of Code	3	Yes	No
95	Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')	5	Yes	Yes
98	Improper Control of Filename for Include/Require Statement in PHP Program (PHP File Inclusion)	4	Yes	Yes
185	Incorrect Regular Expression	2	Yes	No
830	Inclusion of Web Functionality from an Untrusted Source	2	No	Yes
1336	Improper Neutralization of Special Elements Used in a Template Engine	5	Yes	No

Code Quality

CWE ID	CWE name	Flaw severity	SAST support	DAST support
111	Direct Use of Unsafe JNI	4	Yes	No
159	Failure to Sanitize Special Element	0	Yes	No
401	Improper Release of Memory Before Removing Last Reference (Memory Leak)	2	Yes	No
404	Improper Resource Shutdown or Release	0	Yes	No
415	Double Free	3	Yes	No
416	Use After Free	2	Yes	No
477	Use of Obsolete Functions	0	Yes	Yes
479	Signal Handler Use of a Non-Reentrant Function	3	Yes	No
489	Leftover Debug Code	3	Yes	No
597	Use of Wrong Operator in String Comparison	2	Yes	No

Command or Argument Injection

CWE ID	CWE name	Flaw severity	SAST support	DAST support
77	Improper Neutralization of Special Elements used in a Command (Command Injection)	5	Yes	No
78	Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)	5	Yes	Yes
88	Argument Injection or Modification	3	Yes	No

Credentials Management

CWE ID	CWE name	Flaw severity	SAST support	DAST support
256	Plaintext Storage of a Password	3	Yes	No
258	Empty Password in Configuration File	3	Yes	No
259	Use of Hard-coded Password	3	Yes	Yes
522	Insufficiently Protected Credentials	3	Yes	Yes
798	Use of Hard-code Credentials	3	Yes	No

CRLF Injection

CWE ID	CWE name	Flaw severity	SAST support	DAST support
93	Improper Neutralization of CRLF Sequences (CRLF Injection)	3	Yes	No
113	Improper Neutralization of CRLF Sequences in HTTP Headers (HTTP Response Splitting)	3	Yes	Yes
117	Improper Output Neutralization for Logs	3	Yes	No

Cross-Site Scripting (XSS)

CWE ID	CWE name	Flaw severity	SAST support	DAST support
79	Improper Neutralization of Input During Web Page Generation (Cross-site Scripting)	3	Yes	Yes
80	Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)	3	Yes	Yes
83	Improper Neutralization of Script in Attributes in a Web Page	3	No	Yes
86	Improper Neutralization of Invalid Characters in Identifiers in Web Pages	3	Yes	No

Cryptographic Issues

CWE ID	CWE name	Flaw severity	SAST support	DAST support
261	Weak Cryptography for Passwords	3	Yes	No
295	Improper Certificate Validation	3	Yes	No
296	Improper Following of Chain of Trust for Certificate Validation	3	No	Yes
297	Improper Validation of Host-specific Certificate Data	3	Yes	Yes
298	Improper Validation of Certificate Expiration	3	No	Yes
299	Improper Check for Certificate Revocation	3	No	Yes
311	Missing Encryption of Sensitive Data	3	Yes	No
312	Cleartext Storage of Sensitive Information	3	Yes	No
313	Plaintext Storage in a File or on Disk	3	Yes	No
316	Plaintext Storage in Memory	3	Yes	No
319	Cleartext Transmission of Sensitive Information	3	Yes	No
321	Use of Hard-coded Cryptographic Key	3	Yes	Yes
325	Missing Cryptographic Step	3	No	Yes
326	Inadequate Encryption Strength	3	Yes	Yes
327	Use of a Broken or Risky Cryptographic Algorithm	3	Yes	Yes
329	Not Using a Random IV with CBC Mode	2	Yes	No
330	Use of Insufficiently Random Values	3	Yes	No
331	Insufficient Entropy	3	Yes	No
338	Use of Cryptographically Weak Pseudo-Random Number Generator	3	Yes	No
345	Insufficient Verification of Data Authenticity	4	Yes	Yes
347	Improper Verification of Cryptographic Signature	2	Yes	No
354	Improper Validation of Integrity Check Value	3	Yes	No
547	Use of Hard-coded, Security-relevant Constants	3	Yes	No
614	Sensitive Cookie in HTTPS Session Without Secure Attribute	2	Yes	Yes
760	Use of a One-Way Hash with a Predictable Salt	3	Yes	No
780	Use of RSA without Optimal Asymmetric Encryption Padding	3	Yes	No
916	Use of Password Hash With Insufficient Computational Effort	3	Yes	No

Dangerous Functions

CWE ID	CWE name	Flaw severity	SAST support	DAST support
242	Use of Inherently Dangerous Function	5	Yes	No
676	Use of Potentially Dangerous Function	3	Yes	No

Deployment Configuration

CWE ID	CWE name	Flaw severity	SAST support	DAST support
402	Transmission of Private Resources into a New Sphere (Resource Leak)	3	No	Yes
668	Exposure of Resource to Wrong Sphere	3	Yes	Yes
926	Improper Export of Android Application Components	3	Yes	No

Directory Traversal

CWE ID	CWE name	Flaw severity	SAST support	DAST support
22	Improper Limitation of a Pathname to a Restricted Directory (Path Traversal)	3	Yes	Yes
73	External Control of File Name or Path	3	Yes	No

Encapsulation

CWE ID	CWE name	Flaw severity	SAST support	DAST support
501	Trust Boundary Violation	0	Yes	No
502	Deserialization of Untrusted Data	3	Yes	Yes
693	Protection Mechanism Failure	3	Yes	Yes
749	Exposed Dangerous Method or Function	4	Yes	No

Error Handling

CWE ID	CWE name	Flaw severity	SAST support	DAST support
248	Uncaught Exception	2	Yes	No
252	Unchecked Return Value	2	Yes	No

Format String

CWE ID	CWE name	Flaw severity	SAST support	DAST support
134	Use of Externally-Controlled Format String	5	Yes	No

Information Leakage

CWE ID	CWE name	Flaw severity	SAST support	DAST support
200	Information Exposure	2	Yes	Yes
201	Insertion of Sensitive Information Into Sent Data	2	Yes	No
209	Information Exposure Through an Error Message	2	Yes	Yes
215	Information Exposure Through Debug Information	2	Yes	Yes
359	Exposure of Private Information (Privacy Violation)	2	Yes	Yes
497	Exposure of System Data to an Unauthorized Control Sphere	2	Yes	No
526	Information Exposure Through Environmental Variables	2	No	Yes
530	Exposure of Backup File to an Unauthorized Control Sphere	2	No	Yes
532	Insertion of Sensitive Information into Log File	2	Yes	No
538	File and Directory Information Exposure	2	No	Yes
548	Information Exposure Through Directory Listing	2	No	Yes
611	Information Exposure Through XML External Entity Reference	3	Yes	Yes
615	Information Exposure Through Comments	2	Yes	No
665	Improper Initialization	2	Yes	No
918	Server-side Request Forgery	3	Yes	Yes

Insecure Dependencies

CWE ID	CWE name	Flaw severity	SAST support	DAST support
829	Inclusion of Functionality from Untrusted Control Sphere	3	Yes	Yes
1357	Reliance on Insufficiently Trustworthy Component	3	No	Yes

Insufficient Input Validation

CWE ID	CWE name	Flaw severity	SAST support	DAST support
20	Improper Input Validation	0	Yes	No
90	Improper Neutralization of Special Elements Used in an LDAP Query (LDAP Injection)	3	Yes	No
103	Struts: Incomplete validate() Method Definition	3	Yes	No
104	Struts: Form Bean Does Not Extend Validation Class	3	Yes	No
112	Missing XML Validation	3	Yes	No
115	Misinterpretation of Input	4	No	Yes
183	Permissive List of Allowed Inputs	3	Yes	No
223	Omission of Security-relevant Information	2	Yes	No
434	Unrestricted Upload of File with Dangerous Type	4	No	Yes
470	Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)	3	Yes	No
472	External Control of Assumed-Immutable Web Parameter	3	Yes	No
601	URL Redirection to Untrusted Site (Open Redirect)	3	Yes	Yes
618	Exposed Unsafe ActiveX Method	5	Yes	No
915	Improperly Controlled Modification of Dynamically-Determined Object Attributes	3	Yes	No
1174	ASP.NET Misconfiguration: Improper Model Validation	2	Yes	No
1236	Improper Neutralization of Formula Elements in a CSV File	3	Yes	No
1427	Improper Neutralization of Input Used for LLM Prompting	4	Yes	No

Numeric Errors

CWE ID	CWE name	Flaw severity	SAST support	DAST support
190	Integer Overflow or Wraparound	5	Yes	No
191	Integer Underflow (Wrap or Wraparound)	3	Yes	No
192	Integer Coercion Error	3	Yes	No
195	Signed to Unsigned Conversion Error	3	Yes	No
196	Unsigned to Signed Conversion Error	3	Yes	No
197	Numeric Truncation Error	3	Yes	No

Potential Backdoor

CWE ID	CWE name	Flaw severity	SAST support	DAST support
398	Indicator of Poor Code Quality	0	Yes	No
506	Embedded Malicious Code	4	Yes	No
511	Logic/Time Bomb	5	Yes	No
514	Covert Channel	2	Yes	No
656	Reliance on Security Through Obscurity	0	Yes	No

Race Conditions

CWE ID	CWE name	Flaw severity	SAST support	DAST support
366	Race Condition within a Thread	3	Yes	No
367	Time-of-check Time-of-use (TOCTOU) Race Condition	3	Yes	No
421	Race Condition During Access to Alternate Channel	3	Yes	No

Server Configuration

CWE ID	CWE name	Flaw severity	SAST support	DAST support
16	Configuration	0	No	Yes
441	Unintended Proxy or Intermediary (Confused Deputy)	3	Yes	No
642	External Control of Critical State Data	2	No	Yes
757	Selection of Less-Secure Algorithm During Negotiation (Algorithm Downgrade)	3	Yes	Yes
1125	Excessive Attack Surface	0	No	Yes

Session Fixation

CWE ID	CWE name	Flaw severity	Static support	Dynamic support
384	Session Fixation	3	Yes	Yes

SQL Injection

CWE ID	CWE name	Flaw severity	SAST support	DAST support
89	Improper Neutralization of Special Elements used in an SQL Command (SQL Injection)	4	Yes	Yes
564	SQL Injection: Hibernate	4	Yes	No
943	Improper Neutralization of Special Elements in Data Query Logic	4	Yes	Yes

Time and State

CWE ID	CWE name	Flaw severity	SAST support	DAST support
377	Insecure Temporary File	3	Yes	No
382	J2EE Bad Practices: Use of System.exit()	2	Yes	No
557	Concurrency Issues	2	Yes	No
691	Insufficient Control Flow Management	0	Yes	No

Untrusted Initialization

CWE ID	CWE name	Flaw severity	SAST support	DAST support
15	External Control of System or Configuration Setting	4	Yes	No
454	External Initialization of Trusted Variables or Data Stores	0	Yes	No

Untrusted Search Path

CWE ID	CWE name	Flaw severity	SAST support	DAST support
114	Process Control	5	Yes	No
426	Untrusted Search Path	3	Yes	No
427	Uncontrolled Search Path Element	3	Yes	No