CWE forest structure
============================================================
CWE-284: Improper Access Control
├── CWE-749: Exposed Dangerous Method or Function
│   ├── CWE-782: Exposed IOCTL with Insufficient Access Control
│   ├── CWE-618: Exposed Unsafe ActiveX Method
├── CWE-1283: Mutable Attestation or Measurement Reporting Data
├── CWE-1224: Improper Restriction of Write-Once Bit Fields
├── CWE-1290: Incorrect Decoding of Security Identifiers 
├── CWE-1294: Insecure Security Identifier Mechanism
│   ├── CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
├── CWE-1259: Improper Restriction of Security Token Assignment
├── CWE-1292: Incorrect Conversion of Security Identifiers
├── CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges
├── CWE-1296: Incorrect Chaining or Granularity of Debug Components
├── CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions
├── CWE-1231: Improper Prevention of Lock Bit Modification
├── CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
├── CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection
├── CWE-1311: Improper Translation of Security Attributes by Fabric Bridge
├── CWE-1191: On-Chip Debug and Test Interface With Improper Access Control
├── CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
├── CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime
├── CWE-1220: Insufficient Granularity of Access Control
│   ├── CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks
├── CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point
├── CWE-1263: Improper Physical Access Control
│   ├── CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug
├── CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
├── CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
├── CWE-1317: Improper Access Control in Fabric Bridge
├── CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals
├── CWE-1323: Improper Management of Sensitive Trace Data
├── CWE-1267: Policy Uses Obsolete Encoding
├── CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy
├── CWE-1262: Improper Access Control for Register Interface
├── CWE-269: Improper Privilege Management
│   ├── CWE-271: Privilege Dropping / Lowering Errors
│   │   ├── CWE-272: Least Privilege Violation
│   ├── CWE-270: Privilege Context Switching Error
│   ├── CWE-266: Incorrect Privilege Assignment
│   │   ├── CWE-1022: Use of Web Link to Untrusted Target with window.opener Access
│   │   ├── CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods
│   │   ├── CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation
│   │   ├── CWE-520: .NET Misconfiguration: Use of Impersonation
│   ├── CWE-648: Incorrect Use of Privileged APIs
│   ├── CWE-250: Execution with Unnecessary Privileges
│   ├── CWE-268: Privilege Chaining
│   ├── CWE-267: Privilege Defined With Unsafe Actions
│   │   ├── CWE-623: Unsafe ActiveX Control Marked Safe For Scripting
├── CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents
├── CWE-282: Improper Ownership Management
│   ├── CWE-708: Incorrect Ownership Assignment
│   ├── CWE-283: Unverified Ownership
├── CWE-285: Improper Authorization
│   ├── CWE-863: Incorrect Authorization
│   │   ├── CWE-639: Authorization Bypass Through User-Controlled Key
│   │   │   ├── CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key
│   │   ├── CWE-804: Guessable CAPTCHA
│   │   ├── CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
│   │   ├── CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
│   │   ├── CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State
│   │   ├── CWE-942: Permissive Cross-domain Policy with Untrusted Domains
│   ├── CWE-926: Improper Export of Android Application Components
│   ├── CWE-862: Missing Authorization
│   │   ├── CWE-1314: Missing Write Protection for Parametric Data Values
│   │   ├── CWE-425: Direct Request ('Forced Browsing')
│   │   ├── CWE-939: Improper Authorization in Handler for Custom URL Scheme
│   ├── CWE-732: Incorrect Permission Assignment for Critical Resource
│   │   ├── CWE-281: Improper Preservation of Permissions
│   │   ├── CWE-766: Critical Data Element Declared Public
│   │   ├── CWE-279: Incorrect Execution-Assigned Permissions
│   │   ├── CWE-278: Insecure Preserved Inherited Permissions
│   │   ├── CWE-276: Incorrect Default Permissions
│   │   ├── CWE-277: Insecure Inherited Permissions
│   │   ├── CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag
│   ├── CWE-1328: Security Version Number Mutable to Older Versions
│   ├── CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors
│   ├── CWE-1256: Improper Restriction of Software Interfaces to Hardware Features
│   ├── CWE-1230: Exposure of Sensitive Information Through Metadata
│   │   ├── CWE-202: Exposure of Sensitive Information Through Data Queries
│   │   ├── CWE-612: Improper Authorization of Index Containing Sensitive Information
│   ├── CWE-927: Use of Implicit Intent for Sensitive Communication
├── CWE-1270: Generation of Incorrect Security Tokens
├── CWE-286: Incorrect User Management
│   ├── CWE-842: Placement of User into Incorrect Group
├── CWE-287: Improper Authentication
│   ├── CWE-645: Overly Restrictive Account Lockout Mechanism
│   ├── CWE-295: Improper Certificate Validation
│   │   ├── CWE-599: Missing Validation of OpenSSL Certificate
│   │   ├── CWE-296: Improper Following of a Certificate's Chain of Trust
│   │   ├── CWE-298: Improper Validation of Certificate Expiration
│   │   ├── CWE-299: Improper Check for Certificate Revocation
│   │   │   ├── CWE-370: Missing Check for Certificate Revocation after Initial Check
│   ├── CWE-306: Missing Authentication for Critical Function
│   │   ├── CWE-288: Authentication Bypass Using an Alternate Path or Channel
│   │   ├── CWE-322: Key Exchange without Entity Authentication
│   ├── CWE-1390: Weak Authentication
│   │   ├── CWE-294: Authentication Bypass by Capture-replay
│   │   ├── CWE-522: Insufficiently Protected Credentials
│   │   │   ├── CWE-549: Missing Password Field Masking
│   │   │   ├── CWE-260: Password in Configuration File
│   │   │   │   ├── CWE-258: Empty Password in Configuration File
│   │   │   │   ├── CWE-13: ASP.NET Misconfiguration: Password in Configuration File
│   │   │   │   ├── CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File
│   │   │   ├── CWE-256: Plaintext Storage of a Password
│   │   │   ├── CWE-523: Unprotected Transport of Credentials
│   │   │   ├── CWE-261: Weak Encoding for Password
│   │   │   ├── CWE-257: Storing Passwords in a Recoverable Format
│   │   ├── CWE-289: Authentication Bypass by Alternate Name
│   │   ├── CWE-262: Not Using Password Aging
│   │   ├── CWE-263: Password Aging with Long Expiration
│   │   ├── CWE-309: Use of Password System for Primary Authentication
│   │   ├── CWE-308: Use of Single-factor Authentication
│   │   ├── CWE-836: Use of Password Hash Instead of Password for Authentication
│   │   ├── CWE-1391: Use of Weak Credentials
│   │   │   ├── CWE-521: Weak Password Requirements
│   │   │   ├── CWE-798: Use of Hard-coded Credentials
│   │   │   │   ├── CWE-321: Use of Hard-coded Cryptographic Key
│   │   │   │   ├── CWE-259: Use of Hard-coded Password
│   │   │   ├── CWE-1392: Use of Default Credentials
│   │   │   │   ├── CWE-1394: Use of Default Cryptographic Key
│   │   │   │   ├── CWE-1393: Use of Default Password
│   │   ├── CWE-307: Improper Restriction of Excessive Authentication Attempts
│   │   ├── CWE-305: Authentication Bypass by Primary Weakness
│   │   ├── CWE-303: Incorrect Implementation of Authentication Algorithm
│   │   │   ├── CWE-304: Missing Critical Step in Authentication
│   │   ├── CWE-603: Use of Client-Side Authentication
│   │   ├── CWE-302: Authentication Bypass by Assumed-Immutable Data
│   │   ├── CWE-301: Reflection Attack in an Authentication Protocol
│   │   ├── CWE-620: Unverified Password Change
│   │   ├── CWE-290: Authentication Bypass by Spoofing
│   │   │   ├── CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action
│   │   │   ├── CWE-293: Using Referer Field for Authentication
│   │   │   ├── CWE-291: Reliance on IP Address for Authentication
│   │   ├── CWE-640: Weak Password Recovery Mechanism for Forgotten Password
├── CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code
├── CWE-1242: Inclusion of Undocumented Features or Chicken Bits
├── CWE-923: Improper Restriction of Communication Channel to Intended Endpoints
│   ├── CWE-940: Improper Verification of Source of a Communication Channel
│   │   ├── CWE-925: Improper Verification of Intent by Broadcast Receiver
│   ├── CWE-300: Channel Accessible by Non-Endpoint
│   ├── CWE-297: Improper Validation of Certificate with Host Mismatch
│   ├── CWE-941: Incorrectly Specified Destination in a Communication Channel
│   ├── CWE-1275: Sensitive Cookie with Improper SameSite Attribute
│   ├── CWE-420: Unprotected Alternate Channel
│   │   ├── CWE-421: Race Condition During Access to Alternate Channel
│   │   ├── CWE-422: Unprotected Windows Messaging Channel ('Shatter')
│   │   ├── CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface
│   ├── CWE-419: Unprotected Primary Channel
├── CWE-1276: Hardware Child Block Incorrectly Connected to Parent System
CWE-435: Improper Interaction Between Multiple Correctly-Behaving Entities
├── CWE-439: Behavioral Change in New Version or Environment
├── CWE-436: Interpretation Conflict
│   ├── CWE-437: Incomplete Model of Endpoint Features
│   ├── CWE-115: Misinterpretation of Input
│   ├── CWE-650: Trusting HTTP Permission Methods on the Server Side
│   ├── CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
├── CWE-1038: Insecure Automated Optimizations
│   ├── CWE-733: Compiler Optimization Removal or Modification of Security-critical Code
│   │   ├── CWE-14: Compiler Removal of Code to Clear Buffers
│   ├── CWE-1037: Processor Optimization Removal or Modification of Security-critical Code
CWE-664: Improper Control of a Resource Through its Lifetime
├── CWE-372: Incomplete Internal State Distinction
├── CWE-221: Information Loss or Omission
│   ├── CWE-356: Product UI does not Warn User of Unsafe Actions
│   ├── CWE-222: Truncation of Security-relevant Information
│   ├── CWE-224: Obscured Security-relevant Information by Alternate Name
│   ├── CWE-223: Omission of Security-relevant Information
│   │   ├── CWE-778: Insufficient Logging
├── CWE-118: Incorrect Access of Indexable Resource ('Range Error')
│   ├── CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
│   │   ├── CWE-825: Expired Pointer Dereference
│   │   │   ├── CWE-415: Double Free
│   │   │   ├── CWE-416: Use After Free
│   │   ├── CWE-824: Access of Uninitialized Pointer
│   │   ├── CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
│   │   ├── CWE-823: Use of Out-of-range Pointer Offset
│   │   ├── CWE-125: Out-of-bounds Read
│   │   ├── CWE-822: Untrusted Pointer Dereference
│   │   ├── CWE-805: Buffer Access with Incorrect Length Value
│   │   │   ├── CWE-806: Buffer Access Using Size of Source Buffer
│   │   ├── CWE-788: Access of Memory Location After End of Buffer
│   │   │   ├── CWE-126: Buffer Over-read
│   │   │   ├── CWE-122: Heap-based Buffer Overflow
│   │   │   ├── CWE-121: Stack-based Buffer Overflow
│   │   ├── CWE-786: Access of Memory Location Before Start of Buffer
│   │   │   ├── CWE-124: Buffer Underwrite ('Buffer Underflow')
│   │   │   ├── CWE-127: Buffer Under-read
│   │   ├── CWE-787: Out-of-bounds Write
│   │   │   ├── CWE-123: Write-what-where Condition
│   │   ├── CWE-466: Return of Pointer Value Outside of Expected Range
├── CWE-922: Insecure Storage of Sensitive Information
│   ├── CWE-921: Storage of Sensitive Data in a Mechanism without Access Control
├── CWE-1229: Creation of Emergent Resource
│   ├── CWE-514: Covert Channel
│   │   ├── CWE-385: Covert Timing Channel
│   │   ├── CWE-515: Covert Storage Channel
├── CWE-913: Improper Control of Dynamically-Managed Code Resources
│   ├── CWE-502: Deserialization of Untrusted Data
│   ├── CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
│   │   ├── CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
│   ├── CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
├── CWE-911: Improper Update of Reference Count
├── CWE-704: Incorrect Type Conversion or Cast
│   ├── CWE-681: Incorrect Conversion between Numeric Types
│   │   ├── CWE-197: Numeric Truncation Error
│   │   ├── CWE-196: Unsigned to Signed Conversion Error
│   │   ├── CWE-195: Signed to Unsigned Conversion Error
│   │   ├── CWE-192: Integer Coercion Error
│   │   ├── CWE-194: Unexpected Sign Extension
│   ├── CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
│   ├── CWE-1389: Incorrect Parsing of Numbers with Different Radices
│   ├── CWE-588: Attempt to Access Child of a Non-structure Pointer
├── CWE-706: Use of Incorrectly-Resolved Name or Reference
│   ├── CWE-41: Improper Resolution of Path Equivalence
│   │   ├── CWE-48: Path Equivalence: 'file name' (Internal Whitespace)
│   │   ├── CWE-47: Path Equivalence: ' filename' (Leading Space)
│   │   ├── CWE-55: Path Equivalence: '/./' (Single Dot Directory)
│   │   ├── CWE-46: Path Equivalence: 'filename ' (Trailing Space)
│   │   ├── CWE-42: Path Equivalence: 'filename.' (Trailing Dot)
│   │   │   ├── CWE-43: Path Equivalence: 'filename....' (Multiple Trailing Dot)
│   │   ├── CWE-44: Path Equivalence: 'file.name' (Internal Dot)
│   │   │   ├── CWE-45: Path Equivalence: 'file...name' (Multiple Internal Dot)
│   │   ├── CWE-54: Path Equivalence: 'filedir' (Trailing Backslash)
│   │   ├── CWE-57: Path Equivalence: 'fakedir/../realdir/filename'
│   │   ├── CWE-58: Path Equivalence: Windows 8.3 Filename
│   │   ├── CWE-53: Path Equivalence: 'multipleinternalbackslash'
│   │   ├── CWE-56: Path Equivalence: 'filedir*' (Wildcard)
│   │   ├── CWE-52: Path Equivalence: '/multiple/trailing/slash//'
│   │   ├── CWE-51: Path Equivalence: '/multiple//internal/slash'
│   │   ├── CWE-49: Path Equivalence: 'filename/' (Trailing Slash)
│   │   ├── CWE-50: Path Equivalence: '//multiple/leading/slash'
│   ├── CWE-827: Improper Control of Document Type Definition
│   ├── CWE-66: Improper Handling of File Names that Identify Virtual Resources
│   │   ├── CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path
│   │   ├── CWE-67: Improper Handling of Windows Device Names
│   │   ├── CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream
│   ├── CWE-386: Symbolic Name not Mapping to Correct Object
│   ├── CWE-59: Improper Link Resolution Before File Access ('Link Following')
│   │   ├── CWE-65: Windows Hard Link
│   │   ├── CWE-64: Windows Shortcut Following (.LNK)
│   │   ├── CWE-62: UNIX Hard Link
│   │   ├── CWE-1386: Insecure Operation on Windows Junction / Mount Point
│   │   ├── CWE-61: UNIX Symbolic Link (Symlink) Following
│   ├── CWE-178: Improper Handling of Case Sensitivity
│   ├── CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
│   │   ├── CWE-23: Relative Path Traversal
│   │   │   ├── CWE-35: Path Traversal: '.../...//'
│   │   │   ├── CWE-34: Path Traversal: '....//'
│   │   │   ├── CWE-33: Path Traversal: '....' (Multiple Dot)
│   │   │   ├── CWE-32: Path Traversal: '...' (Triple Dot)
│   │   │   ├── CWE-30: Path Traversal: 'dir..filename'
│   │   │   ├── CWE-31: Path Traversal: 'dir....filename'
│   │   │   ├── CWE-29: Path Traversal: '..filename'
│   │   │   ├── CWE-27: Path Traversal: 'dir/../../filename'
│   │   │   ├── CWE-26: Path Traversal: '/dir/../filename'
│   │   │   ├── CWE-24: Path Traversal: '../filedir'
│   │   │   ├── CWE-25: Path Traversal: '/../filedir'
│   │   │   ├── CWE-28: Path Traversal: '..filedir'
│   │   ├── CWE-36: Absolute Path Traversal
│   │   │   ├── CWE-39: Path Traversal: 'C:dirname'
│   │   │   ├── CWE-40: Path Traversal: 'UNCsharename' (Windows UNC Share)
│   │   │   ├── CWE-37: Path Traversal: '/absolute/pathname/here'
│   │   │   ├── CWE-38: Path Traversal: 'absolutepathnamehere'
├── CWE-673: External Influence of Sphere Definition
├── CWE-669: Incorrect Resource Transfer Between Spheres
│   ├── CWE-829: Inclusion of Functionality from Untrusted Control Sphere
│   │   ├── CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
│   │   ├── CWE-830: Inclusion of Web Functionality from an Untrusted Source
│   ├── CWE-434: Unrestricted Upload of File with Dangerous Type
│   ├── CWE-243: Creation of chroot Jail Without Changing Working Directory
│   ├── CWE-1420: Exposure of Sensitive Information during Transient Execution
│   │   ├── CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution
│   │   ├── CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution
│   │   ├── CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution
│   ├── CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer
│   │   ├── CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information
├── CWE-668: Exposure of Resource to Wrong Sphere
│   ├── CWE-642: External Control of Critical State Data
│   │   ├── CWE-73: External Control of File Name or Path
│   │   │   ├── CWE-114: Process Control
│   │   ├── CWE-565: Reliance on Cookies without Validation and Integrity Checking
│   │   │   ├── CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision
│   │   ├── CWE-15: External Control of System or Configuration Setting
│   │   ├── CWE-426: Untrusted Search Path
│   │   ├── CWE-472: External Control of Assumed-Immutable Web Parameter
│   ├── CWE-608: Struts: Non-private Field in ActionForm Class
│   ├── CWE-552: Files or Directories Accessible to External Parties
│   │   ├── CWE-553: Command Shell in Externally Accessible Directory
│   │   ├── CWE-539: Use of Persistent Cookies Containing Sensitive Information
│   │   ├── CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere
│   │   ├── CWE-530: Exposure of Backup File to an Unauthorized Control Sphere
│   │   ├── CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere
│   │   ├── CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere
│   │   ├── CWE-219: Storage of File with Sensitive Data Under Web Root
│   │   │   ├── CWE-433: Unparsed Raw Web Content Delivery
│   │   ├── CWE-220: Storage of File With Sensitive Data Under FTP Root
│   ├── CWE-524: Use of Cache Containing Sensitive Information
│   │   ├── CWE-525: Use of Web Browser Cache Containing Sensitive Information
│   ├── CWE-402: Transmission of Private Resources into a New Sphere ('Resource Leak')
│   │   ├── CWE-403: Exposure of File Descriptor to Unintended Control Sphere ('File Descriptor Leak')
│   │   ├── CWE-619: Dangling Database Cursor ('Cursor Injection')
│   ├── CWE-374: Passing Mutable Objects to an Untrusted Method
│   ├── CWE-493: Critical Public Variable Without Final Modifier
│   │   ├── CWE-500: Public Static Field Not Marked Final
│   ├── CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
│   │   ├── CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere
│   │   │   ├── CWE-214: Invocation of Process Using Visible Sensitive Information
│   │   │   ├── CWE-548: Exposure of Information Through Directory Listing
│   │   ├── CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory
│   │   │   ├── CWE-540: Inclusion of Sensitive Information in Source Code
│   │   │   │   ├── CWE-615: Inclusion of Sensitive Information in Source Code Comments
│   │   │   │   ├── CWE-531: Inclusion of Sensitive Information in Test Code
│   │   │   │   ├── CWE-541: Inclusion of Sensitive Information in an Include File
│   │   │   ├── CWE-651: Exposure of WSDL File Containing Sensitive Information
│   │   │   ├── CWE-532: Insertion of Sensitive Information into Log File
│   │   ├── CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
│   │   ├── CWE-215: Insertion of Sensitive Information Into Debugging Code
│   │   ├── CWE-209: Generation of Error Message Containing Sensitive Information
│   │   │   ├── CWE-550: Server-generated Error Message Containing Sensitive Information
│   │   │   ├── CWE-210: Self-generated Error Message Containing Sensitive Information
│   │   │   ├── CWE-211: Externally-Generated Error Message Containing Sensitive Information
│   │   │   │   ├── CWE-536: Servlet Runtime Error Message Containing Sensitive Information
│   │   │   │   ├── CWE-537: Java Runtime Error Message Containing Sensitive Information
│   │   │   │   ├── CWE-535: Exposure of Information Through Shell Error Message
│   │   ├── CWE-213: Exposure of Sensitive Information Due to Incompatible Policies
│   │   ├── CWE-203: Observable Discrepancy
│   │   │   ├── CWE-208: Observable Timing Discrepancy
│   │   │   │   ├── CWE-1254: Incorrect Comparison Logic Granularity
│   │   │   ├── CWE-204: Observable Response Discrepancy
│   │   │   ├── CWE-1300: Improper Protection of Physical Side Channels
│   │   │   │   ├── CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks
│   │   │   ├── CWE-205: Observable Behavioral Discrepancy
│   │   │   │   ├── CWE-206: Observable Internal Behavioral Discrepancy
│   │   │   │   ├── CWE-207: Observable Behavioral Discrepancy With Equivalent Products
│   │   ├── CWE-201: Insertion of Sensitive Information Into Sent Data
│   │   │   ├── CWE-598: Use of GET Request Method With Sensitive Query Strings
│   │   ├── CWE-1273: Device Unlock Credential Sharing
│   │   ├── CWE-1295: Debug Messages Revealing Unnecessary Information
│   ├── CWE-134: Use of Externally-Controlled Format String
│   ├── CWE-488: Exposure of Data Element to Wrong Session
│   ├── CWE-1282: Assumed-Immutable Data is Stored in Writable Memory
│   ├── CWE-1327: Binding to an Unrestricted IP Address
│   ├── CWE-375: Returning a Mutable Object to an Untrusted Caller
│   ├── CWE-582: Array Declared Public, Final, and Static
│   ├── CWE-499: Serializable Class Containing Sensitive Data
│   ├── CWE-498: Cloneable Class Containing Sensitive Information
│   ├── CWE-492: Use of Inner Class Containing Sensitive Data
│   ├── CWE-428: Unquoted Search Path or Element
│   ├── CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote
│   ├── CWE-491: Public cloneable() Method Without Final ('Object Hijack')
│   ├── CWE-427: Uncontrolled Search Path Element
│   ├── CWE-767: Access to Critical Private Variable via Public Method
│   ├── CWE-583: finalize() Method Declared Public
│   ├── CWE-377: Insecure Temporary File
│   │   ├── CWE-379: Creation of Temporary File in Directory with Insecure Permissions
│   │   ├── CWE-378: Creation of Temporary File With Insecure Permissions
├── CWE-666: Operation on Resource in Wrong Phase of Lifetime
│   ├── CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
│   ├── CWE-826: Premature Release of Resource During Expected Lifetime
│   ├── CWE-672: Operation on a Resource after Expiration or Release
│   │   ├── CWE-910: Use of Expired File Descriptor
│   │   ├── CWE-613: Insufficient Session Expiration
│   │   ├── CWE-324: Use of a Key Past its Expiration Date
├── CWE-665: Improper Initialization
│   ├── CWE-909: Missing Initialization of Resource
│   │   ├── CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings
│   │   ├── CWE-456: Missing Initialization of a Variable
│   ├── CWE-1419: Incorrect Initialization of Resource
│   │   ├── CWE-1188: Initialization of a Resource with an Insecure Default
│   │   │   ├── CWE-453: Insecure Default Variable Initialization
│   │   ├── CWE-1052: Excessive Use of Hard-Coded Literals in Initialization
│   │   ├── CWE-454: External Initialization of Trusted Variables or Data Stores
│   │   ├── CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data
│   │   ├── CWE-1221: Incorrect Register Defaults or Module Parameters
│   ├── CWE-908: Use of Uninitialized Resource
│   │   ├── CWE-457: Use of Uninitialized Variable
├── CWE-662: Improper Synchronization
│   ├── CWE-663: Use of a Non-reentrant Function in a Concurrent Context
│   │   ├── CWE-558: Use of getlogin() in Multithreaded Application
│   ├── CWE-1058: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element
│   ├── CWE-667: Improper Locking
│   │   ├── CWE-764: Multiple Locks of a Critical Resource
│   │   ├── CWE-609: Double-Checked Locking
│   │   ├── CWE-413: Improper Resource Locking
│   │   │   ├── CWE-591: Sensitive Data Storage in Improperly Locked Memory
│   │   ├── CWE-412: Unrestricted Externally Accessible Lock
│   │   ├── CWE-414: Missing Lock Check
│   │   ├── CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks
│   │   ├── CWE-1232: Improper Lock Behavior After Power State Transition
│   │   ├── CWE-833: Deadlock
│   │   ├── CWE-832: Unlock of a Resource that is not Locked
│   │   ├── CWE-765: Multiple Unlocks of a Critical Resource
│   ├── CWE-820: Missing Synchronization
│   │   ├── CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context
│   │   ├── CWE-1096: Singleton Class Instance Creation without Proper Locking or Synchronization
│   │   ├── CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context
│   ├── CWE-821: Incorrect Synchronization
│   │   ├── CWE-574: EJB Bad Practices: Use of Synchronization Primitives
│   │   ├── CWE-572: Call to Thread run() instead of start()
│   │   ├── CWE-1088: Synchronous Access of Remote Resource without Timeout
│   │   ├── CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels
├── CWE-610: Externally Controlled Reference to a Resource in Another Sphere
│   ├── CWE-611: Improper Restriction of XML External Entity Reference
│   ├── CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
│   ├── CWE-384: Session Fixation
│   ├── CWE-441: Unintended Proxy or Intermediary ('Confused Deputy')
│   │   ├── CWE-918: Server-Side Request Forgery (SSRF)
│   │   ├── CWE-1021: Improper Restriction of Rendered UI Layers or Frames
├── CWE-580: clone() Method Without super.clone()
├── CWE-501: Trust Boundary Violation
├── CWE-496: Public Data Assigned to Private Array-Typed Field
├── CWE-495: Private Data Structure Returned From A Public Method
├── CWE-487: Reliance on Package-level Scope
├── CWE-471: Modification of Assumed-Immutable Data (MAID)
│   ├── CWE-473: PHP External Variable Modification
│   ├── CWE-607: Public Static Final Field References Mutable Object
├── CWE-410: Insufficient Resource Pool
├── CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State
│   ├── CWE-1249: Application-Level Admin Tool with Inconsistent View of Underlying Operating System
│   ├── CWE-1251: Mirrored Regions with Different Values
├── CWE-400: Uncontrolled Resource Consumption
│   ├── CWE-779: Logging of Excessive Data
│   ├── CWE-920: Improper Restriction of Power Consumption
│   ├── CWE-770: Allocation of Resources Without Limits or Throttling
│   │   ├── CWE-1325: Improperly Controlled Sequential Memory Allocation
│   │   ├── CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling
│   │   ├── CWE-789: Memory Allocation with Excessive Size Value
│   ├── CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories
│   ├── CWE-405: Asymmetric Resource Consumption (Amplification)
│   │   ├── CWE-406: Insufficient Control of Network Message Volume (Network Amplification)
│   │   ├── CWE-1176: Inefficient CPU Computation
│   │   │   ├── CWE-1067: Excessive Execution of Sequential Searches of Data Resource
│   │   │   ├── CWE-1063: Creation of Class Instance within a Static Code Block
│   │   │   ├── CWE-1049: Excessive Data Query Operations in a Large Data Table
│   │   │   ├── CWE-1042: Static Member Data Element outside of a Singleton Class Element
│   │   │   ├── CWE-1046: Creation of Immutable Text Using String Concatenation
│   │   ├── CWE-407: Inefficient Algorithmic Complexity
│   │   │   ├── CWE-1333: Inefficient Regular Expression Complexity
│   │   ├── CWE-1094: Excessive Index Range Scan for a Data Resource
│   │   ├── CWE-1089: Large Data Table with Excessive Number of Indices
│   │   ├── CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
│   │   ├── CWE-1084: Invokable Control Element with Excessive File or Data Access Operations
│   │   ├── CWE-1072: Data Resource Access without Use of Connection Pooling
│   │   ├── CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses
│   │   ├── CWE-1050: Excessive Platform Resource Consumption within a Loop
│   ├── CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations
│   ├── CWE-771: Missing Reference to Active Allocated Resource
│   │   ├── CWE-773: Missing Reference to Active File Descriptor or Handle
├── CWE-404: Improper Resource Shutdown or Release
│   ├── CWE-772: Missing Release of Resource after Effective Lifetime
│   │   ├── CWE-401: Missing Release of Memory after Effective Lifetime
│   │   ├── CWE-1091: Use of Object without Invoking Destructor Method
│   │   ├── CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime
│   ├── CWE-763: Release of Invalid Pointer or Reference
│   │   ├── CWE-761: Free of Pointer not at Start of Buffer
│   │   ├── CWE-762: Mismatched Memory Management Routines
│   │   │   ├── CWE-590: Free of Memory not on the Heap
│   ├── CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device
│   ├── CWE-459: Incomplete Cleanup
│   │   ├── CWE-568: finalize() Method Without super.finalize()
│   │   ├── CWE-226: Sensitive Information in Resource Not Removed Before Reuse
│   │   │   ├── CWE-1342: Information Exposure through Microarchitectural State after Transient Execution
│   │   │   ├── CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition
│   │   │   ├── CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component
│   │   │   │   ├── CWE-1330: Remanent Data Readable after Memory Erase
│   │   │   ├── CWE-244: Improper Clearing of Heap Memory Before Release ('Heap Inspection')
│   │   │   ├── CWE-1239: Improper Zeroization of Hardware Register
│   │   ├── CWE-460: Improper Cleanup on Thrown Exception
CWE-682: Incorrect Calculation
├── CWE-1335: Incorrect Bitwise Shift of Integer
├── CWE-128: Wrap-around Error
├── CWE-1339: Insufficient Precision or Accuracy of a Real Number
├── CWE-469: Use of Pointer Subtraction to Determine Size
├── CWE-135: Incorrect Calculation of Multi-Byte String Length
├── CWE-468: Incorrect Pointer Scaling
├── CWE-369: Divide By Zero
├── CWE-193: Off-by-one Error
├── CWE-131: Incorrect Calculation of Buffer Size
│   ├── CWE-467: Use of sizeof() on a Pointer Type
├── CWE-191: Integer Underflow (Wrap or Wraparound)
├── CWE-190: Integer Overflow or Wraparound
│   ├── CWE-680: Integer Overflow to Buffer Overflow
CWE-691: Insufficient Control Flow Management
├── CWE-841: Improper Enforcement of Behavioral Workflow
├── CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior
├── CWE-834: Excessive Iteration
│   ├── CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
│   ├── CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context
│   ├── CWE-674: Uncontrolled Recursion
│   │   ├── CWE-776: Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion')
├── CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls
├── CWE-1279: Cryptographic Operations are run Before Supporting Units are Ready
├── CWE-799: Improper Control of Interaction Frequency
│   ├── CWE-837: Improper Enforcement of a Single, Unique Action
├── CWE-768: Incorrect Short Circuit Evaluation
├── CWE-705: Incorrect Control Flow Scoping
│   ├── CWE-698: Execution After Redirect (EAR)
│   ├── CWE-584: Return Inside Finally Block
│   ├── CWE-455: Non-exit on Failed Initialization
│   ├── CWE-396: Declaration of Catch for Generic Exception
│   ├── CWE-397: Declaration of Throws for Generic Exception
│   ├── CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference
│   ├── CWE-382: J2EE Bad Practices: Use of System.exit()
│   ├── CWE-248: Uncaught Exception
│   │   ├── CWE-600: Uncaught Exception in Servlet 
├── CWE-696: Incorrect Behavior Order
│   ├── CWE-408: Incorrect Behavior Order: Early Amplification
│   ├── CWE-179: Incorrect Behavior Order: Early Validation
│   │   ├── CWE-181: Incorrect Behavior Order: Validate Before Filter
│   │   ├── CWE-180: Incorrect Behavior Order: Validate Before Canonicalize
│   ├── CWE-1280: Access Control Check Implemented After Asset is Accessed
│   ├── CWE-1190: DMA Device Enabled Too Early in Boot Phase
│   ├── CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control
├── CWE-670: Always-Incorrect Control Flow Implementation
│   ├── CWE-617: Reachable Assertion
│   ├── CWE-480: Use of Incorrect Operator
│   │   ├── CWE-482: Comparing instead of Assigning
│   │   ├── CWE-481: Assigning instead of Comparing
│   ├── CWE-783: Operator Precedence Logic Error
│   ├── CWE-483: Incorrect Block Delimitation
├── CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
│   ├── CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition
│   │   ├── CWE-363: Race Condition Enabling Link Following
│   ├── CWE-689: Permission Race Condition During Resource Copy
│   ├── CWE-368: Context Switching Race Condition
│   ├── CWE-1223: Race Condition for Write-Once Attributes
│   ├── CWE-366: Race Condition within a Thread
│   ├── CWE-364: Signal Handler Race Condition
│   │   ├── CWE-831: Signal Handler Function Associated with Multiple Signals
│   │   ├── CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations
│   │   ├── CWE-828: Signal Handler with Functionality that is not Asynchronous-Safe
│   │   │   ├── CWE-479: Signal Handler Use of a Non-reentrant Function
│   ├── CWE-1298: Hardware Logic Contains Race Conditions
├── CWE-431: Missing Handler
├── CWE-430: Deployment of Wrong Handler
CWE-693: Protection Mechanism Failure
├── CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications
├── CWE-1253: Incorrect Selection of Fuse Values
├── CWE-1039: Automated Recognition Mechanism with Inadequate Detection or Handling of Adversarial Input Perturbations
├── CWE-1269: Product Released in Non-Release Configuration
├── CWE-807: Reliance on Untrusted Inputs in a Security Decision
├── CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
├── CWE-602: Client-Side Enforcement of Server-Side Security
├── CWE-357: Insufficient UI Warning of Dangerous Operations
│   ├── CWE-450: Multiple Interpretations of UI Input
├── CWE-345: Insufficient Verification of Data Authenticity
│   ├── CWE-346: Origin Validation Error
│   │   ├── CWE-1385: Missing Origin Validation in WebSockets
│   ├── CWE-1293: Missing Source Correlation of Multiple Independent Data
│   ├── CWE-616: Incomplete Identification of Uploaded File Variables (PHP)
│   ├── CWE-352: Cross-Site Request Forgery (CSRF)
│   ├── CWE-354: Improper Validation of Integrity Check Value
│   ├── CWE-360: Trust of System Event Data
│   ├── CWE-646: Reliance on File Name or Extension of Externally-Supplied File
│   ├── CWE-347: Improper Verification of Cryptographic Signature
│   ├── CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel
│   ├── CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
│   ├── CWE-353: Missing Support for Integrity Check
│   ├── CWE-348: Use of Less Trusted Source
│   ├── CWE-351: Insufficient Type Distinction
│   ├── CWE-494: Download of Code Without Integrity Check
│   ├── CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data
├── CWE-330: Use of Insufficiently Random Values
│   ├── CWE-1241: Use of Predictable Algorithm in Random Number Generator
│   ├── CWE-340: Generation of Predictable Numbers or Identifiers
│   │   ├── CWE-342: Predictable Exact Value from Previous Values
│   │   ├── CWE-341: Predictable from Observable State
│   │   ├── CWE-343: Predictable Value Range from Previous Values
│   ├── CWE-344: Use of Invariant Value in Dynamically Changing Context
│   │   ├── CWE-323: Reusing a Nonce, Key Pair in Encryption
│   ├── CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
│   ├── CWE-1204: Generation of Weak Initialization Vector (IV)
│   │   ├── CWE-329: Generation of Predictable IV with CBC Mode
│   ├── CWE-334: Small Space of Random Values
│   │   ├── CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length
│   ├── CWE-331: Insufficient Entropy
│   │   ├── CWE-333: Improper Handling of Insufficient Entropy in TRNG
│   │   ├── CWE-332: Insufficient Entropy in PRNG
│   ├── CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
│   │   ├── CWE-339: Small Seed Space in PRNG
│   │   ├── CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)
│   │   ├── CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG)
├── CWE-327: Use of a Broken or Risky Cryptographic Algorithm
│   ├── CWE-780: Use of RSA Algorithm without OAEP
│   ├── CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation
│   ├── CWE-328: Use of Weak Hash
│   │   ├── CWE-916: Use of Password Hash With Insufficient Computational Effort
│   │   │   ├── CWE-760: Use of a One-Way Hash with a Predictable Salt
│   │   │   ├── CWE-759: Use of a One-Way Hash without a Salt
├── CWE-326: Inadequate Encryption Strength
├── CWE-311: Missing Encryption of Sensitive Data
│   ├── CWE-312: Cleartext Storage of Sensitive Information
│   │   ├── CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable
│   │   ├── CWE-317: Cleartext Storage of Sensitive Information in GUI
│   │   ├── CWE-315: Cleartext Storage of Sensitive Information in a Cookie
│   │   ├── CWE-313: Cleartext Storage in a File or on Disk
│   │   ├── CWE-316: Cleartext Storage of Sensitive Information in Memory
│   │   ├── CWE-314: Cleartext Storage in the Registry
│   │   ├── CWE-318: Cleartext Storage of Sensitive Information in Executable
│   ├── CWE-319: Cleartext Transmission of Sensitive Information
│   │   ├── CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption
│   │   ├── CWE-614: Sensitive Cookie in HTTPS Session Without 'Secure' Attribute
├── CWE-184: Incomplete List of Disallowed Inputs
│   ├── CWE-692: Incomplete Denylist to Cross-Site Scripting
├── CWE-182: Collapse of Data into Unsafe Value
├── CWE-1338: Improper Protections Against Hardware Overheating
├── CWE-1326: Missing Immutable Root of Trust in Hardware
├── CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI)
├── CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses
├── CWE-1291: Public Key Re-Use for Signing both Debug and Production Code
├── CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques
CWE-697: Incorrect Comparison
├── CWE-1023: Incomplete Comparison with Missing Factors
│   ├── CWE-478: Missing Default Case in Multiple Condition Expression
│   ├── CWE-839: Numeric Range Comparison Without Minimum Check
│   ├── CWE-187: Partial String Comparison
├── CWE-1024: Comparison of Incompatible Types
├── CWE-1025: Comparison Using Wrong Factors
│   ├── CWE-486: Comparison of Classes by Name
│   ├── CWE-595: Comparison of Object References Instead of Object Contents
│   │   ├── CWE-597: Use of Wrong Operator in String Comparison
├── CWE-1077: Floating Point Comparison with Incorrect Operator
├── CWE-185: Incorrect Regular Expression
│   ├── CWE-186: Overly Restrictive Regular Expression
│   ├── CWE-625: Permissive Regular Expression
│   │   ├── CWE-777: Regular Expression without Anchors
├── CWE-183: Permissive List of Allowed Inputs
CWE-703: Improper Check or Handling of Exceptional Conditions
├── CWE-1384: Improper Handling of Physical or Environmental Conditions
│   ├── CWE-1332: Improper Handling of Faults that Lead to Instruction Skips
│   ├── CWE-1351: Improper Handling of Hardware Behavior in Exceptionally Cold Environments
│   ├── CWE-1261: Improper Handling of Single Event Upsets
│   ├── CWE-1247: Improper Protection Against Voltage and Clock Glitches
├── CWE-754: Improper Check for Unusual or Exceptional Conditions
│   ├── CWE-391: Unchecked Error Condition
│   ├── CWE-273: Improper Check for Dropped Privileges
│   ├── CWE-394: Unexpected Status Code or Return Value
│   ├── CWE-252: Unchecked Return Value
│   │   ├── CWE-690: Unchecked Return Value to NULL Pointer Dereference
├── CWE-755: Improper Handling of Exceptional Conditions
│   ├── CWE-280: Improper Handling of Insufficient Permissions or Privileges 
│   ├── CWE-756: Missing Custom Error Page
│   │   ├── CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page
│   │   ├── CWE-7: J2EE Misconfiguration: Missing Custom Error Page
│   ├── CWE-392: Missing Report of Error Condition
│   ├── CWE-544: Missing Standardized Error Handling Mechanism
│   ├── CWE-390: Detection of Error Condition Without Action
│   ├── CWE-274: Improper Handling of Insufficient Privileges
CWE-707: Improper Neutralization
├── CWE-116: Improper Encoding or Escaping of Output
│   ├── CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax
│   ├── CWE-838: Inappropriate Encoding for Output Context
│   ├── CWE-117: Improper Output Neutralization for Logs
├── CWE-138: Improper Neutralization of Special Elements
│   ├── CWE-162: Improper Neutralization of Trailing Special Elements
│   │   ├── CWE-163: Improper Neutralization of Multiple Trailing Special Elements
│   ├── CWE-464: Addition of Data Structure Sentinel
│   ├── CWE-164: Improper Neutralization of Internal Special Elements
│   │   ├── CWE-165: Improper Neutralization of Multiple Internal Special Elements
│   ├── CWE-158: Improper Neutralization of Null Byte or NUL Character
│   ├── CWE-160: Improper Neutralization of Leading Special Elements
│   │   ├── CWE-161: Improper Neutralization of Multiple Leading Special Elements
│   ├── CWE-157: Failure to Sanitize Paired Delimiters
│   ├── CWE-156: Improper Neutralization of Whitespace
│   ├── CWE-155: Improper Neutralization of Wildcards or Matching Symbols
│   ├── CWE-154: Improper Neutralization of Variable Name Delimiters
│   ├── CWE-790: Improper Filtering of Special Elements
│   │   ├── CWE-791: Incomplete Filtering of Special Elements
│   │   │   ├── CWE-795: Only Filtering Special Elements at a Specified Location
│   │   │   │   ├── CWE-797: Only Filtering Special Elements at an Absolute Position
│   │   │   │   ├── CWE-796: Only Filtering Special Elements Relative to a Marker
│   │   │   ├── CWE-792: Incomplete Filtering of One or More Instances of Special Elements
│   │   │   │   ├── CWE-794: Incomplete Filtering of Multiple Instances of Special Elements
│   │   │   │   ├── CWE-793: Only Filtering One Instance of a Special Element
│   ├── CWE-153: Improper Neutralization of Substitution Characters
│   ├── CWE-152: Improper Neutralization of Macro Symbols
│   ├── CWE-159: Improper Handling of Invalid Use of Special Elements
│   │   ├── CWE-168: Improper Handling of Inconsistent Special Elements
│   │   ├── CWE-167: Improper Handling of Additional Special Element
│   │   ├── CWE-166: Improper Handling of Missing Special Element
│   ├── CWE-151: Improper Neutralization of Comment Delimiters
│   ├── CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences
│   ├── CWE-149: Improper Neutralization of Quoting Syntax
│   ├── CWE-140: Improper Neutralization of Delimiters
│   │   ├── CWE-143: Improper Neutralization of Record Delimiters
│   │   ├── CWE-141: Improper Neutralization of Parameter/Argument Delimiters
│   │   ├── CWE-145: Improper Neutralization of Section Delimiters
│   │   ├── CWE-146: Improper Neutralization of Expression/Command Delimiters
│   │   ├── CWE-144: Improper Neutralization of Line Delimiters
│   │   ├── CWE-142: Improper Neutralization of Value Delimiters
│   ├── CWE-147: Improper Neutralization of Input Terminators
│   │   ├── CWE-626: Null Byte Interaction Error (Poison Null Byte)
│   ├── CWE-148: Improper Neutralization of Input Leaders
├── CWE-170: Improper Null Termination
├── CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
│   ├── CWE-91: XML Injection (aka Blind XPath Injection)
│   ├── CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
│   │   ├── CWE-85: Doubled Character XSS Manipulations
│   │   ├── CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page
│   │   ├── CWE-83: Improper Neutralization of Script in Attributes in a Web Page
│   │   │   ├── CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
│   │   ├── CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
│   │   ├── CWE-81: Improper Neutralization of Script in an Error Message Web Page
│   │   ├── CWE-87: Improper Neutralization of Alternate XSS Syntax
│   │   ├── CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages
│   ├── CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
│   │   ├── CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
│   │   ├── CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
│   │   ├── CWE-624: Executable Regular Expression Error
│   │   ├── CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
│   ├── CWE-1236: Improper Neutralization of Formula Elements in a CSV File
│   ├── CWE-75: Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
│   │   ├── CWE-76: Improper Neutralization of Equivalent Special Elements
│   ├── CWE-99: Improper Control of Resource Identifiers ('Resource Injection')
│   │   ├── CWE-914: Improper Control of Dynamically-Identified Variables
│   │   │   ├── CWE-621: Variable Extraction Error
│   │   │   ├── CWE-627: Dynamic Variable Evaluation
│   │   ├── CWE-694: Use of Multiple Resources with Duplicate Identifier
│   │   │   ├── CWE-102: Struts: Duplicate Validation Forms
│   │   │   ├── CWE-462: Duplicate Key in Associative List (Alist)
│   │   ├── CWE-641: Improper Restriction of Names for Files and Other Resources
│   ├── CWE-943: Improper Neutralization of Special Elements in Data Query Logic
│   │   ├── CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
│   │   ├── CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
│   │   │   ├── CWE-564: SQL Injection: Hibernate
│   │   ├── CWE-643: Improper Neutralization of Data within XPath Expressions ('XPath Injection')
│   │   ├── CWE-652: Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
│   ├── CWE-94: Improper Control of Generation of Code ('Code Injection')
│   │   ├── CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
│   │   │   ├── CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
│   │   ├── CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine
│   │   ├── CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
│   ├── CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
│   │   ├── CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
├── CWE-463: Deletion of Data Structure Sentinel
├── CWE-172: Encoding Error
│   ├── CWE-177: Improper Handling of URL Encoding (Hex Encoding)
│   ├── CWE-176: Improper Handling of Unicode Encoding
│   ├── CWE-173: Improper Handling of Alternate Encoding
│   ├── CWE-175: Improper Handling of Mixed Encoding
├── CWE-228: Improper Handling of Syntactically Invalid Structure
│   ├── CWE-241: Improper Handling of Unexpected Data Type
│   ├── CWE-237: Improper Handling of Structural Elements
│   │   ├── CWE-239: Failure to Handle Incomplete Element
│   │   ├── CWE-240: Improper Handling of Inconsistent Structural Elements
│   │   │   ├── CWE-130: Improper Handling of Length Parameter Inconsistency
│   │   ├── CWE-238: Improper Handling of Incomplete Structural Elements
│   ├── CWE-229: Improper Handling of Values
│   │   ├── CWE-232: Improper Handling of Undefined Values
│   │   ├── CWE-230: Improper Handling of Missing Values
│   │   ├── CWE-231: Improper Handling of Extra Values
│   ├── CWE-233: Improper Handling of Parameters
│   │   ├── CWE-236: Improper Handling of Undefined Parameters
│   │   ├── CWE-234: Failure to Handle Missing Parameter
│   │   ├── CWE-235: Improper Handling of Extra Parameters
├── CWE-20: Improper Input Validation
│   ├── CWE-622: Improper Validation of Function Hook Arguments
│   ├── CWE-1288: Improper Validation of Consistency within Input
│   ├── CWE-1287: Improper Validation of Specified Type of Input
│   ├── CWE-1289: Improper Validation of Unsafe Equivalence in Input
│   ├── CWE-1286: Improper Validation of Syntactic Correctness of Input
│   │   ├── CWE-112: Missing XML Validation
│   ├── CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
│   │   ├── CWE-129: Improper Validation of Array Index
│   │   ├── CWE-781: Improper Address Validation in IOCTL with METHOD_NEITHER I/O Control Code
│   ├── CWE-1173: Improper Use of Validation Framework
│   │   ├── CWE-105: Struts: Form Field Without Validator
│   │   ├── CWE-1174: ASP.NET Misconfiguration: Improper Model Validation
│   │   ├── CWE-554: ASP.NET Misconfiguration: Not Using Input Validation Framework
│   │   ├── CWE-109: Struts: Validator Turned Off
│   │   ├── CWE-106: Struts: Plug-in Framework not in Use
│   │   ├── CWE-108: Struts: Unvalidated Action Form
│   ├── CWE-1284: Improper Validation of Specified Quantity in Input
│   │   ├── CWE-606: Unchecked Input for Loop Condition
CWE-710: Improper Adherence to Coding Standards
├── CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range
├── CWE-657: Violation of Secure Design Principles
│   ├── CWE-638: Not Using Complete Mediation
│   │   ├── CWE-424: Improper Protection of Alternate Path
│   ├── CWE-653: Improper Isolation or Compartmentalization
│   │   ├── CWE-1189: Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
│   │   │   ├── CWE-1303: Non-Transparent Sharing of Microarchitectural Resources
│   │   ├── CWE-1331: Improper Isolation of Shared Resources in Network On Chip (NoC)
│   ├── CWE-671: Lack of Administrator Control over Security
│   │   ├── CWE-447: Unimplemented or Unsupported Feature in UI
│   ├── CWE-656: Reliance on Security Through Obscurity
│   ├── CWE-655: Insufficient Psychological Acceptability
│   ├── CWE-636: Not Failing Securely ('Failing Open')
│   ├── CWE-1192: Improper Identifier for IP Block used in System-On-Chip (SOC)
│   ├── CWE-654: Reliance on a Single Factor in a Security Decision
│   ├── CWE-1395: Dependency on Vulnerable Third-Party Component
│   ├── CWE-637: Unnecessary Complexity in Protection Mechanism (Not Using 'Economy of Mechanism')
├── CWE-573: Improper Following of Specification by Caller
│   ├── CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session
│   ├── CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined
│   ├── CWE-675: Multiple Operations on Resource in Single-Operation Context
│   │   ├── CWE-1341: Multiple Releases of Same Resource or Handle
│   │   ├── CWE-174: Double Decoding of the Same Data
│   │   ├── CWE-605: Multiple Binds to the Same Port
│   ├── CWE-628: Function Call with Incorrectly Specified Arguments
│   │   ├── CWE-688: Function Call With Incorrect Variable or Reference as Argument
│   │   ├── CWE-687: Function Call With Incorrectly Specified Argument Value
│   │   │   ├── CWE-560: Use of umask() with chmod-style Argument
│   │   ├── CWE-685: Function Call With Incorrect Number of Arguments
│   │   ├── CWE-686: Function Call With Incorrect Argument Type
│   │   ├── CWE-683: Function Call With Incorrect Order of Arguments
│   ├── CWE-578: EJB Bad Practices: Use of Class Loader
│   ├── CWE-577: EJB Bad Practices: Use of Sockets
│   ├── CWE-475: Undefined Behavior for Input to API
│   ├── CWE-358: Improperly Implemented Security Check for Standard
│   ├── CWE-325: Missing Cryptographic Step
│   ├── CWE-253: Incorrect Check of Function Return Value
│   ├── CWE-695: Use of Low-Level Functionality
│   │   ├── CWE-575: EJB Bad Practices: Use of AWT Swing
│   │   ├── CWE-383: J2EE Bad Practices: Direct Use of Threads
│   │   ├── CWE-246: J2EE Bad Practices: Direct Use of Sockets
│   │   ├── CWE-576: EJB Bad Practices: Use of Java I/O
│   │   ├── CWE-111: Direct Use of Unsafe JNI
│   │   ├── CWE-245: J2EE Bad Practices: Direct Management of Connections
│   ├── CWE-103: Struts: Incomplete validate() Method Definition
│   ├── CWE-104: Struts: Form Bean Does Not Extend Validation Class
├── CWE-1048: Invokable Control Element with Large Number of Outward Calls
├── CWE-1041: Use of Redundant Code
├── CWE-570: Expression is Always False
├── CWE-571: Expression is Always True
├── CWE-1164: Irrelevant Code
│   ├── CWE-110: Struts: Validator Without Form Field
│   ├── CWE-563: Assignment to Variable without Use
│   ├── CWE-561: Dead Code
│   ├── CWE-107: Struts: Unused Validation Form
│   ├── CWE-1071: Empty Code Block
│   │   ├── CWE-1069: Empty Exception Block
│   │   ├── CWE-585: Empty Synchronized Block
├── CWE-1177: Use of Prohibited Code
│   ├── CWE-242: Use of Inherently Dangerous Function
│   ├── CWE-676: Use of Potentially Dangerous Function
│   │   ├── CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer
├── CWE-489: Active Debug Code
│   ├── CWE-11: ASP.NET Misconfiguration: Creating Debug Binary
├── CWE-684: Incorrect Provision of Specified Functionality
│   ├── CWE-440: Expected Behavior Violation
│   ├── CWE-451: User Interface (UI) Misrepresentation of Critical Information
│   │   ├── CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User
│   ├── CWE-446: UI Discrepancy for Security Feature
│   │   ├── CWE-449: The UI Performs the Wrong Action
│   │   ├── CWE-448: Obsolete Feature in UI
│   ├── CWE-912: Hidden Functionality
│   │   ├── CWE-506: Embedded Malicious Code
│   │   │   ├── CWE-511: Logic/Time Bomb
│   │   │   ├── CWE-510: Trapdoor
│   │   │   ├── CWE-512: Spyware
│   │   │   ├── CWE-507: Trojan Horse
│   │   │   │   ├── CWE-509: Replicating Malicious Code (Virus or Worm)
│   │   │   │   ├── CWE-508: Non-Replicating Malicious Code
│   ├── CWE-393: Return of Wrong Status Code
│   ├── CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic
├── CWE-476: NULL Pointer Dereference
├── CWE-484: Omitted Break Statement in Switch
├── CWE-1357: Reliance on Insufficiently Trustworthy Component
│   ├── CWE-1104: Use of Unmaintained Third Party Components
│   ├── CWE-1329: Reliance on Component That is Not Updateable
│   │   ├── CWE-1310: Missing Ability to Patch ROM Code
│   │   ├── CWE-1277: Firmware Not Updateable
├── CWE-1209: Failure to Disable Reserved Bits
├── CWE-1093: Excessively Complex Data Representation
│   ├── CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements
│   ├── CWE-1055: Multiple Inheritance from Concrete Classes
│   ├── CWE-1086: Class with Excessive Number of Child Classes
│   ├── CWE-1074: Class with Excessively Deep Inheritance
├── CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers
├── CWE-1076: Insufficient Adherence to Expected Conventions
│   ├── CWE-1108: Excessive Reliance on Global Variables
│   ├── CWE-594: J2EE Framework: Saving Unserializable Objects to Disk
│   ├── CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element
│   ├── CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element
│   ├── CWE-586: Explicit Call to Finalize()
│   ├── CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor
│   ├── CWE-1082: Class Instance Self Destruction Control Element
│   ├── CWE-1070: Serializable Data Element Containing non-Serializable Item Elements
│   ├── CWE-1087: Class with Virtual Method without a Virtual Destructor
│   ├── CWE-1079: Parent Class without Virtual Destructor Method
│   ├── CWE-1078: Inappropriate Source Code Style or Formatting
│   │   ├── CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code
│   │   ├── CWE-1106: Insufficient Use of Symbolic Constants
│   │   ├── CWE-1116: Inaccurate Comments
│   │   ├── CWE-1115: Source Code Element without Standard Prologue
│   │   ├── CWE-1114: Inappropriate Whitespace Style
│   │   ├── CWE-547: Use of Hard-coded, Security-relevant Constants
│   │   ├── CWE-546: Suspicious Comment
│   │   ├── CWE-1109: Use of Same Variable for Multiple Purposes
│   │   ├── CWE-1113: Inappropriate Comment Style
│   │   ├── CWE-1107: Insufficient Isolation of Symbolic Constant Definitions
│   │   ├── CWE-1099: Inconsistent Naming Conventions for Identifiers
│   │   ├── CWE-1117: Callable with Insufficient Behavioral Summary
├── CWE-1068: Inconsistency Between Implementation and Documented Design
├── CWE-1127: Compilation with Insufficient Warnings or Errors
├── CWE-477: Use of Obsolete Function
├── CWE-1126: Declaration of Variable with Unnecessarily Wide Scope
├── CWE-1120: Excessive Code Complexity
│   ├── CWE-1123: Excessive Use of Self-Modifying Code
│   ├── CWE-1122: Excessive Halstead Complexity
│   ├── CWE-1124: Excessively Deep Nesting
│   ├── CWE-1121: Excessive McCabe Cyclomatic Complexity
│   ├── CWE-1119: Excessive Use of Unconditional Branching
│   ├── CWE-1095: Loop Condition Value Update within the Loop
│   ├── CWE-1125: Excessive Attack Surface
│   ├── CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses
│   ├── CWE-1075: Unconditional Control Flow Transfer outside of Switch Block
│   ├── CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters
│   ├── CWE-1080: Source Code File with Excessive Number of Lines of Code
│   ├── CWE-1047: Modules with Circular Dependencies
│   ├── CWE-1056: Invokable Control Element with Variadic Parameters
├── CWE-1101: Reliance on Runtime Component in Generated Code
├── CWE-1066: Missing Serialization Control Element
├── CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers
├── CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior
│   ├── CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality
│   │   ├── CWE-188: Reliance on Data/Memory Layout
│   │   │   ├── CWE-198: Use of Incorrect Byte Ordering
│   ├── CWE-562: Return of Stack Variable Address
│   ├── CWE-474: Use of Function with Inconsistent Implementations
│   │   ├── CWE-589: Call to Non-ubiquitous API
│   ├── CWE-587: Assignment of a Fixed Address to a Pointer
│   ├── CWE-1102: Reliance on Machine-Dependent Data Representation
│   ├── CWE-1103: Use of Platform-Dependent Third Party Components
├── CWE-1061: Insufficient Encapsulation
│   ├── CWE-1062: Parent Class with References to Child Class
│   ├── CWE-1090: Method Containing Access of a Member Element from Another Class
│   ├── CWE-1083: Data Access from Outside Expected Data Manager Component
│   ├── CWE-1100: Insufficient Isolation of System-Dependent Functions
│   ├── CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer
│   ├── CWE-1057: Data Access Operations Outside of Expected Data Manager Component
├── CWE-1059: Insufficient Technical Documentation
│   ├── CWE-1111: Incomplete I/O Documentation
│   ├── CWE-1118: Insufficient Documentation of Error Handling Techniques
│   ├── CWE-1112: Incomplete Documentation of Program Execution
│   ├── CWE-1053: Missing Documentation for Design
│   ├── CWE-1110: Incomplete Design Documentation