比特派app官方链接|cwe
CWE - Common Weakness Enumeration
CWE -
Common Weakness Enumeration
Common Weakness Enumeration
A community-developed list of SW & HW weaknesses that can become vulnerabilities
ID Lookup:
Home
About ▼
About
New to CWE
User Stories
History
Documents
FAQs
Glossary
Compatibility
CWE List ▼
Latest Version
Downloads
Reports
Visualizations
Archive
Mapping ▼
CVE → CWE Mapping Guidance
CVE → CWE Mapping Quick Tips
CVE → CWE Mapping Examples
Common Terms Cheatsheet
Top-N Lists ▼
Top 25 Software
Top Hardware
Top 10 KEV Weaknesses
Community ▼
Community
Working Groups & Special Interest Groups
Board
Board Meeting Minutes
CWE Discussion List
CWE Discussion Archives
Contribute Weakness Content to CWE
News ▼
Current News
X-Twitter
Mastodon
YouTube
Podcast
Medium
News Archive
Search
CWE Glossary Definition
CWE Top 10 KEV Weaknesses
This list identifies the top ten CWEs in the Cybersecurity and Infrastructure Security Agency’s (CISA) “Known Exploited Vulnerabilities (KEV) Catalog,” a database of security flaws in software applications that have been exposed and leveraged by attackers. Our analysis/key insights about the list are available here, and our methodology for creating the list is here.
CWE List Quick Access
Search CWE
View CWEs by
Software Development
Hardware Design
All Weaknesses
Other Select Options
Total Weaknesses: 938
Community Engagement
Hardware CWE Special Interest Group
Join HW CWE SIG
ICS/OT Special Interest Group
Join ICS/OT SIG
REST API Working Group
Join REST API WG
User Experience Working Group
Join UE WG
CWE/CAPEC Board
Read meeting minutes
Contribute Weakness Content to CWE
Contact the CWE Program: cwe@mitre.org
CWE News
News
CWE Version 4.14 Now Available
Podcast
Red Hat’s CWE Journey
News
“2023 CWE Top 10 KEV Weaknesses” List Now Available
News
Follow CWE on Mastodon!
News
Enhancing Automotive Security with CWE
More >>
More information is available — Please edit the custom filter or select a different filter.
Page Last Updated:
February 29, 2024
Site Map |
Terms of Use |
Manage Cookies |
Cookie Notice |
Privacy Policy |
Contact Us |
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.
CWE - CWE List Version 4.14
CWE -
CWE List Version 4.14
Common Weakness Enumeration
A community-developed list of SW & HW weaknesses that can become vulnerabilities
Home > CWE List
Version 4.14
ID Lookup:
Home
About ▼
About
New to CWE
User Stories
History
Documents
FAQs
Glossary
Compatibility
CWE List ▼
Latest Version
Downloads
Reports
Visualizations
Archive
Mapping ▼
CVE → CWE Mapping Guidance
CVE → CWE Mapping Quick Tips
CVE → CWE Mapping Examples
Common Terms Cheatsheet
Top-N Lists ▼
Top 25 Software
Top Hardware
Top 10 KEV Weaknesses
Community ▼
Community
Working Groups & Special Interest Groups
Board
Board Meeting Minutes
CWE Discussion List
CWE Discussion Archives
Contribute Weakness Content to CWE
News ▼
Current News
X-Twitter
Mastodon
YouTube
Podcast
Medium
News Archive
Search
CWE Glossary Definition
CWE List Version 4.14
Total Weaknesses: 938
Latest Version |
Downloads |
Reports |
Visualizations |
Archive
Latest Version
At its core, the Common Weakness Enumeration (CWE™) is a list of software and hardware weaknesses types. Creating the list is a community initiative aimed at creating specific and succinct definitions for each common weakness type. By leveraging the widest possible group of interests and talents, the hope is to ensure that item in the list is adequately described and differentiated. This is a living effort with ongoing work to capture the specific effects, behaviors, exploit mechanisms, and implementation details within the CWE List as well as to review and revise the presentation approaches to provide those that best suit the community using this information.
Navigate CWE
Use one of the hierarchical representations below to navigate the entire list according to your specific point of view. The Software Development representation groups weaknesses around concepts that are frequently used or encountered in software development, while the Hardware Design representation groups weaknesses around concepts that are frequently used or encountered in hardware design. The Research Concepts representation facilitates research into weakness types and organizes items by behaviors using multiple levels of abstraction.
View by Software Development
View by Hardware Design
View by Research Concepts
Back to top
External Mappings
These views are used to represent mappings to external groupings such as a Top-N list, as well as to express subsets of entries that are related by some external factor.
CWE Top 25 (2023)
Most Important Hardware Weaknesses List (2021)
OWASP Top Ten (2021)
Seven Pernicious Kingdoms
Software Fault Pattern Clusters
SEI CERT Oracle Coding Standard for Java
SEI CERT C Coding Standard
SEI CERT Perl Coding Standard
Addressed by ISA/IEC 62443 Requirements
CISQ Quality Measures (2020)
CISQ Data Protection Measures
SEI ETF Security Vulnerabilities in ICS
Architectural Concepts
Back to top
Helpful Views
A number of additional helpful views have been created. These are based on a specific criteria and hope to provide insight for a certain domain or use case.
Introduced During Design
Introduced During Implementation
Software Assurance Trends Categorization
Quality Weaknesses with Indirect Security Impacts
Software Written in C
Software Written in C++
Software Written in Java
Software Written in PHP
Weaknesses in Mobile Applications
CWE Composites
CWE Named Chains
CWE Cross-Section
CWE Simplified Mapping
CWE Entries with Maintenance Notes
CWE Deprecated Entries
CWE Comprehensive View
Weakness Base Elements
Back to top
Obsolete Views
The views below have been marked obsolete. They are still valid but no longer considered relevant, likely because each has been superseded by a more recent view.
CWE Top 25 (2022)
CWE Top 25 (2021)
CWE Top 25 (2020)
CWE Top 25 (2019)
CWE/SANS Top 25 (2011)
CWE/SANS Top 25 (2010)
CWE/SANS Top 25 (2009)
Weaknesses Used by NVD
OWASP Top Ten (2017)
OWASP Top Ten (2013)
OWASP Top 10 (2010)
OWASP Top 10 (2007)
OWASP Top 10 (2004)
The CERT C Secure Coding Standard (2008)
The CERT Oracle Secure Coding Standard for Java (2011)
SEI CERT C++ Coding Standard (2016)
CISQ Quality Measures (2016)
Back to top
More information is available — Please edit the custom filter or select a different filter.
Page Last Updated:
February 29, 2024
Site Map |
Terms of Use |
Manage Cookies |
Cookie Notice |
Privacy Policy |
Contact Us |
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.
CWE - CWE Top 25 Most Dangerous Software Weaknesses
CWE -
CWE Top 25 Most Dangerous Software Weaknesses
Common Weakness Enumeration
A community-developed list of SW & HW weaknesses that can become vulnerabilities
Home > CWE Top 25
ID Lookup:
Home
About ▼
About
New to CWE
User Stories
History
Documents
FAQs
Glossary
Compatibility
CWE List ▼
Latest Version
Downloads
Reports
Visualizations
Archive
Mapping ▼
CVE → CWE Mapping Guidance
CVE → CWE Mapping Quick Tips
CVE → CWE Mapping Examples
Common Terms Cheatsheet
Top-N Lists ▼
Top 25 Software
Top Hardware
Top 10 KEV Weaknesses
Community ▼
Community
Working Groups & Special Interest Groups
Board
Board Meeting Minutes
CWE Discussion List
CWE Discussion Archives
Contribute Weakness Content to CWE
News ▼
Current News
X-Twitter
Mastodon
YouTube
Podcast
Medium
News Archive
Search
CWE Glossary Definition
CWE Top 25 Most Dangerous Software Weaknesses
Welcome to the 2023 Common Weakness Enumeration (CWE™) Top 25 Most Dangerous Software Weaknesses list (CWE™ Top 25). This list demonstrates the currently most common and impactful software weaknesses.
Often easy to find and exploit, these can lead to exploitable vulnerabilities that allow adversaries to completely take over a system, steal data, or prevent applications from working.
2023 Top 25 List
Key Insights
Methodology
CWEs are becoming more and more prevalent in vulnerability exposure conversations as the community looks to avoid the root causes that can become vulnerabilities. Links to information and documents that will help you understand and use the CWE Top 25 more effectively are noted below.
Available now:
2023 CWE Top 10 KEV Weaknesses — Ranking actively exploited weaknesses by CISA’s KEV Catalog.
Stubborn Weaknesses in the CWE Top 25 — 15 weaknesses that have been present on every list from 2019-2023 with potential mitigations.
Trends in Real-World CWEs: 2019 to 2023 — A discussion of overall trends and what it means for your IT infrastructure.
2023 “On the Cusp” Weaknesses List — 15 additional weaknesses that were “on the cusp” of being included in the 2023 CWE Top 25.
2023 On the Cusp Weaknesses Insights — A discussion about the On the Cusp CWEs that continue to be prevalent and severe enough to cause concern.
Top 25 Archive
Back to top
More information is available — Please edit the custom filter or select a different filter.
Page Last Updated:
November 30, 2023
Site Map |
Terms of Use |
Manage Cookies |
Cookie Notice |
Privacy Policy |
Contact Us |
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.
Common Weakness Enumeration - Wikipedia
Common Weakness Enumeration - Wikipedia
Jump to content
Main menu
Main menu
move to sidebar
hide
Navigation
Main pageContentsCurrent eventsRandom articleAbout WikipediaContact usDonate
Contribute
HelpLearn to editCommunity portalRecent changesUpload file
Search
Search
Create account
Log in
Personal tools
Create account Log in
Pages for logged out editors learn more
ContributionsTalk
Contents
move to sidebar
hide
(Top)
1Examples
2CWE compatibility
3Research, critiques, and new developments
4See also
5References
6External links
Toggle the table of contents
Common Weakness Enumeration
5 languages
EspañolFrançaisNederlandsУкраїнська中文
Edit links
ArticleTalk
English
ReadEditView history
Tools
Tools
move to sidebar
hide
Actions
ReadEditView history
General
What links hereRelated changesUpload fileSpecial pagesPermanent linkPage informationCite this pageGet shortened URLDownload QR codeWikidata item
Print/export
Download as PDFPrintable version
From Wikipedia, the free encyclopedia
Catalog of software weaknesses and vulnerabilities
The Common Weakness Enumeration (CWE) is a category system for hardware and software weaknesses and vulnerabilities. It is sustained by a community project with the goals of understanding flaws in software and hardware and creating automated tools that can be used to identify, fix, and prevent those flaws.[1] The project is sponsored by the office of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA), which is operated by The MITRE Corporation,[2] with support from US-CERT and the National Cyber Security Division of the U.S. Department of Homeland Security.[3][4]
Version 4.10 of the CWE standard was released in July 2021.[5]
CWE has over 600 categories, including classes for buffer overflows, path/directory tree traversal errors, race conditions, cross-site scripting, hard-coded passwords, and insecure random numbers.[6]
Examples[edit]
CWE category 121 is for stack-based buffer overflows.[7]
CWE compatibility[edit]
Common Weakness Enumeration (CWE) Compatibility program allows a service or a product to be reviewed and registered as officially "CWE-Compatible" and "CWE-Effective". The program assists organizations in selecting the right software tools and learning about possible weaknesses and their possible impact.
In order to obtain CWE Compatible status a product or a service must meet 4 out of 6 requirements, shown below:
CWE Searchable
users may search security elements using CWE identifiers
CWE Output
security elements presented to users include, or allow users to obtain, associated CWE identifiers
Mapping Accuracy
security elements accurately link to the appropriate CWE identifiers
CWE Documentation
capability's documentation describes CWE, CWE compatibility, and how CWE-related functionality in the capability is used
CWE Coverage
for CWE-Compatibility and CWE-Effectiveness, the capability's documentation explicitly lists the CWE-IDs that the capability claims coverage and effectiveness against locating in software
CWE Test Results
for CWE-Effectiveness, test results from the capability showing the results of assessing software for the CWEs are posted on the CWE Web site
There are 56 organizations as of September 2019 that develop and maintain products and services that achieved CWE Compatible status.[8]
Research, critiques, and new developments[edit]
Some researchers think that ambiguities in CWE can be avoided or reduced.[9]
See also[edit]
Common Vulnerabilities and Exposures (CVE)
Common Vulnerability Scoring System (CVSS)
National Vulnerability Database
References[edit]
^ "CWE - About CWE". at mitre.org.
^ "CWE - Frequently Asked Questions (FAQ)". cwe.mitre.org. Retrieved 2023-09-21.
^ National Vulnerabilities Database CWE Slice at nist.gov
^ Goseva-Popstojanova, Katerina; Perhinschi, Andrei (2015). "On the capability of static code analysis to detect security vulnerabilities". Information and Software Technology. 68: 18–33. doi:10.1016/j.infsof.2015.08.002.
^
"CWE Version 4.10 Now Available". The MITRE Corporation. Retrieved 9 March 2022.
^ The Bugs Framework (BF) / Common Weakness Enumeration (CWE) at nist.gov
^ CWE-121: Stack-based Buffer Overflows
^ "CWE - CWE-Compatible Products and Services". at mitre.org.
^ Paul E. Black, Irena V. Bojanova, Yaacov Yesha, Yan Wu. 2015. Towards a “Periodic Table” of Bugs
External links[edit]
Certifying Applications for Known Security Weaknesses. The Common Weakness Enumeration (CWE) Effort // 6 March 2007
"Classes of Vulnerabilities and Attacks" (PDF). Wiley Handbook of Science and Technology for Homeland Security. comparison of different vulnerability Classifications. Archived from the original (PDF) on 2016-03-22.{{cite web}}: CS1 maint: others (link)
vteMitre Corporation computer security ontologies
Common Weakness Enumeration (CWE)
Common Vulnerabilities and Exposures (CVE)
Common Vulnerability Scoring System (CVSS)
Common Attack Pattern Enumeration and Classification (CAPEC)
Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)
Retrieved from "https://en.wikipedia.org/w/index.php?title=Common_Weakness_Enumeration&oldid=1211549623"
Categories: Software anomaliesComputer standardsComputer network securityComputer security organizationsClassification systemsHidden categories: Articles with short descriptionShort description matches WikidataCS1 maint: others
This page was last edited on 3 March 2024, at 03:49 (UTC).
Text is available under the Creative Commons Attribution-ShareAlike License 4.0;
additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy. Wikipedia® is a registered trademark of the Wikimedia Foundation, Inc., a non-profit organization.
Privacy policy
About Wikipedia
Disclaimers
Contact Wikipedia
Code of Conduct
Developers
Statistics
Cookie statement
Mobile view
Toggle limited content width
NVD - Categories
NVD - Categories
You are viewing this page in an unauthorized frame window.
This is a potential security issue, you are being redirected to
https://nvd.nist.gov
You have JavaScript disabled. This site requires JavaScript to be enabled for complete site functionality.
An official website of the United States government
Here's how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock () or https:// means you've safely connected to the .gov website. Share sensitive information only on official, secure websites.
NVD MENU
General Expand or Collapse
NVD Dashboard
News
Email List
FAQ
Visualizations
Legal Disclaimer
Vulnerabilities
Expand or Collapse
Search & Statistics
Weakness Types
Legacy Data Feeds
Vendor Comments
CVMAP
Vulnerability Metrics Expand or Collapse
CVSS V3
Calculator
CVSS V2
Calculator
Products Expand or Collapse
CPE Dictionary
CPE Search
CPE Statistics
SWID
Developers Expand or Collapse
Start Here
Request an API Key
Vulnerabilities
Products
Data Sources
Terms of Use
Contact NVD
Other Sites Expand or Collapse
Checklist (NCP) Repository
Configurations (CCE)
800-53 Controls
SCAP
Validated Tools
SCAP
USGCB
Search Expand or Collapse
Vulnerability Search
CPE Search
Information Technology Laboratory
National Vulnerability Database
National Vulnerability Database
NVD
Vulnerabilities
NVD CWE Slice
The Common Weakness Enumeration Specification (CWE) provides a common language of discourse for discussing, finding and dealing with the causes of software security vulnerabilities as they are found in code, design, or system architecture. Each individual CWE represents a single vulnerability type. CWE is currently maintained by the MITRE Corporation. A detailed CWE list is currently available at the MITRE website; this list provides a detailed definition for each individual CWE.
All individual CWEs are held within a hierarchical structure that allows for multiple levels of abstraction. CWEs located at higher levels of the structure (i.e.
Configuration
) provide a broad overview of a vulnerability type and can have many children CWEs associated with them. CWEs at deeper levels in the structure (i.e.
Cross Site Scripting
) provide a finer granularity and usually have fewer or no children CWEs. The image to the right represents a portion of the overall CWE structure, the red boxes represent the CWEs being used by NVD. Clicking the image to the right will open an enlarged version for viewing.
NVD integrates CWE into the scoring of CVE vulnerabilities by providing a cross section of the overall CWE structure. NVD analysts score CVEs using CWEs from different levels of the hierarchical structure. This cross section of CWEs allows analysts to score CVEs at both a fine and coarse granularity, which is necessary due to the varying levels of specificity possessed by different CVEs. The cross section of CWEs used by NVD is listed below; each CWE listed links to a detailed description hosted by MITRE. For a better understanding of how the standards link together please visit:
MITRE - Making Security Measurable
CWE is not currently part of the
Security Content Automation Protocol
(SCAP). NVD is using CWE as a classification mechanism that differentiates CVEs by the type of vulnerability they represent.
Related Activities
The Software Assurance Metrics and Tool Evaluation
(SAMATE) Project, NIST.
CWE-ID
Name
Description
CWE-843
Access of Resource Using Incompatible Type ('Type Confusion')
The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
CWE-824
Access of Uninitialized Pointer
The program accesses or uses a pointer that has not been initialized.
CWE-770
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CWE-670
Always-Incorrect Control Flow Implementation
The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.
CWE-294
Authentication Bypass by Capture-replay
A capture-replay flaw exists when the design of the software makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
CWE-290
Authentication Bypass by Spoofing
This attack-focused weakness is caused by improperly implemented authentication schemes that are subject to spoofing attacks.
CWE-639
Authorization Bypass Through User-Controlled Key
The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-120
Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CWE-312
Cleartext Storage of Sensitive Information
The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-319
Cleartext Transmission of Sensitive Information
The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CWE-352
Cross-Site Request Forgery (CSRF)
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CWE-502
Deserialization of Untrusted Data
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CWE-425
Direct Request ('Forced Browsing')
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CWE-369
Divide By Zero
The product divides a value by zero.
CWE-415
Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CWE-494
Download of Code Without Integrity Check
The product downloads source code or an executable from a remote location and executes the code without sufficiently verifying the origin and integrity of the code.
CWE-834
Excessive Iteration
The software performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.
CWE-668
Exposure of Resource to Wrong Sphere
The product exposes a resource to the wrong control sphere, providing unintended actors with inappropriate access to the resource.
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-610
Externally Controlled Reference to a Resource in Another Sphere
The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CWE-552
Files or Directories Accessible to External Parties
The product makes files or directories accessible to unauthorized actors, even though they should not be.
CWE-209
Generation of Error Message Containing Sensitive Information
The software generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-287
Improper Authentication
When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CWE-295
Improper Certificate Validation
The software does not validate, or incorrectly validates, a certificate.
CWE-273
Improper Check for Dropped Privileges
The software attempts to drop privileges but does not check or incorrectly checks to see if the drop succeeded.
CWE-754
Improper Check for Unusual or Exceptional Conditions
The software does not check or incorrectly checks for unusual or exceptional conditions that are not expected to occur frequently during day to day operation of the software.
CWE-913
Improper Control of Dynamically-Managed Code Resources
The software does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.
CWE-94
Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-116
Improper Encoding or Escaping of Output
The software prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved.
CWE-924
Improper Enforcement of Message Integrity During Transmission in a Communication Channel
The software establishes a communication channel with an endpoint and receives a message from that endpoint, but it does not sufficiently ensure that the message was not modified during transmission.
CWE-178
Improper Handling of Case Sensitivity
The software does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-755
Improper Handling of Exceptional Conditions
The software does not handle or incorrectly handles an exceptional condition.
CWE-665
Improper Initialization
The software does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.
CWE-20
Improper Input Validation
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-59
Improper Link Resolution Before File Access ('Link Following')
The software attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.
CWE-667
Improper Locking
The software does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
CWE-88
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
The software constructs a string for a command to executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
CWE-1236
Improper Neutralization of Formula Elements in a CSV File
The software saves user-provided information into a Comma-Separated Value (CSV) file, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as a command when the file is opened by spreadsheet software.
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-74
Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The software constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-917
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression La
The software constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CWE-281
Improper Preservation of Permissions
The software does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.
CWE-269
Improper Privilege Management
The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-212
Improper Removal of Sensitive Information Before Storage or Transfer
The product stores, transfers, or shares a resource that contains sensitive information, but it does not properly remove that information before the product makes the resource available to unauthorized actors.
CWE-404
Improper Resource Shutdown or Release
The program does not release or incorrectly releases a resource before it is made available for re-use.
CWE-307
Improper Restriction of Excessive Authentication Attempts
The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CWE-920
Improper Restriction of Power Consumption
The software operates in an environment in which power is a limited resource that cannot be automatically replenished, but the software does not properly restrict the amount of power that its operation consumes.
CWE-776
Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
CWE-1021
Improper Restriction of Rendered UI Layers or Frames
The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.
CWE-611
Improper Restriction of XML External Entity Reference
The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CWE-662
Improper Synchronization
The software utilizes multiple threads or processes to allow temporary access to a shared resource that can only be exclusive to one process at a time, but it does not properly synchronize these actions, which might cause simultaneous accesses of this resource by multiple threads or processes.
CWE-129
Improper Validation of Array Index
The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-354
Improper Validation of Integrity Check Value
The software does not validate or incorrectly validates the integrity check values or "checksums" of a message. This may prevent it from detecting if the data has been modified or corrupted in transmission.
CWE-1284
Improper Validation of Specified Quantity in Input
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.
CWE-347
Improper Verification of Cryptographic Signature
The software does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-1321
Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
The software receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.
CWE-326
Inadequate Encryption Strength
The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CWE-838
Inappropriate Encoding for Output Context
The software uses or specifies an encoding when generating output to a downstream component, but the specified encoding is not the same as the encoding that is expected by the downstream component.
CWE-829
Inclusion of Functionality from Untrusted Control Sphere
The software imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere.
CWE-459
Incomplete Cleanup
The software does not properly "clean up" and remove temporary or supporting resources after they have been used.
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
The product acts as an intermediary HTTP agent (such as a proxy or firewall) in the data flow between two entities such as a client and server, but it does not interpret malformed HTTP requests or responses in ways that are consistent with how the messages will be processed by those entities that are at the ultimate destination.
CWE-863
Incorrect Authorization
The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CWE-682
Incorrect Calculation
The software performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.
CWE-131
Incorrect Calculation of Buffer Size
The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-697
Incorrect Comparison
The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CWE-681
Incorrect Conversion between Numeric Types
When converting from one data type to another, such as long to integer, data can be omitted or translated in a way that produces unexpected values. If the resulting values are used in a sensitive context, then dangerous behaviors may occur.
CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.
CWE-732
Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
CWE-669
Incorrect Resource Transfer Between Spheres
The product does not properly transfer a resource/behavior to another sphere, or improperly imports a resource/behavior from another sphere, in a manner that provides unintended control over that resource.
CWE-704
Incorrect Type Conversion or Cast
The software does not correctly convert an object, resource, or structure from one type to a different type.
CWE-335
Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
The software uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.
CWE-407
Inefficient Algorithmic Complexity
An algorithm in a product has an inefficient worst-case computational complexity that may be detrimental to system performance and can be triggered by an attacker, typically using crafted manipulations that ensure that the worst case is being reached.
CWE-1333
Inefficient Regular Expression Complexity
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-1188
Insecure Default Initialization of Resource
The software initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.
CWE-922
Insecure Storage of Sensitive Information
The software stores sensitive information without properly limiting read or write access by unauthorized actors.
CWE-532
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.
CWE-331
Insufficient Entropy
The software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
NVD-CWE-noinfo
Insufficient Information
There is insufficient information about the issue to classify it; details are unkown or unspecified.
CWE-613
Insufficient Session Expiration
According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CWE-345
Insufficient Verification of Data Authenticity
The software does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-522
Insufficiently Protected Credentials
The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-190
Integer Overflow or Wraparound
The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
CWE-191
Integer Underflow (Wrap or Wraparound)
The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-436
Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
CWE-835
Loop with Unreachable Exit Condition ('Infinite Loop')
The program contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
CWE-306
Missing Authentication for Critical Function
The software does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.
CWE-862
Missing Authorization
The software does not perform an authorization check when an actor attempts to access a resource or perform an action.
CWE-311
Missing Encryption of Sensitive Data
The software does not encrypt sensitive or critical information before storage or transmission.
CWE-909
Missing Initialization of Resource
The software does not initialize a critical resource.
CWE-401
Missing Release of Memory after Effective Lifetime
The software does not sufficiently track and release allocated memory after it has been used, which slowly consumes remaining memory.
CWE-772
Missing Release of Resource after Effective Lifetime
The software does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CWE-476
NULL Pointer Dereference
A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
CWE-203
Observable Discrepancy
The product behaves differently or sends different responses under different circumstances in a way that is observable to an unauthorized actor, which exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-193
Off-by-one Error
A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-672
Operation on a Resource after Expiration or Release
The software uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
CWE-346
Origin Validation Error
The software does not properly verify that the source of data or communication is valid.
NVD-CWE-Other
Other
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CWE-125
Out-of-bounds Read
The software reads data past the end, or before the beginning, of the intended buffer.
CWE-787
Out-of-bounds Write
The software writes data past the end, or before the beginning, of the intended buffer.
CWE-617
Reachable Assertion
The product contains an assert() or similar statement that can be triggered by an attacker, which leads to an application exit or other behavior that is more severe than necessary.
CWE-763
Release of Invalid Pointer or Reference
The application attempts to return a memory resource to the system, but calls the wrong release function or calls the appropriate release function incorrectly.
CWE-565
Reliance on Cookies without Validation and Integrity Checking
The application relies on the existence or values of cookies when performing security-critical operations, but it does not properly ensure that the setting is valid for the associated user.
CWE-918
Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-384
Session Fixation
Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition
The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.
CWE-252
Unchecked Return Value
The software does not check the return value from a method or function, which can prevent it from detecting unexpected states and conditions.
CWE-674
Uncontrolled Recursion
The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.
CWE-400
Uncontrolled Resource Consumption
The software does not properly control the allocation and maintenance of a limited resource, thereby enabling an actor to influence the amount of resources consumed, eventually leading to the exhaustion of available resources.
CWE-427
Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
CWE-428
Unquoted Search Path or Element
The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
CWE-434
Unrestricted Upload of File with Dangerous Type
The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.
CWE-426
Untrusted Search Path
The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.
CWE-601
URL Redirection to Untrusted Site ('Open Redirect')
A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CWE-416
Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CWE-327
Use of a Broken or Risky Cryptographic Algorithm
The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
CWE-338
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
CWE-134
Use of Externally-Controlled Format String
The software uses a function that accepts a format string as an argument, but the format string originates from an external source.
CWE-470
Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
The application uses external input with reflection to select which classes or code to use, but it does not sufficiently prevent the input from selecting improper classes or code.
CWE-798
Use of Hard-coded Credentials
The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
CWE-706
Use of Incorrectly-Resolved Name or Reference
The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.
CWE-330
Use of Insufficiently Random Values
The software uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE-916
Use of Password Hash With Insufficient Computational Effort
The software generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
CWE-908
Use of Uninitialized Resource
The software uses or accesses a resource that has not been initialized.
CWE-640
Weak Password Recovery Mechanism for Forgotten Password
The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CWE-521
Weak Password Requirements
The product does not require that users should have strong passwords, which makes it easier for attackers to compromise user accounts.
CWE-91
XML Injection (aka Blind XPath Injection)
The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
Created
September 20, 2022
,
Updated
August 3, 2023
twitter (link
is external)
facebook (link
is external)
linkedin (link
is external)
youtube (link
is external)
rss
govdelivery (link is external)
HEADQUARTERS
100 Bureau Drive
Gaithersburg, MD 20899
(301) 975-2000
Webmaster | Contact Us
| Our Other Offices
Incident Response Assistance and Non-NVD RelatedTechnical Cyber Security Questions:
US-CERT Security Operations Center
Email: soc@us-cert.gov
Phone: 1-888-282-0870
Site Privacy
|
Accessibility
|
Privacy Program
|
Copyrights
|
Vulnerability Disclosure
|
No Fear Act Policy
|
FOIA
|
Environmental Policy
|
Scientific Integrity
|
Information Quality Standards
|
Commerce.gov
|
Science.gov
|
USA.gov
What You Need to Know About the CWE Top 25 (And 3 CWE Examples)
You Need to Know About the CWE Top 25 (And 3 CWE Examples) Skip to main content 6th Edition of the Hacker Powered Security Report is available for downloadGet your copy today! Top bar Login Contacted by a hacker? Contact Us Main navigation Platform Platform Overview Attack Resistance PlatformThreat exposure reduction Products Pentest as a ServiceContinuous, on-demand pentests ResponseVulnerability Disclosure Program (VDP) BountyBug Bounty program AssetsAttack Surface Management (ASM) ChallengeTime-bound offensive testing Code Security AuditSource code review Services & Integrations Services Integrations Login Contacted by a hacker? Contact Us Solutions Solutions Customer Success Customer StoriesOur customers say it best Solutions AI Security & Safety Application Security Attack Resistance Management Cloud Security Continuous Security Testing Continuous Vulnerability Discovery Vulnerability Management Industries Automotive and Transportation Financial Services Government Healthcare Retail, Hospitality, and Entertainment US Federal Featured Customer Story Zebra Defends its Attack Surface From All Angles With HackerOne Login Contacted by a hacker? Contact Us Partners Partners Partners Partner OverviewExplore our technology, service, and solution partners, or join us. AWSProtect your cloud environment with AWS-certified security experts. Login Contacted by a hacker? Contact Us Company Company Company About Us Why HackerOne LeadershipMeet the team building an inclusive space to innovate and share ideas. CareersWant to make the internet safer, too? Join us! TrustEarning trust through privacy, compliance, security, and transparency. In the News Press Press Releases Login Contacted by a hacker? Contact Us Hackers Hackers For Hackers HackersHack, learn, earn. See what the HackerOne community is all about. Hacker101Free videos and CTFs that connect you to private bug bounties. HacktivityWatch the latest hacker activity on HackerOne. OpportunitiesFind disclosure programs and report vulnerabilities. LeaderboardSee the top hackers by reputation, geography, OWASP Top 10, and more. h@cktivityconJoin the virtual conference for the hacker community, by the community. Login Contacted by a hacker? Contact Us Resources Resources Events Events Webinars Live Hacking Events Resources Resource Center Blogs From the CEO Company News Hacker Community Blog Culture and Talent Blog Public Policy Blog Knowledge Center Application Security Penetration Testing Attack Surface Security Compliance Cloud Security Vulnerability Assessment Cybersecurity Attacks Hacking DevSecOps OWASP CVE Information Security Website Security Login Contacted by a hacker? Contact Us Main navigation Platform Platform Overview Attack Resistance PlatformThreat exposure reduction Products Pentest as a ServiceContinuous, on-demand pentests ResponseVulnerability Disclosure Program (VDP) BountyBug Bounty program AssetsAttack Surface Management (ASM) ChallengeTime-bound offensive testing Code Security AuditSource code review Services & Integrations Services Integrations Login Contacted by a hacker? Contact Us Solutions Solutions Customer Success Customer StoriesOur customers say it best Solutions AI Security & Safety Application Security Attack Resistance Management Cloud Security Continuous Security Testing Continuous Vulnerability Discovery Vulnerability Management Industries Automotive and Transportation Financial Services Government Healthcare Retail, Hospitality, and Entertainment US Federal Featured Customer Story Zebra Defends its Attack Surface From All Angles With HackerOne Login Contacted by a hacker? Contact Us Partners Partners Partners Partner OverviewExplore our technology, service, and solution partners, or join us. AWSProtect your cloud environment with AWS-certified security experts. Login Contacted by a hacker? Contact Us Company Company Company About Us Why HackerOne LeadershipMeet the team building an inclusive space to innovate and share ideas. CareersWant to make the internet safer, too? Join us! TrustEarning trust through privacy, compliance, security, and transparency. In the News Press Press Releases Login Contacted by a hacker? Contact Us Hackers Hackers For Hackers HackersHack, learn, earn. See what the HackerOne community is all about. Hacker101Free videos and CTFs that connect you to private bug bounties. HacktivityWatch the latest hacker activity on HackerOne. OpportunitiesFind disclosure programs and report vulnerabilities. LeaderboardSee the top hackers by reputation, geography, OWASP Top 10, and more. h@cktivityconJoin the virtual conference for the hacker community, by the community. Login Contacted by a hacker? Contact Us Resources Resources Events Events Webinars Live Hacking Events Resources Resource Center Blogs From the CEO Company News Hacker Community Blog Culture and Talent Blog Public Policy Blog Knowledge Center Application Security Penetration Testing Attack Surface Security Compliance Cloud Security Vulnerability Assessment Cybersecurity Attacks Hacking DevSecOps OWASP CVE Information Security Website Security Login Contacted by a hacker? Contact Us HackerOne Submitted by HackerOne on Tue, 12/14/2021 - 08:01 BreadcrumbHomeBlogCWE (Common Weakness Enumeration) and the CWE Top 25 Explained Vulnerability Management CWE (Common Weakness Enumeration) and the CWE Top 25 Explained HackerOneVulnerability ManagementDecember 16th, 2021 Updated September 1, 2023Are you wondering about CWE? We explain CWE (Common Weakness Enumeration) and why this community-based initiative is essential in cybersecurity.Common Weakness Enumeration (CWE) is a system to categorize software and hardware security flaws—implementation defects that can lead to vulnerabilities. It is a community project to understand security weaknesses or errors in code and vulnerabilities and create tools to help prevent them.The MITRE Corporation operates CWE, and the National Cyber Security Division and US-CERT support it. CWE has over 600 categories detailing different types of vulnerabilities and bugs.CWE strives to stop vulnerabilities and bugs by educating developers on building better products that aren’t susceptible to exploitation. Programmers can use CWE as a resource while writing code to prevent vulnerabilities during the development process. Security Orchestration, Automation, and Response (SOAR) tools use CWEs to build policies and workflows to automate remediation.In this article:What Is the CWE Top 25?CWE Examples: Which Are the Most Dangerous CWEs?Invalid Input Validation (CWE-20)Out-of-Bounds Reading (CWE-125)Incorrect Restriction of Operations in the Memory Buffer (CWE-119)What Is CWE Compatibility?CWE vs. CVEWhat Is CWSS and How Does It Compare to CVSS?How HackerOne Can HelpWhat Is the CWE Top 25?The CWE Top 25 is a vulnerability list compiled by the MITRE corporation. It lists the common security vulnerabilities with the most severe impact based on the Common Weaknesses and Exposures (CWE) database. It results from ongoing research, including interviews and surveys of security analysts, suppliers, and developers.The CWE Top 25 maps information from the US government’s National Vulnerability Database (NVD), with severity ratings based on the Common Vulnerability Scoring System (CVSS). The scoring algorithm determines the severity of the vulnerabilities using a data-driven approach to update the list periodically.The 2022 CWE Top 25 includes:CWE-787 - out-of-bounds writing. Severity score: 64.20CWE-79 - improperly neutralizing input when generating web pages (cross-site scripting). Severity score: 45.97.CWE-89 - improperly neutralizing special elements in SQL commands (SQL injection). Severity score: 22.11CWE-20 - improperly validating input. Severity score: 20.63.CWE-125 - out-of-bounds reading. Severity score: 17.67.CWE-78 - improperly neutralizing special elements in operating system commands (OS command injection). Severity score: 17.53.CWE-416 - using after free. Severity score: 15.50.CWE-22 - improperly limiting pathnames to restricted directories (path traversal). Severity score: 14.08.CWE-352 - cross-site request forgery (CSRF). Severity score: 11.53.CWE-434 - unrestricted uploading of files with dangerous type. Severity score: 9.56.CWE-476 - NULL pointer dereferencing. Severity score: 7.15.CWE-502 - deserializing untrusted data. Severity score: 6.68.CWE-190 - integer overflow or wraparound. Severity score: 6.53.CWE-287 - improper authentication. Severity score: 6.35.CWE-798 - using hard-coded credentials. Severity score: 5.66.CWE-862 - missing authorization. Severity score: 5.53.CWE-77 - improperly neutralizing special elements in commands (command injection). Severity score: 5.42.CWE-306 - missing authentication for critical functions. Severity score: 5.15.CWE-119 - improperly restricting operations in memory buffers. Severity score: 4.85.CWE-276 - incorrect default permissions. Severity score: 4.84CWE-918 - server-side request forgery (SSRF). Severity score: 4.27.CWE-362 - concurrent execution with shared resources and improper synchronization (race condition). Severity score: 3.57.CWE-400 - uncontrolled resource consumption. Severity score: 3.56.CWE-611 - improperly restricting XML external entity references. Severity score: 3.38.CWE-94 - improper control of code generation (code injection). Severity score: 3.32.CWE Examples: Which Are the Most Dangerous CWEs?Following are three vulnerabilities from the CWE Top 25 which present a serious security risk.Invalid Input Validation (CWE-20)This vulnerability relates to problems in an application’s data flow. If the application doesn’t properly check all data, inputs can end up in unwanted places. This error affects applications that accept extrinsic data, allowing attackers to change data flows or execute arbitrary code. Attackers can inject malicious code into an existing data object to access confidential information.Out-of-Bounds Reading (CWE-125)This vulnerability is ubiquitous across many applications. It occurs when a system’s buffer cannot control the amount of data consumed by the software. This error allows attackers to read sensitive data like virtual addresses and exploit memory locations. It may also cause the system to crash.Many hackers use segmentation faults and buffer overflows to exploit out-of-bounds reading vulnerabilities. Developers must use input validation methods to mitigate the risk, especially in C or C++ code.Incorrect Restriction of Operations in the Memory Buffer (CWE-119)This vulnerability allows the software to read over a memory buffer’s specified boundary. It lets attackers introduce malicious code by replacing 64 memory bits. They can damage the application’s memory and compromise critical security data.Memory buffer vulnerabilities enable hackers to retrieve sensitive data, change control flows, execute malicious code, and crash the target device. The programming language, platform, and chip architecture influence the impact of this issue. Managing memory helps reduce the risk.What Is CWE-Compatible Software?The CWE compatibility program registers products or services as either CWE-Compatible or CWE-Effective. Compatible products assist organizations in assessing their applications for known weaknesses and flaws. For CWE compatibility qualification, the service product must meet the first four of the six requirements, while CWE-Effective products and services must meet all six.CWE Searchable - users may search elements using CWE identifiers.CWE Output - elements presented to users include, or are obtained associated CWE identifiers.Mapping Accuracy - security elements accurately link to the appropriate CWE identifiers.CWE Documentation - capability's documentation describes CWE, CWE compatibility, and CWE-related functionality.CWE Coverage - capability's documentation explicitly lists the CWE-IDs that the capability claims coverage and effectiveness against.CWE Test Results - for CWE-Effectiveness, the capability’s test results must show an assessment of software for CWEs, and the test results must appear on the CWE website.CWE vs. CVEThe primary difference between CWE and CVE is that CWEs highlight the vulnerabilities, not the specific instance of one within a product.For example, a CVE might detail a particular vulnerability within an operating system that allows attackers to execute code remotely. This CVE entry only details this vulnerability for a single product.A CWE outlines the vulnerability independent from any product. CWE has become a common language for discussing eliminating or mitigating software security weaknesses. Because developers have access to data regarding weaknesses early in product lifecycles, they can build products without vulnerabilities eliminating subsequent security issues. This allows developers to keep pace with rapid development lifecycles, build better products, release them faster to customers, minimize attack surfaces, and prevent more cyberattacks.A few examples of a CWE are below:Out-of-bounds WriteCross-site ScriptingImproper Input ValidationMissing Authentication for Critical FunctionWhat Is CWSS and How Does It Compare to CVSS?The key difference between CWSS and CVSS is that while CVSS is reactive, CWSS is a proactive approach to cybersecurity.CVSS stands for Common Vulnerability Scoring System, numerically scoring vulnerabilities based on risk. Vulnerabilities are security flaws that attackers can exploit to gain access to a system.Common Weakness Scoring System (CWSS) is a framework that documents software weaknesses so developers can minimize the number of bugs and vulnerabilities they introduce in a live system.The biggest difference between scoring systems is that the CWSS is proactive, whereas the CVSS is reactive. Both scoring systems can prevent vulnerabilities and prioritize the remediation of existing flaws when security teams use them together.CWSS uses three criteria to help developers prioritize software-based weaknesses:Attack Surface - the availability of the weaknessBase - the risk of weakness, degree of accuracy, and effectiveness of controlsEnvironmental - the parts of the weakness that are environmentally specific scoring for CWSS ranges between zero and 100.CVSS uses similar metrics when calculating scores but works on a range of zero to ten using the following criteria:Base - the characteristics of the security flawTemporal - a metric that changes with time due to external factorsEnvironmental - a metric that measures the impact of the vulnerability in your organizationWhile remediation teams can use both systems, their scores are not compatible. Even if the scores were normalized, their numbers would reflect differently across each system.How HackerOne Can HelpHackerOne brings specialized skills and domain expertise to help security teams scale testing across attack surfaces. With the perspective of skilled experts, varied approaches, experience, and knowledge, ethical hackers submit vulnerabilities that traditional scanning tools miss. HackerOne’s vulnerability taxonomy includes a more complete weakness database based on the industry-standard CWE. Customers can rely on HackerOne data to deliver otherwise unavailable vulnerability intelligence and use that data to improve security strategies. Vulnerability reports are labeled with a weakness, either by the hacker at report submission or later by our Triage team. This allows organizations to first address the most critical vulnerabilities, mitigating cyber risk and providing greater protection for their attack surfaces. Contact us to learn more.Share Related Content What Is The Common Vulnerability Scoring System (CVSS) HackerOne Submitted by HackerOne on Fri, 12/03/2021 - 09:57 Vulnerability Management Vulnerability Assessment Tools [Top Tools & What They Do] HackerOne Submitted by HackerOne on Mon, 08/30/2021 - 07:21 Vulnerability Management Vulnerability Assessment I A Complete Guide HackerOne Submitted by HackerOne on Fri, 07/30/2021 - 06:15 Vulnerability Management Footer menu Platform HackerOne Challenge HackerOne Response HackerOne Assets HackerOne Code Security Audit HackerOne Insights HackerOne Services Solutions Application Security Attack Resistance Management Cloud Security Continuous Security Testing High-Growth Companies Vulnerability Management Industries Financial Services Government US Federal Partners Partner Overview Tech Integrations AWS Hackers Hacker101 Hacktivity Opportunities Leaderboard Company About Us Leadership Careers Press Customer Stories Contact Us Resources Resource Center Events Documentation Blog Blog Hacker Community Blog Company News Marketo Form Copyright Policies Terms Privacy Security Trust ©2024 HackerOne All rights reserv2023 CWE Top 25 Most Dangerous Software Weaknesses | CISA
2023 CWE Top 25 Most Dangerous Software Weaknesses | CISA
Skip to main content
An official website of the United States government
Here’s how you know
Here’s how you know
Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (LockA locked padlock) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Cybersecurity & Infrastructure Security Agency
America's Cyber Defense Agency
Search
Menu
Close
Topics
Topics
Cybersecurity Best Practices
Cyber Threats and Advisories
Critical Infrastructure Security and Resilience
Election Security
Emergency Communications
Industrial Control Systems
Information and Communications Technology Supply Chain Security
Partnerships and Collaboration
Physical Security
Risk Management
How can we help?
GovernmentEducational InstitutionsIndustryState, Local, Tribal, and TerritorialIndividuals and FamiliesSmall and Medium BusinessesFind Help LocallyFaith-Based CommunityExecutives
Spotlight
Resources & Tools
Resources & Tools
All Resources & Tools
Services
Programs
Resources
Training
Groups
News & Events
News & Events
News
Events
Cybersecurity Alerts & Advisories
Directives
Request a CISA Speaker
Congressional Testimony
CISA Conferences
CISA Live!
Careers
Careers
Benefits & Perks
HireVue Applicant Reasonable Accommodations Process
Hiring
Resume & Application Tips
Students & Recent Graduates
Veteran and Military Spouses
Work @ CISA
About
About
Culture
Divisions & Offices
Regions
Leadership
Doing Business with CISA
Site Links
Reporting Employee and Contractor Misconduct
CISA GitHub
2022 Year In Review
2023 Year In Review
Contact Us
Report a Cyber Issue
America's Cyber Defense Agency
Breadcrumb
Home
News & Events
Cybersecurity Advisories
Alert
Share:
Alert
2023 CWE Top 25 Most Dangerous Software Weaknesses
Release DateJune 29, 2023
The Homeland Security Systems Engineering and Development Institute, sponsored by the Department of Homeland Security and operated by MITRE, has released the 2023 Common Weakness Enumeration (CWE) Top 25 Most Dangerous Software Weaknesses. The CWE Top 25 is calculated by analyzing public vulnerability data in the National Vulnerability Data (NVD) for root cause mappings to CWE weaknesses for the previous two calendar years. These weaknesses lead to serious vulnerabilities in software. An attacker can often exploit these vulnerabilities to take control of an affected system, steal data, or prevent applications from working.
The 2023 CWE Top 25 also incorporates updated weakness data for recent CVE records in the dataset that are part of CISA’s Known Exploited Vulnerabilities Catalog (KEV).
CISA encourages developers and product security response teams to review the CWE Top 25 and evaluate recommended mitigations to determine those most suitable to adopt. Over the coming weeks, the CWE program will be publishing a series of further articles on the CWE Top 25 methodology, vulnerability mapping trends, and other useful information that help illustrate how vulnerability management plays an important role in Shifting the Balance of Cybersecurity Risk.
This product is provided subject to this Notification and this Privacy & Use policy.
Please share your thoughts
We recently updated our anonymous product survey; we’d welcome your feedback.
Related Advisories
Mar 12, 2024
Alert
Fortinet Releases Security Updates for Multiple Products
Mar 12, 2024
Alert
CISA Publishes SCuBA Hybrid Identity Solutions Guidance
Mar 12, 2024
Alert
Microsoft Releases Security Updates for Multiple Products
Mar 12, 2024
Alert
CISA Releases One Industrial Control Systems Advisory
Return to top
Topics
Spotlight
Resources & Tools
News & Events
Careers
About
Cybersecurity & Infrastructure Security Agency
YouTube
CISA Central
888-282-0870
central@cisa.dhs.gov
DHS Seal
CISA.gov
An official website of the U.S. Department of Homeland Security
About CISA
Accessibility
Budget and Performance
DHS.gov
FOIA Requests
No FEAR Act
Office of Inspector General
Privacy Policy
Subscribe
The White House
USA.gov
Website Feedback
What Is CWE? Overview + CWE Top 25 | Perforce
What Is CWE? Overview + CWE Top 25 | Perforce
Skip to main content
Secondary navigationDownloadsIntegrationsBlogCompanyAbout UsTeamCultureCareersPartnersPressEventsSecurity & ComplianceContactContact UsRequest SupportSubscribe
PerforceMain Navigation - Mega MenuProductsMain Navigation - Mega MenuExplore ProductsAll ProductsDev Productivity & CollaborationApplication Testing & QualityAgile Management & PlanningApplication & Open Source ManagementHelix Core
Version Control
Helix TeamHub
Code Hosting for Git, SVN, Hg
Helix IPLM
IP Lifecycle Management
Gliffy
Diagramming
JRebel
Java Application Development
Helix DAM
Digital Asset Management
Dev Productivity & CollaborationApplication Testing & QualityAgile Management & PlanningApplication & Open Source ManagementHelix Core
Version Control
Helix TeamHub
Code Hosting for Git, SVN, Hg
Helix IPLM
IP Lifecycle Management
Gliffy
Diagramming
JRebel
Java Application Development
Helix DAM
Digital Asset Management
SolutionsMain Navigation - Mega MenuExplore SolutionsSolutions OverviewMain Navigation - Mega MenuBy NeedBy IndustryMain Navigation - Mega MenuApplication Lifecycle ManagementAgile Project ManagementDiagrammingDevOpsVersion ControlIP Lifecycle ManagementJava Application DevelopmentWeb & Mobile App TestingCodeless Selenium AutomationStatic Analysis & SASTAudit & ComplianceAPI ManagementOpen Source SupportEnterprise PHPHPC DebuggingConfiguration ManagementIT Infrastructure & AutomationDevelopment Tools & LibrariesMain Navigation - Mega MenuAerospace & DefenseAutomotiveEmbedded SystemsSemiconductorEnergyFinancialGame DevelopmentVirtual ProductionGovernmentMedical DevicesSoftwareDigital TwinsMain Navigation - Mega MenuMain Navigation - Mega MenuMain Navigation - Mega MenuMain Navigation - Mega MenuCustomersResourcesMain Navigation - Mega MenuExplore ResourcesPapers & VideosRecorded WebinarsEvents & WebinarsBlogFree TrialsSubscribe2023 Game Development ReportRead NowSupportServicesMain Navigation - Mega MenuConsulting/Professional ServicesTrainingMain Navigation - Mega MenuConsulting Services OverviewAkanaBlazeMeterHelix ALMHelix CoreHelix QACKlocworkMethodics IPLMOpenLogicPerfectoZendMain Navigation - Mega MenuTraining OverviewHansoftHelix ALMHelix CoreHelix QACKlocworkOpenLogicPerfectoZendTry FreeDownloadsIntegrationsBlogCompanyMain Navigation - Mega MenuAbout UsCareersCultureEventsPartnersPressTeamContactBreadcrumbHomeResourcesBlog
What Is CWE? Overview + CWE Top 25
September 28, 2020
What Is CWE? Overview + CWE Top 25Security & ComplianceStatic AnalysisBy
Stuart Foster CWE and CWE Top 25 secure coding practices help you safeguard your code against rising software security risks. Here we explain what is CWE and the CWE Top 25.Read along or jump ahead to the section that interests you the most:Table of ContentsWhat Is CWE?What Is CWE Top 25?How to Ensure CWE Security with Static Analysis?Use Klocwork to Ensure Software SecurityTable of Contents1 - What Is CWE?2 - What Is CWE Top 25?3 - How to Ensure CWE Security with Static Analysis?4 - Use Klocwork to Ensure Software Security➡️ Ensure CWE Security with KlocworkBack to topWhat Is CWE?Common Weakness Enumeration (CWE) list identifies software security weaknesses in software and hardware. This includes C, C++, and Java. The list is compiled by feedback from the CWE Community.Sponsored by the MITRE Corporation, the community is made up of representatives from major operating systems vendors, commercial information security tool vendors, academia, government agencies, and research institutions.The full list is regularly updated every few months with the latest version released in August 2020. The security weakness list includes over 600 categories, which include:Buffer overflowCross-site scriptingInsecure random numbers Related Resource: Learn about the top embedded security vulnerabilities. Back to topWhat Is CWE Top 25?Published by MITRE, the CWE Top 25 is a compilation of the most widespread and critical weaknesses that could lead to severe software vulnerabilities. The most recent list was published in 2020 and listed vulnerabilities that allowed hackers to gain control over an affected system, steal sensitive data, and cause a denial-of-service condition.CWE Top 25Here is the list of the 2020 CWE Top 25 software weaknesses:Improper Neutralization of Input During Web Page Generation (“Cross-site Scripting”)Out-of-bounds WriteImproper Input ValidationOut-of-bounds ReadImproper Restriction of Operations within the Bounds of a Memory BufferImproper Neutralization of Special Elements used in an SQL Command (“SQL Injection”)Exposure of Sensitive Information to an Unauthorized ActorUse After FreeCross-Site Request Forgery (CSRF)Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection)Integer Overflow or WraparoundImproper Limitation of a Pathname to a Restricted Directory (“Path Traversal”)NULL Pointer DereferenceImproper AuthenticationUnrestricted Upload of File with Dangerous TypeIncorrect Permission Assignment for Critical ResourceImproper Control of Generation of Code (“Code Injection”)Insufficiently Protected CredentialsImproper Restriction of XML External Entity ReferenceUse of Hard-coded CredentialsDeserialization of Untrusted DataImproper Privilege ManagementUncontrolled Resource ConsumptionMissing Authentication for Critical FunctionMissing AuthorizationBack to topHow to Ensure CWE Security with Static Analysis?The best way to ensure that your code is secure is to use a SAST tool, like Klocwork.SAST tools identify and eliminate security vulnerabilities and software defects early on in development. This helps to ensure that your software is secure, reliable, and compliant.Klocwork helps you:Identify and analyze security risks and prioritizes severity.Fulfill compliance standard requirements.Apply and enforce coding standards.Verify and validate through testing.Achieve compliance and get certified faster. Related Resource: Review the SAST tutorial for additional software security resources. Back to topUse Klocwork to Ensure Software SecuritySee for yourself how Klocwork can help you enforce software security standards, register for a free trial.➡️ register for Klocwork free trialBack to topStuart Foster Klocwork and Helix QAC Product Manager, Perforce Stuart Foster has over 17 years of experience in mobile and software development. He has managed product development of consumer apps and enterprise software. Currently, he manages Klocwork and Helix QAC, Perforce’s market-leading code quality management solutions. He believes in developing products, features, and functionality that fit customer business needs and helps developers produce secure, reliable, and defect-free code. Stuart holds a bachelor’s degree in information technology, interactive multimedia and design from Carleton University, and an advanced diploma in multimedia design from the Algonquin College of Applied Arts and Technology.Footer menuProductsPlanHelix ALMHelix PlanCreate & DevelopHelix CoreHelix4GitHelix DAMHelix TeamHubHelix SwarmHelix IPLMVersICTest & ValidateHelix QACKlocworkOperate, Manage, & ScaleSourceProHostAccessHydraExpressPV-WAVEStingrayVisualizationSolutionsBy needApplication Lifecycle ManagementAgile Project ManagementDevOpsVersion ControlIP Lifecycle ManagementStatic AnalysisAudit & ComplianceConfiguration ManagementIT Infrastructure & AutomationBacklog ManagementProject Portfolio ManagementBy industryAerospace & DefenseAutomotiveEmbedded SystemsSemiconductorEnergy & UtilitiesFinanceGame DevelopmentVirtual ProductionGovernmentLife SciencesSoftwareServicesConsulting/Professional ServicesConsulting Services OverviewAkanaBlazeMeterHelix ALMHelix CoreHelix QACKlocworkHelix IPLMOpenLogicPerfectoZendTrainingTraining OverviewHelix PlanHelix ALMHelix CoreHelix QACKlocworkOpenLogicPerfectoZendResourcesPapers & VideosEvents & WebinarsRecorded WebinarsBlogPerforce USupportCustomersCase StudiesAboutOur TeamOur CultureCareersPressContact UsPartnersIntegrationsResellersQuick linksFree TrialsSubscription CenterCustomer Support LoginEducational LicensesHow to BuyPerforceCopyright © Perforce Software, Inc. All rights reserved. | Sitemap | Terms of Use | Privacy PolicySocial menuFacebookTwitterLinkedInYouTubeRSSSend Feedback
CWE - Frequently Asked Questions (FAQ)
CWE -
Frequently Asked Questions (FAQ)
Common Weakness Enumeration
A community-developed list of SW & HW weaknesses that can become vulnerabilities
Home > About CWE >
Frequently Asked Questions (FAQ)
ID Lookup:
Home
About ▼
About
New to CWE
User Stories
History
Documents
FAQs
Glossary
Compatibility
CWE List ▼
Latest Version
Downloads
Reports
Visualizations
Archive
Mapping ▼
CVE → CWE Mapping Guidance
CVE → CWE Mapping Quick Tips
CVE → CWE Mapping Examples
Common Terms Cheatsheet
Top-N Lists ▼
Top 25 Software
Top Hardware
Top 10 KEV Weaknesses
Community ▼
Community
Working Groups & Special Interest Groups
Board
Board Meeting Minutes
CWE Discussion List
CWE Discussion Archives
Contribute Weakness Content to CWE
News ▼
Current News
X-Twitter
Mastodon
YouTube
Podcast
Medium
News Archive
Search
CWE Glossary Definition
Frequently Asked Questions (FAQ)
FAQ answers are available for the topics below. Please contact us to provide feedback about this page.
Introduction
Community
CWE Top 25
CWE List Basics
Using the CWE List
Scoring CWEs (CWSS & CWRAF)
Introduction
What is CWE? What are software and hardware "weaknesses"?
What is the difference between a vulnerability and a weakness?
Why CWE? Is there a lot of support for something like this?
Can't hackers use this to break into my network, system, or product?
How can CWE help me?
Who owns CWE? Is CWE free for public use?
What is the relationship between CWE and CAPEC?
What is the relationship between CWE and CVE?
What is the relationship between CWE and NVD?
How is CWE related to other Software Assurance (SwA) efforts?
What is CWE? What are software and hardware "weaknesses"?
Targeted at both the development community and the community of security practitioners, Common Weakness Enumeration (CWE™) is a formal list or dictionary of common software and hardware weaknesses that can occur in architecture, design, code, or implementation that can lead to exploitable security vulnerabilities. CWE was created to serve as a common language for describing security weaknesses; serve as a standard measuring stick for security tools targeting these weaknesses; and to provide a common baseline standard for weakness identification, mitigation, and prevention efforts.
A “weakness” is a condition in a software, firmware, hardware, or service component that, under certain circumstances, could contribute to the introduction of vulnerabilities.
Weaknesses Examples:
Software — buffer overflows, format strings, etc.; structure and validity problems; common special element manipulations; channel and path errors; handler errors; user interface errors; pathname traversal and equivalence errors; authentication errors; resource management errors; insufficient verification of data; code evaluation and injection; and randomness and predictability.
Hardware — core and compute issues typically associated with CPUs, Graphics, Vision, AI, FPGA, and uControllers; privilege separation and access control issues related to identity and policy, shared resources, locking controls, registers, and other features and mechanisms; and power, clock, and reset concerns related to voltage, electrical current, temperature, clock control, and state saving/restoring.
See About CWE and the CWE List for additional information.
Back to top
What is the difference between a vulnerability and a weakness?
Weaknesses are errors that can lead to vulnerabilities. A software vulnerability, such as those enumerated on the Common Vulnerabilities and Exposures (CVE®) List, is a mistake in software that can be directly used by a hacker to gain access to a system or network. A hardware vulnerability is a mistake in hardware or its firmware that can be used by a hacker to gain remote or physical access to a system. See What is CWE? What are software and hardware "weaknesses"? for additional information.
Back to top
Why CWE? Is there a lot of support for something like this?
The main goal of the CWE initiative is to stop vulnerabilities at the source by educating software and hardware acquirers, architects, designers, and programmers on how to eliminate the most common mistakes before a product is delivered. CWE serves as a resource for programmers as they write code, for architects as they design new software, for hardware engineers as they create physical components, and supports educators in teaching security as part of curriculum for software and hardware engineering, computer science, and management information systems; CWE ultimately helps them prevent the kinds of security vulnerabilities that have plagued the software and hardware industries and put enterprises at risk. CWE continues to evolve as a collaborative community effort to populate a publicly available repository of software and hardware errors in code, design, architecture, and implementation for developers and security practitioners that can also be utilized by tool vendors for tagging what their tool’s report and claim to cover.
CWE is industry-endorsed by the CWE Community, which includes representatives from major operating systems vendors, commercial information security tool vendors, academia, government agencies, and research institutions. Community members participate in the development of CWE on the CWE Community Research email list. This means the CWE List, as well as its follow-on CWSS and CWRAF efforts, reflect the insights and combined expertise of the broadest possible collection of information technology and information security professionals.
Back to top
Can't hackers use this to break into my network, system, or product?
Any public discussion about weaknesses in software and hardware and/or potential resulting vulnerabilities may help an attacker. However, there are several reasons why the benefits of CWE outweigh its risks:
CWE allows developers to minimize weaknesses as early in the lifecycle as possible, improving its overall security.
CWE helps reduce risk industry-wide by enabling more effective community discussion about finding and mitigating these weaknesses in existing software and hardware, and reducing them in future updates and releases.
CWE enables more effective description, selection, and use of security tools and services that organizations can use to find these weaknesses and reduce their risk now.
There is a shift in community opinion towards sharing information, as reflected in the success of the collaborative nature of similar programs such as Common Vulnerabilities and Exposures (CVE®), Common Attack Pattern Enumeration and Classification (CAPEC™), the “CWE Top 25 Most Dangerous Software Errors List,” and the fact that the CWE Community includes key organizations in information security.
Back to top
How can CWE help me?
Software and hardware development organizations and security practitioners are using CWE today as a common language for discussing how to eliminate and/or mitigate software security weaknesses in software architecture, design, code, and implementation. Organizations are using CWE today as a standard measuring stick for evaluating software security tools targeting these weaknesses, and as a common baseline standard for their weakness identification, mitigation, and prevention efforts.
In addition, CWE and the community have worked together to leverage the CWE List and create additional tools to help enterprises and software vendors in their efforts to address software weaknesses:
CWE Top 25 Most Dangerous Software Errors List – provides enterprises and vendors with priorities for mitigation and prevention.
Common Weakness Scoring System (CWSS™)
– allows organizations to score the severity of software coding errors found in their software applications in order in mitigate weaknesses in applications they are currently using and to influence future purchases.
Common Weakness Risk Analysis Framework (CWRAF™)
– allows for organizations to apply CWSS to those CWEs that are most relevant to their own specific businesses, missions, and deployed technologies.
CWE Coverage Claims Representation (CCR) – allows for software analysis vendors to convey to their
customers in XML format exactly which CWE-identified weaknesses they claim to be able to locate in software.
Back to top
Who owns CWE? Is CWE free for public use?
The MITRE Corporation maintains CWE, its follow-on efforts, and this public website; manages the compatibility program; and provides impartial technical guidance to the CWE Community throughout the process to ensure CWE serves the public interest.
CWE is free to use by any organization or individual for any research, development, and/or commercial purposes, per the CWE Terms of Use. MITRE has copyrighted the CWE List, Top 25, CWSS, and CWRAF for the benefit of the community in order to ensure each remains a free and open standard, as well as to legally protect the ongoing use of it and any resulting content by government, vendors, and/or users. MITRE has trademarked ™ the CWE and related acronyms and the CWE and related logos to protect their sole and ongoing use by the CWE effort within the information security arena. Please contact us if you require further clarification on this issue.
Back to top
What is the relationship between CWE and CAPEC?
While CWE is a list of software and hardware weakness types, Common Attack Pattern Enumeration and Classification (CAPEC™) is a list of the most common methods attackers use to exploit these weaknesses. Used together, CWE and CAPEC provide understanding and guidance to software and hardware development personnel of all levels as to where and how their software and hardware are likely to be attacked, thereby equipping them with the information they need to help them build more secure software and hardware.
Back to top
What is the relationship between CWE and CVE?
MITRE began working on the issue of categorizing software weaknesses as early 1999 when it launched the Common Vulnerabilities and Exposures (CVE®) List. As part of building CVE, MITRE's CVE Team developed a preliminary classification and categorization of vulnerabilities, attacks, faults, and other concepts beginning in 2005 to help define common software weaknesses. However, while sufficient for CVE those groupings were too rough to be used to identify and categorize the functionality offered within the offerings of the code security assessment industry. The CWE List was created in 2006 to better address those additional needs.
Back to top
What is the relationship between CWE and NVD?
The U.S. National Vulnerability Database (NVD) is a federal government repository of standards-based vulnerability management data. This data enables automation of vulnerability management, security measurement, and compliance (e.g., FISMA). NVD integrates CWE into the scoring of Common Vulnerabilities and Exposures (CVE®) entries, upon which NVD is built, by providing a cross section of the overall CWE structure. NVD analysts score CVEs using CWEs from different levels of the hierarchical structure. This allows analysts to score CVEs at both a fine and coarse granularity, which is necessary due to the varying levels of specificity possessed by different CVEs.
Back to top
How is CWE related to other Software Assurance (SwA) efforts?
CWE, along with its follow-on CWE Top 25, CWSS, and CWRAF, are measurement and risk mitigation efforts focused on realizing software assurance (SwA).
The CWE initiative, which has matured over the years through collaborative efforts of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and the international CWE Community, provides the requisite characterization of exploitable software constructs to enable the education and training of developers on how to eliminate all-too-common errors before software and hardware products are delivered and put into operation.
In addition, CWE enables the interoperable automation of SwA ecosystem components and projects, such as the Object Management Group (OMG) SwA Task Force's OMG SwA Ecosystem.
Back to top
Community
CWE COMMUNITY
Who is the CWE Community? What is their role?
How can my organization and I be involved in this effort?
What is the role of the CWE Research Email Discussion List and how can I join?
Is someone from CWE available to speak or participate on panel discussions at industry-related events, meetings, etc.?
How can I submit content for the CWE List?
CWE COMPATIBILITY
What does it mean to be "CWE-Compatible"? What does it mean to be "CWE-Effective"?
How can my product or service be made CWE-Compatible and/or CWE-Effective? Are there specific requirements that must be met?
What is Coverage Claims Representation (CCR)?
How can my organization register our product or service as CWE-Compatible and/or CWE-Effective?
SPONSOR
Who pays for CWE? Who is the sponsor?
MITRE'S ROLE
What is MITRE's role in CWE?
CWE COMMUNITY
Who is the CWE Community? What is their role?
An integral component of the CWE effort is broad community participation. The CWE community includes:
A CWE Board comprised of members from around the world that sets and promotes the goals and objectives of the CWE Program to ensure the ongoing adoption, coverage, and quality of CWE
CWE special interest groups (SIGs) and working groups (WGs), each focused on specific areas of the program
Individual researchers and representatives from numerous organizations from across industry, academia, and government interested in actively reducing and managing weaknesses in software and hardware who:
Participate in content development and other conversations on the CWE Research Discussion List
Submit software and hardware weaknesses and related content for the CWE List
Engage with us and the community to help promote CWE on social media
Advocate for the expansion and active use of CWE and the CWE Top-N lists by the community
Back to top
How can my organization and I be involved in this effort?
See CWE Community.
Back to top
What is the role of the CWE Research Email Discussion List and how can I join?
The CWE Research Email Discussion
List is a lightly moderated public forum to discuss CWE definitions, suggest potential definition expansion(s), and/or submit new definitions. General discussion of the vulnerabilities themselves is also welcome.
Active participation is an important part of the CWE effort. Members of the information security community are all invited to participate. A confirmation will be sent to you verifying your addition to the list(s). View our Privacy Policy.
Back to top
Is someone from CWE available to speak or participate on panel discussions at industry-related events, meetings, etc.?
Yes, contact us to have the CWE Team present a briefing or participate in a panel discussion about CWE, the CWE Top 25, CWSS, and/or CWRAF efforts at your next event.
Back to top
How can I submit content for the CWE List?
See Content Submissions.
Back to top
CWE COMPATIBILITY
What does it mean to be "CWE-Compatible"? What does it mean to be "CWE-Effective"?
"CWE-Compatible" means that a product or service meets the first four (4) requirements listed below, while "CWE-Effective" means that a product or service meets all six (6) requirements.
CWE SEARCHABLE – users may search security elements using CWE Identifiers (CWE-IDs).
CWE OUTPUT – security elements presented to users includes, or allows users to obtain, associated CWE-IDs.
MAPPING ACCURACY – security elements accurately link to the appropriate CWE-IDs.
CWE DOCUMENTATION – capability's documentation describes CWE, CWE compatibility, and how CWE-related functionality in the capability is used.
CWE COVERAGE – for CWE-Compatibility and CWE-Effectiveness, the capability's documentation explicitly lists the CWE-IDs that the capability claims coverage and effectiveness locates.
CWE TEST RESULTS – for CWE-Effectiveness, test results from the capability showing the results of assessing the CWEs for a product are posted on the CWE website.
Visit the CWE-Compatible and CWE-Effective Products and Services section for the most current information regarding the types and availability of CWE-Compatible and CWE-Effective products and services.
Back to top
How can my product or service be made CWE-Compatible? Are there specific requirements that must be met?
See the CWE Compatibility and Effectiveness Program, Requirements and Recommendations for CWE Compatibility and CWE Effectiveness, and Coverage Claims Representation (CCR) for detailed information.
Back to top
What is Coverage Claims Representation (CCR)?
CCR is a means for analysis vendors to convey to their customers exactly which CWE-identified weaknesses they claim to be able to locate. CCR documents are written in Extensible Markup Language (XML) based upon the CCR schema.
Each CCR claim document contains the following information:
Name of the organization making the coverage claim.
Name of the product or service to which the coverage claim refers.
Date the coverage claim was made.
Where the tool or service claims to be able to find weaknesses, i.e., which programming languages and/or binary formats are being analyzed.
Lists the specific CWE Identifiers for which coverage is claimed and details of that coverage.
Note that organizations make these claims on the honor system and neither the CCR itself nor the CWE Compatibility Program verify or otherwise vet the CCR statements of coverage.
See Coverage Claims Representation (CCR) for an example and/or more information.
Back to top
Can my organization register our product or service as CWE-Compatible?
To begin the process, send an email to cwe@mitre.org requesting a Declaration Form along with your organization name, contact information, the type of product, and the name of the product or service.
See Make a Declaration for more information.
Back to top
SPONSOR
Who pays for CWE? Who is the sponsor?
CWE is sponsored by the office of the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA). This CWE website is sponsored and managed by MITRE to enable stakeholder collaboration.
Back to top
MITRE'S ROLE
What is MITRE’s role in CWE?
The MITRE Corporation (MITRE) maintains the CWE List and its follow-on efforts (i.e., CWE Top 25, CWSS, and CWRAF), moderates the CWE Research email list, and provides neutral guidance throughout the process to ensure that CWE serves the public interest.
Back to top
CWE Top 25 Most Dangerous Software Weaknesses List
What is the CWE Top 25 List?
What should I do to address these errors? How can the Top 25 help me?
Can't hackers use this to break into my network or system?
How is this different from the OWASP Top Ten?
How are the weaknesses prioritized on the Top 25 list?
Is the Top 25 list still updated each year?
What is the CWE Top 25 List?
The CWE Top 25 Most Dangerous Software Weaknesses List is a demonstrative list of the most common and impactful issues experienced over the previous two calendar years. These weaknesses are dangerous because they are often easy to find, exploit, and can allow adversaries to completely take over a system, steal data, or prevent an application from working. The CWE Top 25 is a valuable community resource that can help developers, testers, and users – as well as project managers, security researchers, and educators – provide insight into the most severe and current security weaknesses.
The current release of the CWE Top 25 uses real-world vulnerability data from the U.S. National Vulnerability Database (NVD), combining frequency and an average Common Vulnerability Scoring System (CVSS) score to determine a rank order. For details about this new approach, visit the CWE Top 25 page.
Back to top
What should I do to address these errors? How can the Top 25 help me?
The CWE Top 25 list is a tool for education and awareness that can help the community as a whole reduce the perpetuation of weaknesses in software code that could lead to dangerous vulnerabilities.
Software Developers – Use the Top 25 to help prevent the kinds of vulnerabilities that plague the software industry, by identifying and avoiding all-too-common mistakes that occur before software is even shipped.
Software Users – Use the Top 25 to help achieve a better awareness of your organization's current risk posture, and to ask your vendors for more secure software.
Software Security Researchers – Use the Top 25 to focus on a narrow but important subset of all known security weaknesses.
Software Managers and CIOs – Use the Top 25 list as a measuring stick of progress in your efforts to secure your organization's software and thus improve your security posture.
NOTE: The Common Weakness Scoring System (CWSS™) and
Common Weakness Risk Analysis Framework (CWRAF™) allow organizations to directly address their own specific needs.
Back to top
Can't attackers use this to break into my network or system?
Any public discussion about weaknesses in software code and/or potential resulting vulnerabilities may help a hacker. However, there are several reasons why the benefits of the CWE Top 25, as well as the follow-on
Common Weakness Scoring System (CWSS™) and
Common Weakness Risk Analysis Framework (CWRAF™) efforts, outweigh their risks:
The Top 25 allows developers to minimize weaknesses in their software as early in the lifecycle as possible, improving its overall security.
The Top 25 helps reduce risk industry-wide by enabling more effective community discussion about finding and mitigating these weaknesses in existing software, and reducing them in future releases.
The Top 25 enables more effective description, selection, and use of the software security tools and services that organizations can use to find these weaknesses and reduce their risk now.
There is a shift in community opinion towards sharing information, as reflected in the success of the collaborative nature of the CWE and Common Vulnerabilities and Exposures (CVE®) efforts.
Back to top
How is this different from the OWASP Top Ten?
The OWASP Top Ten covers more general concepts and is focused on Web applications. The CWE Top 25 covers a broader range of issues than what arises from the Web-centric view of the OWASP Top Ten, such as buffer overflows. Also, one goal of the Top 25 was to be at a level that is directly actionable to programmers, so it contains more detailed issues than the categories being used in the Top Ten. There is some overlap however, since web applications are so prevalent, and some issues in the Top Ten have general applications to all classes of software.
Back to top
How are the weaknesses prioritized on the list?
For the current release, the CWE Team pulled vulnerability data directly from the U.S. National Vulnerability Database (NVD) and developed a scoring formula to calculate a rank order of weaknesses that combines the frequency of a CWE with the projected severity of its exploitation. While this method introduces a bias through analyzing only reported vulnerabilities and could potentially exclude some software and a breadth of other data, the CWE Team believes it will result in a more repeatable and accurate Top 25 list each year.
For detailed information about this new approach, including methodology, rankings, scoring, and refined mappings, visit the CWE Top 25 page.
Back to top
Is the Top 25 still updated each year?
Yes, the CWE Top 25 will be updated annually using the methodology described on the CWE Top 25 page.
For information about previous releases, visit the CWE Top 25 Archive.
Back to top
CWE List Basics
What types of software and hardware weaknesses are included on the CWE List?
What is a CWE-ID? How is it used?
What information is included in a CWE weakness entry?
Is there a glossary or key available to help me understand CWE terminology?
What is included in the CWE List ZIP download file?
How can I use the CWE schema?
Why is there a printable version of the CWE List? What information is included in it?
Are Change Logs available for the different release versions of the CWE List?
How can I get a complete copy of the CWE List?
What types of software and weaknesses are included on the CWE List?
See What is CWE? What are software and hardware "weaknesses"? for examples, and the CWE List page for the most current list.
Back to top
What is a CWE-ID? How is it used?
CWE Identifiers, also known as CWE-IDs or CWEs, are organized into four main types: Category, Compound Element, View, and Weakness.
Category IDs – assigned to collections of weaknesses sharing a common attribute(s). For example, CWE-557: Concurrency Issues or CWE-355: User Interface Security Issues, where the shared attributes may be any number of things including, but not limited to, functional area (e.g., authentication, cryptography) and the relevant resource (e.g., credentials management, certificate issues).
Compound Element IDs – assigned to meaningful aggregations of several weaknesses, as in a composite or chain. For example, in a chain such as CWE-252: Unchecked Return Value that can result in CWE-476: NULL Pointer Dereference, or in a composite such as CWE-352 Cross-Site Request Forgery.
View IDs – assigned to predefined perspectives with which one might look at the weaknesses in CWE. For example, CWE-699: Software Development is geared towards architects, designers, coders, and testers whose goal is to eliminate mistakes from a software application, while CWE-1000: Research Concepts is oriented towards academic research, creating a new framework for classifying weaknesses.
Weakness IDs – assigned to the actual weaknesses themselves, such as CWE-311: Failure to Encrypt Sensitive Data or CWE-326: Weak Encryption. Within Weakness IDs, there are four sub-classifications: “Pillar”, which are the more abstract representations; “Class”, typically independent of any specific language or technology such as CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'); “Base”, which is a more specific type of weakness that is still mostly independent of a specific resource or technology such as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); and “Variant”, which is a weakness specific to a particular resource, technology, or context such as CWE-83: Improper Neutralization of Script in Attributes in a Web Page.
CWE is searchable by individual CWE-ID number on the CWE website homepage, and from the search field in the upper right corner of the CWE website masthead. In addition, links to specific CWE-IDs for the predefined Views, Graphs, Explicit Slices, Implicit Slices, Composites, and Named Chains perspectives are available on the CWE List page.
Back to top
What information is included in a CWE weakness entry?
Each CWE entry includes the following information:
CWE Identifier Number/Name of the weakness type
Description of the type
Alternate terms for the weakness
Description of the applicable platforms
Description of how the weakness may be introduced
Likelihood of exploit for the weakness
Description of the consequences of the exploit
Potential mitigations
Node relationship information
Source taxonomies
Code samples for the languages/architectures
CVE Identifier numbers (CVE IDs) of vulnerabilities for which that type of weakness exists
References
Refer to the Schema and Schema Documentation for more information.
Back to top
Is there a glossary or key available to help me understand CWE terminology?
Yes, see CWE Glossary for a list of basic terminology and
Schema Documentation for the schema elements key.
Back to top
What is included in the CWE List ZIP download file?
The ZIP download file in the Downloads section of the CWE List page contains the selected view in XML format.
Back to top
How can I use the CWE schema?
The CWE Schema is provided for validating the various XML downloads files of individual CWE entries provided on the CWE List page. See the
Schema Documentation for additional information.
Back to top
Why is there a printable version of the CWE List? What information is included in it?
The Printable Version of CWE was created for those wishing to view and use the CWE List in PDF or printed format. The printable version includes a complete list of all CWE entries from the most current release in numerical order along with a table of contents, an index, and the CWE-ID in the facing margins for easy searching through a printed copy. Many organizations use printed copies of CWE for design review meetings and training.
Back to top
Are Change Logs available for the different release versions of the CWE List?
Yes, see Reports.
Back to top
How can I get a complete copy of the CWE List?
CWE is provided in multiple formats on the CWE List and Downloads, and Archive pages.
Back to top
Using the CWE List
What do the numerals in parenthesis signify in the various views of the CWE List?
How can the four different Overviews of the CWE List help me?
What is the difference between an Explicit Slice and an Implicit Slice? How can the various slices under each category help me?
What are the Composites and how can they help me?
What are the Named Chains and how can they help me?
Is there a key to the small icons used on the definition and view pages?
What do the numerals in parenthesis signify in the various views of the CWE List?
The numbers in parenthesis are the CWE IDs for that category or weakness being listed. See What is a CWE-ID? How is it used? for additional information.
Back to top
How can the four different Overviews of the CWE List help me?
Development Concepts – This view organizes weaknesses around concepts that are frequently used or encountered in software development. Accordingly, this view can align closely with the perspectives of developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.
Research Concepts – This view is intended to facilitate research into weaknesses, including their inter-dependencies, and can be leveraged to systematically identify theoretical gaps within CWE. It classifies weaknesses in a way that largely ignores how they can be detected, where they appear in code, and when they are introduced in the software development life cycle. Instead, it is mainly organized according to abstractions of software behaviors.
Comprehensive CWE Dictionary – This view lists all elements on the CWE List in alphabetical order by weakness type. This view can be useful to any researcher, educator, software developer, or other organization interested in locating specific weakness types.
PDFs with Graphical Depictions of CWE – This view provides graphical representations of various CWE views as PDF files. It can be used to quickly see the structure implied by the parent relationships in those views. Also, some files provide "coverage graphs" in which the members of a smaller view are highlighted within the context of a larger view, illustrating how the entries of the smaller view are organized by the larger view.
Back to top
What is the difference between an Explicit Slice and an Implicit Slice? How can the various slices under each category help me?
An "Explicit Slice" is a view whose membership is determined by some external criterion that is represented using HasMember relationships between the view and those entries, but not between entries themselves. Examples are CWE 1026: Weaknesses in OWASP Top Ten (2017) and CWE 1128: CISQ Quality Measures (2016).
An "Implicit Slice" is a Slice that defines its membership based on common characteristics of entries, such as CWE-658: Weaknesses in Software Written in C.
Slices are one of the “View” mechanisms within CWE that are meant to help people focus on the portion of the CWE content for which they are looking.
Back to top
What are the Composites and how can they help me?
The Composite are those instances in which two or more distinct weaknesses must be present at the same time in order for a potential vulnerability to arise, and where removing any of the weaknesses eliminates or sharply reduces the risk. For example, CWE-61: UNIX Symbolic Link (Symlink) Following is only possible through a combination of several component weaknesses, including CWE-340: Predictability Problems, CWE-275: Permission Issues, and CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition').
By eliminating any single component, a developer can prevent the composite from becoming exploitable. Often the various components of a composite are found in different aspects of a software system, either in the architecture, design, code, or implementation, which means that multiple assessment methods may be needed to find them or that one type of assessment method – like a static analysis tool can find issues in code but not in design, architecture, or implementation.
Back to top
What are the Named Chains and how can they help me?
A "Chain" is a sequence of two or more separate weaknesses that can be closely linked together within software, where one weakness can directly create the conditions that are necessary to cause another weakness. The "Named Chains" are those chains that appear so frequently in software that a CWE-ID has been assigned to it, such as CWE-680: Integer Overflow to Buffer Overflow.
By understanding how one weakness can chain to another weakness and result in another type of weakness, assessment results that show the presence of one of the weaknesses in a chain can now be viewed in light of the possibility that the one weakness discovered could be indicating the presence of the entire chain.
Back to top
Is there a key to the small icons used in the Type column in the Relationship section of the definition pages?
A key to the image icons is included below:
View – A subset of CWE entries that provides a way of examining CWE content. The two main View Structures are Slices (flat lists) and Graphs (containing relationships between entries).
Category – A CWE entry that contains a set of other entries that share a common characteristic.
Pillar Weakness – Highest-level weakness that cannot be made any more abstract.
Class Weakness – A weakness that is described in a very abstract fashion, typically independent of any specific language or technology. It is more general than a Base weakness.
Base Weakness – A weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. It is more general than a Variant weakness, but more specific than a Class weakness.
Weakness Variant - A weakness that is described at a very low level of detail, typically limited to a specific language or technology. It is more specific than a Base weakness.
Compound Element Composite – An entry that consists of two or more distinct weaknesses, in which all weaknesses must be present at the same time in order for a potential vulnerability to arise. Removing any of the weaknesses eliminates or sharply reduces the risk.
Refer to the CWE Glossary and Schema Documentation for additional definitions of CWE terminology.
Back to top
Scoring CWEs (CWSS & CWRAF)
COMMON WEAKNESS SCORING SYSTEM (CWSS)
What is CWSS? How is it related to CWE?
How does CWSS work?
How does CWSS help me protect my network or system?
How can I customize CWSS for my organization?
Is CWSS free for public use?
Is there a CWSS calculator, such as the calculators for the Common Vulnerability Scoring System (CVSS)?
COMMON WEAKNESS RISK ANALYSIS FRAMEWORK (CWRAF)
What is CWRAF? How is it related to CWE and CWSS?
What's a "business domain"?
What's an "archetype"?
What's a "vignette"?
How does CWRAF help me protect my network or system?
How can I customize CWRAF for my organization?
Is CWRAF free for public use?
COMMON WEAKNESS SCORING SYSTEM (CWSS)
What is CWSS? How is it related to CWE?
The Common Weakness Scoring System (CWSS™) allows organizations to score the severity of software coding errors – that is, CWEs – found in their software applications in order in mitigate weaknesses in applications they are currently using and to influence future purchases. When used in conjunction with the Common Weakness Risk Analysis Framework (CWRAF™), organizations are able to apply CWSS to those CWEs that are most relevant to their own specific businesses, missions, and deployed technologies.
For additional information, visit the CWE-CWSS-CWRAF Framework Overview.
Back to top
How does CWSS work?
CWSS scores CWEs using 18 different factors across three metric groups: (1) the Base Finding group, which captures the inherent risk of the weakness, confidence in the accuracy of the finding, and strength of controls; (2) the Attack Surface group, which captures the barriers that an attacker must cross in order to exploit the weakness; and (3) the Environmental group, which includes factors that may be specific to a particular operational context, such as business impact, likelihood of exploit, and existence of external controls.
For a detailed description of how CWSS works visit the CWSS page.
Back to top
How does CWSS help me protect my network or system?
By knowing the severity of weaknesses software developers and organizations that use that software will know which CWEs should have priority in being addressed. In addition, educators teaching software code writing will know which weaknesses should be addressed directly in their curriculum.
Back to top
How can I customize CWSS for my organization?
See the Common Weakness Risk Analysis Framework (CWRAF™).
Back to top
Is CWSS free for public use?
CWSS is free to use by any organization or individual for any research, development, and/or commercial purposes, per the CWE Terms of Use. MITRE has copyrighted the CWE List, CWSS, CWRAF, and Top 25 for the benefit of the community in order to ensure each remains a free and open standard, as well as to legally protect the ongoing use of it and any resulting content by government, vendors, and/or users. Please contact us if you require further clarification on this issue.
Back to top
Is there a CWSS calculator, such as the calculators for the Common Vulnerability Scoring System (CVSS)?
No, at this time there is no calculator available for CWSS.
Back to top
COMMON WEAKNESS RISK ANALYSIS FRAMEWORK (CWRAF)
What is CWRAF? How is it related to CWE and CWSS?
Common Weakness Risk Analysis Framework (CWRAF™) allows for organizations to apply
Common Weakness Scoring System (CWSS™) to those CWEs that are most relevant to their own specific businesses, missions, and deployed technologies. With CWRAF, any organization can apply CWSS to score the severity of CWEs found in the software applications they are currently using in order to mitigate or remediate those weaknesses as soon as possible, and/or to influence future purchases.
CWRAF uses the CWSS scoring criteria with CWE to provide consistent measures for prioritizing risk exposures and for focusing on mitigation efforts and secure coding practices. CWRAF also enables better informed decision-making for the development and acquisition of more secure and resilient software products and services.
Back to top
What's a "business domain"?
In CWRAF, a Business Domains is a major function or service that includes the operations and interactions of a broad range of networked capabilities or organizations from the public and private sector, government and military, commercial and nonprofit organizations, academia, etc., that are enabled or controlled by software/IT and require some degree of resilience and security in transactions or operations. Examples of business domains for CWRAF include Finance, e-Commerce, Public Health, Emergency Services, Telecommunications, etc.
For additional information see the CWRAF page and CWRAF Domains, Technology Groups, Archetypes, and Vignette.
Back to top
What's an "archetype"?
In CWRAF, an Archetype is general type of technical capability, component, system, system-of-systems, or architecture that is commonly used to support the mission of a particular organization. An archetype may also be used within multiple business domains. An archetype could be a Web application, Web server, database, smartphone, Supervisory Control and Data Acquisition (SCADA) system, etc. For example, many industries manage their information using database-connected Web servers and SCADA systems are used in electrical power grids, manufacturing, oil and gas transmission, and other domains.
For additional information see the CWRAF page and CWRAF Domains, Technology Groups, Archetypes, and Vignette.
Back to top
What's a "vignette"?
In CWRAF, a Vignette is a shareable, semi-formal description of a particular environment within a business domain, the role that software plays within that environment, and an organization's priorities with respect to software security. The vignette identifies essential resources and capabilities, as well as their importance relative to security principles such as confidentiality, integrity, and availability. For example, in an e-commerce context, 99.999% uptime may be a strong business requirement that drives the interpretation of the severity of discovered weaknesses.
Vignettes allow CWRAF to support diverse audiences that may have different requirements for how to prioritize weaknesses. Those audiences can also use CWRAF to score within the context of the vignette that's most applicable to them.
For additional information see the CWRAF page and CWRAF Domains, Technology Groups, Archetypes, and Vignette.
Back to top
How does CWRAF help me protect my network or system?
By knowing the severity of those CWEs that directly affect your organization because of the software you are currently using, you will have a much more complete understanding of your organization's security risk posture than ever before. You will know which CWEs should be addressed immediately, either internally or with your vendors. You will also have actionable data with which to influence your vendors to improve future versions of their products and services, and to help your organization acquire more secure alternate software in the future if need be.
Back to top
How can I customize CWRAF for my organization?
CWRAF enables more targeted prioritization of "Top-N" CWE lists, with respective mitigation practices, that are relevant to specified technologies used by organizations within specific business domains. With CWRAF, enterprises from any business domain can use the CWSS scoring criteria with CWE to identify exploitable software fault patterns and associated mitigation practices that are most relevant to them in specific technologies including Web applications, control systems, embedded systems, end-point computing devices, identity management systems, operating systems, databases, storage systems, enterprise system applications, and cloud computing services.
CWRAF uses vignettes with archetypes to identify applicable CWEs in respective technologies used by specific business domains. CWSS scoring criteria applies business value context to specify the top CWEs most applicable to the respective situation.
For a detailed description of how CWRAF works visit the CWRAF page or contact us.
Back to top
Is CWRAF free for public use?
CWRAF is free to use by any organization or individual for any research, development, and/or commercial purposes, per the CWE Terms of Use. MITRE has copyrighted the CWE List, CWSS, CWRAF, and Top 25 for the benefit of the community in order to ensure each remains a free and open standard, as well as to legally protect the ongoing use of it and any resulting content by government, vendors, and/or users. Please contact us if you require further clarification on this issue.
Back to top
More information is available — Please edit the custom filter or select a different filter.
Page Last Updated:
April 05, 2023
Site Map |
Terms of Use |
Manage Cookies |
Cookie Notice |
Privacy Policy |
Contact Us |
Use of the Common Weakness Enumeration (CWE™) and the associated references from this website are subject to the Terms of Use. CWE is sponsored by the U.S. Department of Homeland Security (DHS) Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI) which is operated by The MITRE Corporation (MITRE). Copyright © 2006–2024, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation.
-1.4 %����19 0 obj <> endobj
xref
19 280
0000000016 00000 n
0000006646 00000 n
0000006745 00000 n
0000007810 00000 n
0000007990 00000 n
0000008103 00000 n
0000009779 00000 n
0000010209 00000 n
0000010386 00000 n
0000010858 00000 n
0000011390 00000 n
0000011810 00000 n
0000012390 00000 n
0000012784 00000 n
0000012954 00000 n
0000013410 00000 n
0000013781 00000 n
0000013871 00000 n
0000014051 00000 n
0000014241 00000 n
0000014420 00000 n
0000014531 00000 n
0000014965 00000 n
0000015329 00000 n
0000015596 00000 n
0000015905 00000 n
0000016246 00000 n
0000016657 00000 n
0000018908 00000 n
0000019451 00000 n
0000020062 00000 n
0000020145 00000 n
0000020641 00000 n
0000022309 00000 n
0000023419 00000 n
0000024930 00000 n
0000025339 00000 n
0000026248 00000 n
0000026690 00000 n
0000026715 00000 n
0000027038 00000 n
0000027165 00000 n
0000027589 00000 n
0000028636 00000 n
0000030522 00000 n
0000036016 00000 n
0000036269 00000 n
0000037811 00000 n
0000039900 00000 n
0000039985 00000 n
0000040054 00000 n
0000043186 00000 n
0000047335 00000 n
0000047521 00000 n
0000049488 00000 n
0000049613 00000 n
0000049736 00000 n
0000049852 00000 n
0000049975 00000 n
0000050090 00000 n
0000050203 00000 n
0000050326 00000 n
0000050449 00000 n
0000050562 00000 n
0000051033 00000 n
0000051314 00000 n
0000051400 00000 n
0000054030 00000 n
0000054402 00000 n
0000054903 00000 n
0000056524 00000 n
0000056839 00000 n
0000057225 00000 n
0000059906 00000 n
0000060276 00000 n
0000061480 00000 n
0000061517 00000 n
0000079125 00000 n
0000079162 00000 n
0000079239 00000 n
0000079362 00000 n
0000079439 00000 n
0000080305 00000 n
0000080356 00000 n
0000431592 00000 n
0000431998 00000 n
0000432351 00000 n
0000432429 00000 n
0000432487 00000 n
0000432536 00000 n
0000432571 00000 n
0000432649 00000 n
0000432762 00000 n
0000433886 00000 n
0000434209 00000 n
0000434275 00000 n
0000434391 00000 n
0000435515 00000 n
0000435890 00000 n
0000436245 00000 n
0000436323 00000 n
0000436358 00000 n
0000436436 00000 n
0000437194 00000 n
0000437524 00000 n
0000437590 00000 n
0000437706 00000 n
0000438464 00000 n
0000438754 00000 n
0000439141 00000 n
0000439219 00000 n
0000439364 00000 n
0000439490 00000 n
0000439606 00000 n
0000439803 00000 n
0000440207 00000 n
0000440285 00000 n
0000440475 00000 n
0000440880 00000 n
0000440958 00000 n
0000441095 00000 n
0000441217 00000 n
0000441333 00000 n
0000441532 00000 n
0000441938 00000 n
0000442016 00000 n
0000442115 00000 n
0000442219 00000 n
0000442319 00000 n
0000442455 00000 n
0000442650 00000 n
0000443054 00000 n
0000443132 00000 n
0000443237 00000 n
0000443334 00000 n
0000443533 00000 n
0000443933 00000 n
0000444011 00000 n
0000444209 00000 n
0000444610 00000 n
0000444688 00000 n
0000444793 00000 n
0000444899 00000 n
0000445003 00000 n
0000445162 00000 n
0000445360 00000 n
0000445763 00000 n
0000445841 00000 n
0000445942 00000 n
0000446043 00000 n
0000446160 00000 n
0000446359 00000 n
0000446766 00000 n
0000446844 00000 n
0000446943 00000 n
0000447049 00000 n
0000447155 00000 n
0000447259 00000 n
0000447363 00000 n
0000447542 00000 n
0000447737 00000 n
0000448142 00000 n
0000448220 00000 n
0000448255 00000 n
0000448333 00000 n
0000449437 00000 n
0000449769 00000 n
0000449835 00000 n
0000449951 00000 n
0000451055 00000 n
0000451431 00000 n
0000451795 00000 n
0000451873 00000 n
0000451976 00000 n
0000452093 00000 n
0000452292 00000 n
0000452697 00000 n
0000452775 00000 n
0000453407 00000 n
0000453485 00000 n
0000453591 00000 n
0000453699 00000 n
0000453804 00000 n
0000453962 00000 n
0000454153 00000 n
0000454559 00000 n
0000454637 00000 n
0000454776 00000 n
0000454899 00000 n
0000455015 00000 n
0000455215 00000 n
0000455625 00000 n
0000455703 00000 n
0000455842 00000 n
0000455965 00000 n
0000456081 00000 n
0000456280 00000 n
0000456676 00000 n
0000456754 00000 n
0000456952 00000 n
0000457374 00000 n
0000457452 00000 n
0000457651 00000 n
0000458061 00000 n
0000458139 00000 n
0000458337 00000 n
0000458747 00000 n
0000458825 00000 n
0000459536 00000 n
0000459614 00000 n
0000459649 00000 n
0000459727 00000 n
0000460657 00000 n
0000460987 00000 n
0000461053 00000 n
0000461169 00000 n
0000462099 00000 n
0000462423 00000 n
0000462806 00000 n
0000462884 00000 n
0000462919 00000 n
0000462997 00000 n
0000463926 00000 n
0000464257 00000 n
0000464323 00000 n
0000464439 00000 n
0000465368 00000 n
0000465702 00000 n
0000466086 00000 n
0000466164 00000 n
0000466199 00000 n
0000466277 00000 n
0000467210 00000 n
0000467541 00000 n
0000467607 00000 n
0000467723 00000 n
0000468656 00000 n
0000468996 00000 n
0000469380 00000 n
0000469458 00000 n
0000469493 00000 n
0000469571 00000 n
0000470770 00000 n
0000471101 00000 n
0000471167 00000 n
0000471283 00000 n
0000472482 00000 n
0000472863 00000 n
0000473229 00000 n
0000473307 00000 n
0000473342 00000 n
0000473420 00000 n
0000474395 00000 n
0000474726 00000 n
0000474792 00000 n
0000474908 00000 n
0000475883 00000 n
0000476224 00000 n
0000476611 00000 n
0000476689 00000 n
0000476724 00000 n
0000476802 00000 n
0000477775 00000 n
0000478105 00000 n
0000478171 00000 n
0000478287 00000 n
0000479260 00000 n
0000479575 00000 n
0000479959 00000 n
0000480037 00000 n
0000480072 00000 n
0000480150 00000 n
0000481112 00000 n
0000481442 00000 n
0000481508 00000 n
0000481624 00000 n
0000482586 00000 n
0000482906 00000 n
0000483289 00000 n
0000005896 00000 n
trailer
<]/Prev 499257>>
startxref
0
%%EOF
298 0 obj <>stream
hޔ��KqƟ�wf��]ܶ��n ��k��H�
_j�bi��*�������K$m����L !�I�
��t�N�^"(�&�ԑ)@8#���̜h���+BC��%\v%�v,��eD���"�wqí*�-P@�?K"�Fq�VS�k6VPIr��+a��j��$�@�8���W&ЯNA�Ō +z��"Ń��:��Nf�J �0?���[�R�A��hR�^�h��2N*с8zo��&Kd�ds��*\f�fr��5~ B��'��U<�J�N�λb/ф�e9UCFJ\ϗ�x��˩!�T|�"�:�7�a4�?�#�K��P�fQ�!���31/���ɀ�����J�q�|��D��2��rK�u�~�(>qV5���2�/�"_"��@�$3x�u�M�1��{�ZH��Ǜ�҈;�#������3>`�1�O�%���C\a�Kt�r�j���(࿑7'Ʒ�Jo�_#�v�_�7�����ۼ���;"˟&r����~"��o (n��
endstream endobj 20 0 obj <>>> endobj 21 0 obj <>/ExtGState<>/Font<>/ProcSet[/PDF/Text]/Properties<>/XObject<>>>/Rotate 0/TrimBox[0.0 0.0 612.0 792.0]/Type/Page>> endobj 22 0 obj [/Separation/PANTONE#202945#20CP/DeviceCMYK<>] endobj 23 0 obj <> endobj 24 0 obj <>stream
H��WɎE��W�tM�˕��dd���À�%��ODdu�6\,͈�MFזKdf����߹�ܻǟ������m?a������E���ӧ�n�6~�����Oۻ�����n_�����-������\���??l�mo�~�}��ͫ�����~x��/[>�<�t��Բ���ѹ����t��Y�;�kv�#I���(0��Gju��b��0C�T�n��f�#V�s�!ċU{��p����Lj��p{�NK�m���@{����Envc�!�b���p�P�~�h2&%_��}abr1�&�c1�5��D�D�>�C; �[8�d;��s{S�D�L>�
T@ku�img�4�� \
K���>r���[�=+*�� ���훨��d�>���p� u;!,B41N!1!�p�@��.{ly��'������s�}j=2.��M�]�E�T@%g�� y�
x2�*;�4�,�2~6��� �h�D��x���) � ����������?v���p���P��Ƣ!��%ܶ�(I�0Ei���OhR
w�7K*I�M�P��Ǡ2�s�3��7�<��ffK9Tߞ���木�5�b�,!�Y��9O�(3�QnW�b�@�s�7��VT�XI��XIּ�����@'�����F��c�4�@|7Q� S컑�G��@9@��~�8��+ZfE�qv� &�@C� ��۷`�f@�A�uڶ��8���Y�a����e�����{Pn�#��=(�ѲF3��Q����� �P�rsϽ�VuUO��]��ȦЌL(#,e�������Q����@�î�\RǪ*_Mm� .n��}չ�ȤB��&D?��f�Z��y�o(�6�P��@�y�kn8��(嵡oܣ�m�Ú����yߒ~�"��R��Q[F���Zg�+PZ�>+%��I7��N�훲d}�:������&�K%��a9� ��{���**t��އ��Rͯl�ƪt�T�"bVb2�B�,e-ݫ�ƫc8��~(�m���V,*Ӎ��n��|:@�hy�@k�sQk���F�:*��c�)��:��:�R���^�Ȭ�FԙY�_�ڽ����B�;kP����jח�M��%e[�+�Om�K�
�z�8�-��6#S�Ȯ�(�='��'�W^�,�7���UǙHڍ T��h����D臮 �!�ɖb:5����S4Y��P��H��Ƙ���!G�2փ�;�{����L�6��鴪,��C�9t�g+k��2t�����t�w�C���n�,��¤�����E顨.tp�-����P�Gt��gq��r��|�6�wI��&VR�u{���_?4߲%�==���2<�x�l�U���οw�yq�'.������X��ֳ_�j�����/��I�<� "cu}h� ,�����qff�5(0=[O(#�aP
���ԌJ����!v��S��Ҝ���eo��v�s��g� �2�Ry����XD~^�!D���� �B��r�`�����H�Q�;�,��j�������W�:d:=�T���I�R�y�B��6��7�Ƀ�7�� Xn�
endstream endobj 25 0 obj <> endobj 26 0 obj <> endobj 27 0 obj <> endobj 28 0 obj <> endobj 29 0 obj <> endobj 30 0 obj <>stream
H�\�ˎ�@E�|E/g#^�Uc !y�ɋ<'��� ŀ�x�O_.�H��9�n�S������&����gs�.��x�7'�$/L�z�|��fJҸ�����z�cRU&�o���0O�n<��$�:��b�~��&=ާ鏿�a6��k��s��/����z�.�^]��Ϗ���ߊ��ɛb��)ӎ��MM�C3\|Re�S��#~����e�v:����T�G\�e"���IUd�u> endobj 32 0 obj <> endobj 33 0 obj <> endobj 34 0 obj <>stream
H�bd`ab`dd�t�r�ЎJ,Hs��KOJ,)�+��a�!���[�W����+�x����,�}���ﻅ�Y6&�;�Te�g�(h$k*ZZ��Hs0i&-A����cJ~R�BpeqIjn��g^r~QA~QbIj���cN�BȘb����Ԣ2��g���e
0�)d+$*��g�(JMQ()JLI�M,�V�O�K,���K�Q�,HMKLNUp���c F�v&�<f��徯�����~z�3�����3K��_���|�3z���{�r��� ��i
endstream endobj 35 0 obj <> endobj 36 0 obj [/Separation/PANTONE#20538#20CP/DeviceCMYK<>] endobj 37 0 obj [/Separation/PANTONE#20Cool#20Gray#2010#20CP/DeviceCMYK<>] endobj 38 0 obj [/Separation/PANTONE#207599#20CP/DeviceCMYK<>] endobj 39 0 obj <> endobj 40 0 obj <>stream
H�\�ϊ�0��y�9��bkkBA�ֶ�a���>�5cWXc�����S���_�7�7�Dyq*\;B������ـC5�o�S�l[������ʫ���i�+\ӫ4���1L�8���K���u7X|������v�FXC��ņ
�T����9mUX:o�iE9���#��~#f����C�n��5���L����㽤]���
*�Y�^S > �����)�t����Vx˼�1'� q"��5�h�$F�k�����f��f����kj-����{��9Ι�ͽ���"L����p�&��ŏa?F��cďa?F��c�/�}�F�/�q�<z-�q}��;?�y�<�������e�~ ѱ6
endstream endobj 41 0 obj <> endobj 42 0 obj <> endobj 43 0 obj <>stream
H�\P͊� ��slE�eo"�v9���0:�
cy�mia��>���s�]����1��M��5�'�Yӂu&ߦz�YG�I�oKƹ�c`R�$p�i��ц���'��� vߧ~�_c��}J�ő�^u|�3��Cg wy;�����"B[����K���2)���b��?��F���q��P�_�mq�Oq��}�a͚嬻�K4��"���'� E_tk
endstream endobj 44 0 obj <> endobj 45 0 obj <>stream
H�\��n�0��y��C�� !���8���h0�Q��~v\u�"�!��8QUj��2z��9�,���� �\{+%����Yx��q"B�y�fjۍ�(d�����X��ͷ�{{�O_�y%����2�e)[�p��ƽ6�(��u��������\H� c�&�����(b�,N8J����6l�t��P$�c��nc@N�S⊹BNY��&��9Kc@foFތ5Y��w�9sN�g�s��re���H|b�,�
��k�T��2o��M�hΫ)oN��8!MN�U�T8�����a��7��=�%\���Do�q[��$��� �
�N
endstream endobj 46 0 obj <>stream
H��Wю�}�W��.HQ�Էf{�MP�b���%��]Y�u6_�3Cٖ�z��A�eR�p�̙3�<�V%b�F2�gq"�X���F����R�T+�h�g{d�[a"��Ha�Ʌ�db�(fK��L��{�%^��j���h�S%3c�'�(�֪�c�,�Q�Mg��&��:���I�����B�J�3L"m���Ԉb�i��4i����P2Q)��[�����X�VFx �8��� ���m�8܉{�#�;K@E
3��?��T�>K�2��1�p�4��\(1��(�E��}�W�g��t���*I�5����L*��$�i�
8%t,"ԉ��ed<�2�����D��/�I'c�;J ��
�A+��� +�°�4��U�Of S�g���`̌���ߔ�H��.��o�*3��+h��9K�2g�� {��q4�:e�j`h3�'6H�'"#`5��2��z���]�I�^����� O�:I.3K�;�l*��:�f��0�K�(
D�xP,xd�2,f����2F�@M��<咏��� g#>/��%sċoJQ���o3 �8�ߕ�$%M�b x�I�jJ(䀶ê�h�mJ�6�T�ev���ę5iY ���0B�R��� �N�� y���ɮCH��X�#�A��QL���"|��e+k�D�&�U��Fu�c�~i|3c5��/e�#�c�,~9���o�>�����0�8�ٽ�&�c1�����YV���f������Ƞ~�Խ�#��*o�� ���Β kl"QC$��Uho%�|(���5�H"���V��$��%ƙ�4E����Zb�r�1��$�>�ٳhf߮f߬Կ����D��B!�&B)�ά���������j��G�#���S$�6DW4lP��rg�z*�=�\]�f��^4&�e��wOJl;��G+c�T�b����O��?��BEs/\�e��Ts���5�p]7]Sx��\�//��&c����_��iAk\�fDž��m9}G[ބ;���wUS5�����k�O���(^��Ԉ����'�ۍ���ݺ�G��U�&N4��|� \S��VW�Uۈ����mpu8t�jD�hW�^l�W\@d>o�����ñzu=�8/tM��#��$�;���W
�-�`���G��c+������#<6�$�܉�;������c����K�Ϧ�ꋝ�oH߶u��t����UỐ�;��v�K���g�N��:���j\EFO`n�� ��pf\v1tM�?�]�.DE��w����(�p��a3$K�ˎ@|ϒ��ŶalE�n]�����_���`/Ŋ�ҋ��C���P��f1�=�Y�{��� ��E�ͧ]U�e�4`�2ƨ�{tf����Gxg��)�(>�k)��5��x_b�tw|��f�Ո=�캊g�R�_U�M ���%�_�VCIQ�c4���vah���v�v�,��9��t��[�AXhc�@_��&� Ĕ��k���Q���F7��S[���� �z���IT6�G��۲��}{�ۻ:��hʪ�G���� ��22I��8��{&*aED.A6��nAU����P���*�f��v1���{5��������� F�J�y��w�� �%ċ} ^]=�6�1�U��~�&K�/Ƣ��B��G��� f�/���3��y;��X�,�R�}8��|F8 P08b���v��?Ҩ��hk@��Ԋ�u����r(�������JБ��ժ@�¢�5����X3�jM'��9�\tm�"��6�*a�ڨo���S<�UhvӮ{&�=H�w�������/M�������s��[jv�I�>/�d����Ё�c,Z\l�r����H���5%�ߵ�����Qד����j8��z\�,����H���mXZ/���&ϋ,������'/�:�<�1P���c��Z��<|d:t�
�o(�*�j�2��L�����w��d�k��rb ��|���?�Sf��m�L*W������3|� �E�W%S�k%��+�����_J`�= j��*<;3�y* �3��3� 7�dz0���S4��]?؋��~���� 8�r�p)�����y���Z����ZV�n?gҰ�� ���O�C�ϣo~���x�Ө:e��7f��% &�-� 4k
endstream endobj 47 0 obj <> endobj 48 0 obj <>stream
H�\�݊�@��}������ӧ!��@.�����d���1y����,�`,����1��w���M�s�C�ͩ��)\���s�O�´]3?���R�I7��9\��iH�Ҥ����<��Ӧ��9ILm���l��l�&=���3\B?��T�i�)}����%�t���o��n���=�V�����}N�fh�u��0��9$e�ʔ��з�=��O�G=%e�g�j<�UR�r/Q+�B��W�k�e�+�+��z���A�Q�Em�o�os���.�-��j�v��ll�S{hrZpZrZp� �&ja� W�+��
r���\a� W�+��
r���\a� W؏�a?�~����#�G��KR:v�Е#��#��#��#��#��#��#���S��Tx*=�JO���S��xo�驋'{P���ay���+�Wv��Dى�e'�N��(:��;�N<;��ē߃ߓ߃ߓ߃ߓ߃ߓ߃ߓ߃ߓ߃ߓ߃ߓ߃��E��e�Ӄ�_�5��m���.��e^1�]��&�0��g�W� cD Y
endstream endobj 49 0 obj <> endobj 50 0 obj <> endobj 51 0 obj <>stream
H��W]o�6}������0$���6i�n(�6��"ӶZYr�� �~璒#�
g�0�D����A^����\��H�|9�4�IE$��ŏ(Ƒ��f�כM]ѵɾT�m�u�oL�u~�:���ן��N�-�?��*������%1L_��酹3e�5�(r�ɚ��tU/���1t}��{��T{[Ӟ�1�u�z>;;�R��$EH����C
�,AScf��+k��R9;�8z���bEQ"����x���ď=�fe:p�jZ����jA���Bh�d��
�f��s�Ҳn6YIe�vd�[�h��G �e�����A�i�[g��v����0�h���+���$�r�2�V}�2�"��yS��j/�������ɚEEY�����]�V�j Y�*��#���6����Q�%y���d-Vc>]��$w�|�lǧ�����\4�[�v�,f����w��w��L�u���,*U��W6|�ԈI������
��mޏ��`�j� �ǶA�T�,�����;���o����T��i�vwE�Z��K�����"����-�ܖ� z�珫����|�����CR�CC��mR�*���v�w)��X��m���"�QJQ� JR���7YƩq�`&�0���������7ޫ~�4 �w�a���uQqil�Cr2��c�|�Ca�<�� "��5�-G�;��,n���M{8k���qȣvk���GTm������Wc�P��ؔ���묪L�7��d�ex0K���r�����g����䦈��`VT�i�Yn��1L�#s�"�x�'a�!�U���k2lm��n���-0�3�D��ɱ5L_�8p����~��cs�"~4m�7p!j}�-�g �c�"���~i���9"&�<��������"�I�@r��ޑ�.���6ԇ'��l�#���\ ��v[�8�\/c_>����-z��{?����|q�ZQ"�L�1�}��w��)5ۺ�-���&Ö�ok�(룮�m[9�f��&�gn�E��X/�tiQ4�¸dnmW�ݖ�'��-�q��ȡ�,`�t|~��^W��V}��x���Ʒ}_�n�~������k�F,��w1� �7�um8�$� ڴ�`~��,�[/./����sE�.Ή�!��υ�v�1�87�W�HT@:TBF
+���՚�>�|���
�4)`sM����ۙ�{R��/�m��l$]Գ������E`3�X4 �@�l$d���1龒�D��HCaD��Zm��BM�)�j���K>;�h�e2>(�@�PǏ��U8B #ig�{�GqbgP�)8 �$�h\h�|��0.g��0�#����^�0��B�x! B�(P�#=����ߓ���4� ��"��HO�Ȁ�����$�"�Br�vI$�P�����>��]$�NLjA�Ӏ��T*���V9�c̶$��A�>
ǦD\K����&P�����=�}ÚJx�j/5|�,`�$Bjd�|����V�L��~1�>���8o���>�U5`��+{�_h.w�h�@|Pr9�E��N�0ԫq,G9�?��L�~�s�_ ��Z
endstream endobj 52 0 obj <>stream
H��K�)��y
.P�@<���,^� �{�v��H �Aev�=�pD-����/%@yr�� +���
�ȣ�ju7>��}Z�)��oӺ�b-�a�2�݉I���2�F?43h�?-(�����ay����S-㹂�L�(AJ,#�����-9�f���B��t;�0Ӈ}z%}>�ӑ����~HV6�/�_��}���T$yľ��>;K�=}�Iz>�<��yz|�~5ퟋ�C���?%���u=�4���qK~yM��W%� �_�v�B�Bĺ��1���j����mb�g�ę�Y��\����~�8��0?b���~�G| @����b�|��wɿ{�<:��~.qG�;�8����n�0�f��5�M㰂f�~�?�E�[N�R������� �g��������/���:ހv<��y��4彿J�z��¿ȁ\ ��4{��%�d-:�,)�$V��!�f'��嚡m@P��M5��j݂h��F7���:pL�fi
eB�`vQ�T�!d[��P��%Vݑ��M���۵��� X1̀������M�,o�͵u�M;��@��� s�S�K2a/%������'�P��$u@Z���Ho˄\ڱ2:X�!�"0g7<�l)�L���P�8��ppR��(����<����Gx~���)#)@\��)ܝF�����u��~���%�����ԪR
~_�˫1����u��X��:�djuÒ��Ye�d���RL��Hj�N�K�R�˅�"&=�^�����x�ڄ�T��H��M������r�c�UB���E��~���A�3f��[[2���"���,UݒP�X��d���RL7|]�ifp88+²��bC�n��w���Ӂ>���u�^I_&�4��=��g��r&�u��}���S��L����^.b�{x�v5��i�|�[��"�5�����O$�^6�Y��RڇӸ_���������y��w���Wl_H~J�+ՙ'���Ru�^���|t�d����n������7�>���}y���w�_ e��/
endstream endobj 53 0 obj <>stream
H��W;��6�y
\��o����`˖����v�� Ip�O~��`�����|������l)�gE��#d-��m�?�Z��b�F�S��u�#^WI�%Sl�f���T��V���m�x9�ˤ?H�5IƍXWc<���z'f�f<_��
��&�<Q�
,Z�h}���2�'����+��x�m� �=s68���YlJ�^�fQ?i{#*��}zt_��Ñ�ְ�>��aDB���,�>|T����_�y��dst�BE�jK�� ���emA�A����u�k��{�t�ґ���m��-�(ݗ�~��g���*6�ϡ�S(����>F"�l5!Bč�|�D�I��`�#�ކlD�G+�&z�h(�i��N����t�����953m��d똬@����Z"��*�
p�0�Թ�_A�@��
� YaZ?B� 4t�`m��1��j�J�"��薚E�3��F�~�8��C@xҀ����0 }5�+�CEN�SEC��-sf�`2Y�ĭ�, dJႄ���U)/�lJJ�D{���Ԃ���8d
D?�Ft���ZRx�Aqh!ttHޓW��>�kJDx����X������ii�YC�a4��`%�*�a������'��Ӌ�
���@"�k�+� D78[B+XJJ ]��%� �ͅ�M"j��R_C����I�--��T�b�3��L�Ƈ�"��(�Ņ�s��ShW�=���� s,)֙2wv����ys���h�1֤�ȕ8�F-P��{ߋ#��1 Y������E�P|5V�.�4G(�f������|�J�t ��6�M�L9�ª�(�Z�� �F�^ӣ��?�8�q(;� ��yt�a�yvf��Ո֟;@L���W�����ɓ��4y'�k�+ɟz �j��;��G���K`{dB6Ub����/���͠�I���zn�H\��ز ���L��&"XSi�R6��^�u��K��IՁX3(q�ҋYE�6e�)[&;�Ge�}ry��Aue[��j�|��h�iS5$�v�{��r��G�l6E�3Z2�AC�-�!ߗn�ݦ�m�o�� ��8���Ç�Bõ����!�2��)>��E�e�\N���-< P��qW6���M,;���CP^Ġ�x���@.�%ˉW��9
�=�����g
4��Z���o�``���Ӷ Z�쯗dk�5u��o5���]]D�e��:� ㄻ�Cl�І!ߗn�ݦ� �O��~��D�i ~9����hw�������h��'@(ѸdS�H�lk(���'�P6Ğ!�Q��!㋏�P�O��y6�ː,��nS��+ޒ�gN�7���=q"&�u�:
`">�̂4 �N��-L �>`v��q� �ʚ0�ۛԐhwmH�Mg��N� 5"��
endstream endobj 54 0 obj <> endobj 55 0 obj <>stream
H��WK��0���@J"�9F�#(
�]t��);r���P�h������fL�Α s )B�1`�*�0\N_N�N?C(.Q�b)=\~���>ϣc�����#d���t���5璠����V���N+�������ϫ!��)u���Q��Qd��&GSͯ����V¨�.ߤ�`��q��Wc7�,�"
��oWr�
D��ĺʁ%��3A��K��/��f�w�H��� 3p,�á��ҡ�:�zE�֕��Ak%�H����X��q:�ɂ�_�X��K�W]�o�"U����A=zPWx���<��zPW����e�kɿ�(T}ti�X_��P���B�\��4]�d��>9e}q���d��
UW������̡ce@f�W0DmjD���14\�q��6H��8�o3�e�/� ��f=6@ɪ%*C��"�&��YR��%�/����"pqE�۲}�I�VF���CZ�������kf0WaJI�M���a�9\ӐU��#�^r�Tg�*쀱m�3�4L��a��e]l8|��hLbJ�f$����a��1N�fjȒ)���>�?Kp&�,I���8S��G����4�L�gMHw։�� ��B�e��r)|;̃�p4=h�bzз�CW�\�vr�rU��z-�����i��(w��]���Y�����א��W��� ;0��!�k|j�k�%~���2B��:�pŴ@Wk��=� /(��?�B�?pгRF)䢗�t�e����A��ӳOtg�R�
;�t���7��ͣ�A;4YY^GO���H�*���p��#q<\�E� Nt��P��p(��<� a��6
endstream endobj 56 0 obj <> endobj 57 0 obj [71 0 R] endobj 58 0 obj <>stream
H�\��j�0��~
�Cq�5l�`)���e{ �V2Cc�9���إ� l�!}�>�=��D���#�ꀳ[�B�q4�K�F��_M�3N�n�#N��k����cXa��]�{�߃�`������8��P��q�F�ҿ� �'١Ք7q=���k�e�c^F9���
��#���P_(C��嫬��#�V]>QuQ�*�������t�T%��L��Niʭ�6��w3j �|��%�������y ��د �zz
endstream endobj 59 0 obj <> endobj 60 0 obj <> endobj 61 0 obj <>stream
H��W�n7��W��D�����D�)��hĻ)JlA�>��iz,�G�� s�j=�^m�g[r1\l���q�E���F�c����[�S�Z��:�Z��6������dy��mȨLFH,e�\G䁼�P]��B4U3�늘~o�Ԏ���`H5����V�������U�\�皬��Z��>�/���_�����w�E�E��^\��1!�e��xa�]J�p�F�!��}��q|���Xqy��Y�2uu�2��D6��G��"�5!v.{3n�b�F�<���nhqC��YqR���!�2�RPb��|�+�!qrP&^�
+
�-က�,g3���: �7�:��2cI��uG���k��s��]���B4��YZ�B{��)6�0y!u���PDlI{m�����8�N� 5��#%N��UN Hs�J��qb�� Y� Il�5�2 �_���\"/��t(a�xT٩'�I�'���:�*����%�$�IV1��uhF[���5-����q�t����.V����������E���]v����4��L�gg�G�ᠼ#NE|A�j�ʙ7�y���ǐ3�����1o>,�^#ο�Te�0>�7aa�d,���4`i�,o�ʀ��lc� æ��0n��0�[��0a�a��v�m�a��n�ᖑ���� Z�\���=Cm�����
���SGx�zԁGk5�����O/~ڽ�խ���a���r�o� ��%�Dy4zM��u6��v/��~�x������
��Y�h^u"�6!��`T2cdJ�6y4��t��_߉!S�54���f�~�qK�pJ��|����K�}A��á���1CM�z�]��:Z�R�N��ˮ�p]��3чl����"�Ơ���|;��.�3Ư��8�T�/�Wn���o:p<��O@��]���Tw�V՝��?��Ԅ�ɧ/�}�4�>�>.�n�` �m��
endstream endobj 62 0 obj <>stream
H��Wmo�6��_�O�<��D��0�v�.]�XM?�C��J�ű�I�����MKuQlkP�����Ȼ���7��䃣�����v��0&%�BWYI �,����2X�0���C���ِ��Ϫ)7U]����̀�nF�%�A �^t��$�re$QJ�L
��%���d]>QR��cĨH��[��y�����8!��ĥ������[��Ŷ���]`[a�����slo�m��? ��t�le]�QRG瞄�8��"*D{��oӫ�o]��"�ӷ�l`P�S�1�/��ǹ-yY��x6�
�".:5u�tg$�Kko��J�s��f)��K���c^���G��� #�+-\V4 �20HC�u���c�Z���d���|G�պ)��c$���udAM�p&te*�z�n��N��E��x���#x~}b���&_��y�zl�_���*�T����3�.���i_HR���_T������w ݹ�:���ۇ����h���fmh���e2Wt�Q��w��+j�z���$?n�/oV�b�NͿ�w"����%O�r5�Y߈8�~ȳ���Wc�oC
�L����>آ�7�P����0��&.�^\�\�7�x�u�� ������c�CƬX<����Cpj2��ZWeѼ��x�:�w��|���%ӻbq�*�����L����U\!�L�T��
T���9"秳���g�QI~�:�f@�q4��H��HFBW HQ�0�q��@�U�P����a��\�u=)]� ޗ�@`>'.�^���l�/�q��L��Ϟ���aGN�P��\`D�g��RdZr�'D��]:��y<���/n
�Q� ?vSk��`�w�a���¿cg��`'��� R��V�p��$9�4����?��V0,!v����'� ����{�5�(V���3Oi���6ˬ{ZUH�m������w^/_M��Y�p6>�s��x�}�Z5��J!�Д@V�6҂��x�7M�4���I>89���$��q�M�'�Mk��>JC3�Lkp��#c��t
_�S�g?��0� ��C��K����J���<�+�fS��U5_�J ��L��mU�τ�� #؈+�� �� �b�Q����