CAPEC Related Weakness
Manipulating Web Input to File System Calls
CWE-15External Control of System or Configuration Setting
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-23Relative Path Traversal
CWE-59Improper Link Resolution Before File Access ('Link Following')
CWE-73External Control of File Name or Path
CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-264Permissions, Privileges, and Access Controls
CWE-272Least Privilege Violation
CWE-285Improper Authorization
CWE-346Origin Validation Error
CWE-348Use of Less Trusted Source
CWE-715OWASP Top Ten 2007 Category A4 - Insecure Direct Object Reference
Pharming
CWE-346Origin Validation Error
CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
Navigation Remapping To Propagate Malicious Content
CWE-311Missing Encryption of Sensitive Data
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-602Client-Side Enforcement of Server-Side Security
DNS Cache Poisoning
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-348Use of Less Trusted Source
CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-350Reliance on Reverse DNS Resolution for a Security-Critical Action
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
Transaction or Event Tampering via Application API Manipulation
CWE-311Missing Encryption of Sensitive Data
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-602Client-Side Enforcement of Server-Side Security
Exploitation of Trusted Credentials
CWE-6J2EE Misconfiguration: Insufficient Session-ID Length
CWE-290Authentication Bypass by Spoofing
CWE-302Authentication Bypass by Assumed-Immutable Data
CWE-346Origin Validation Error
CWE-384Session Fixation
CWE-539Use of Persistent Cookies Containing Sensitive Information
CWE-602Client-Side Enforcement of Server-Side Security
CWE-642External Control of Critical State Data
CWE-664Improper Control of a Resource Through its Lifetime
Application API Message Manipulation via Man-in-the-Middle
CWE-311Missing Encryption of Sensitive Data
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-602Client-Side Enforcement of Server-Side Security
Session Credential Falsification through Prediction
CWE-6J2EE Misconfiguration: Insufficient Session-ID Length
CWE-200Exposure of Sensitive Information to an Unauthorized Actor
CWE-285Improper Authorization
CWE-290Authentication Bypass by Spoofing
CWE-330Use of Insufficiently Random Values
CWE-331Insufficient Entropy
CWE-346Origin Validation Error
CWE-384Session Fixation
CWE-488Exposure of Data Element to Wrong Session
CWE-539Use of Persistent Cookies Containing Sensitive Information
CWE-693Protection Mechanism Failure
CWE-719OWASP Top Ten 2007 Category A8 - Insecure Cryptographic Storage
Manipulating Writeable Configuration Files
CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-99Improper Control of Resource Identifiers ('Resource Injection')
CWE-346Origin Validation Error
CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-353Missing Support for Integrity Check
CWE-354Improper Validation of Integrity Check Value
CWE-713OWASP Top Ten 2007 Category A2 - Injection Flaws
Application API Navigation Remapping
CWE-311Missing Encryption of Sensitive Data
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-602Client-Side Enforcement of Server-Side Security
Application API Button Hijacking
CWE-311Missing Encryption of Sensitive Data
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-471Modification of Assumed-Immutable Data (MAID)
CWE-602Client-Side Enforcement of Server-Side Security
SaaS User Request Forgery
CWE-346Origin Validation Error
Cache Poisoning
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-348Use of Less Trusted Source
CWE-349Acceptance of Extraneous Untrusted Data With Trusted Data
CWE-441Unintended Proxy or Intermediary ('Confused Deputy')
Exploit Script-Based APIs
CWE-346Origin Validation Error
JSON Hijacking (aka JavaScript Hijacking)
CWE-345Insufficient Verification of Data Authenticity
CWE-346Origin Validation Error
CWE-352Cross-Site Request Forgery (CSRF)
Reusing Session IDs (aka Session Replay)
CWE-200Exposure of Sensitive Information to an Unauthorized Actor
CWE-285Improper Authorization
CWE-290Authentication Bypass by Spoofing
CWE-294Authentication Bypass by Capture-replay
CWE-346Origin Validation Error
CWE-384Session Fixation
CWE-488Exposure of Data Element to Wrong Session
CWE-539Use of Persistent Cookies Containing Sensitive Information
CWE-664Improper Control of a Resource Through its Lifetime
CWE-732Incorrect Permission Assignment for Critical Resource
Back to Top