CWE Research Context
Browse Common Weakness Enumeration context connected to published Atomicorp CVE research and active WAF protections. CVE pages provide the direct finding for a specific vulnerability.
This is a selected set of published research examples, not a complete list of Atomicorp protections. Absence of a CWE or CVE does not imply absence of protection against that weakness or attack method.
| CWE | Weakness | Published CVEs | Products | Active Atomicorp rules |
|---|---|---|---|---|
| CWE-15 | External Control of System or Configuration Setting | 1 | 1 | 2 |
| CWE-17 | DEPRECATED: Code | 1 | 1 | 1 |
| CWE-19 | Data Processing Errors | 3 | 3 | 12 |
| CWE-20 | Improper Input Validation | 137 | 118 | 112 |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | 1144 | 939 | 134 |
| CWE-23 | Relative Path Traversal | 20 | 19 | 19 |
| CWE-24 | Path Traversal: '../filedir' | 7 | 7 | 6 |
| CWE-25 | Path Traversal: '/../filedir' | 1 | 1 | 13 |
| CWE-26 | Path Traversal: '/dir/../filename' | 2 | 2 | 6 |
| CWE-27 | Path Traversal: 'dir/../../filename' | 2 | 2 | 14 |
| CWE-28 | Path Traversal: '..\filedir' | 1 | 1 | 2 |
| CWE-29 | Path Traversal: '..\filename' | 11 | 5 | 9 |
| CWE-31 | Path Traversal: 'dir....\filename' | 1 | 1 | 5 |
| CWE-32 | Path Traversal: '…' (Triple Dot) | 1 | 1 | 1 |
| CWE-35 | Path Traversal: '…/…//' | 3 | 3 | 4 |
| CWE-36 | Absolute Path Traversal | 8 | 8 | 11 |
| CWE-44 | Path Equivalence: 'file.name' (Internal Dot) | 1 | 1 | 1 |
| CWE-50 | Path Equivalence: '//multiple/leading/slash' | 1 | 1 | 1 |
| CWE-59 | Improper Link Resolution Before File Access ('Link Following') | 6 | 5 | 16 |
| CWE-61 | UNIX Symbolic Link (Symlink) Following | 2 | 1 | 5 |
| CWE-73 | External Control of File Name or Path | 62 | 56 | 59 |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | 1181 | 446 | 95 |
| CWE-77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') | 231 | 146 | 71 |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') | 619 | 386 | 96 |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | 2213 | 1451 | 119 |
| CWE-80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | 21 | 19 | 17 |
| CWE-81 | Improper Neutralization of Script in an Error Message Web Page | 1 | 1 | 1 |
| CWE-83 | Improper Neutralization of Script in Attributes in a Web Page | 5 | 5 | 26 |
| CWE-84 | Improper Neutralization of Encoded URI Schemes in a Web Page | 1 | 1 | 1 |
| CWE-87 | Improper Neutralization of Alternate XSS Syntax | 8 | 4 | 15 |
| CWE-88 | Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') | 14 | 14 | 26 |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | 2111 | 1086 | 110 |
| CWE-90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') | 1 | 1 | 3 |
| CWE-91 | XML Injection (aka Blind XPath Injection) | 6 | 6 | 21 |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | 10 | 10 | 27 |
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | 673 | 438 | 129 |
| CWE-95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') | 18 | 16 | 25 |
| CWE-96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') | 1 | 1 | 13 |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | 33 | 32 | 39 |
| CWE-112 | Missing XML Validation | 1 | 1 | 2 |
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | 5 | 5 | 20 |
| CWE-116 | Improper Encoding or Escaping of Output | 18 | 18 | 32 |
| CWE-119 | Improper Restriction of Operations within the Bounds of a Memory Buffer | 14 | 12 | 21 |
| CWE-120 | Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') | 3 | 2 | 15 |
| CWE-121 | Stack-based Buffer Overflow | 8 | 5 | 18 |
| CWE-125 | Out-of-bounds Read | 1 | 1 | 2 |
| CWE-144 | Improper Neutralization of Line Delimiters | 1 | 1 | 9 |
| CWE-158 | Improper Neutralization of Null Byte or NUL Character | 1 | 1 | 4 |
| CWE-177 | Improper Handling of URL Encoding (Hex Encoding) | 1 | 1 | 6 |
| CWE-178 | Improper Handling of Case Sensitivity | 1 | 1 | 9 |
| CWE-180 | Incorrect Behavior Order: Validate Before Canonicalize | 2 | 2 | 10 |
| CWE-183 | Permissive List of Allowed Inputs | 4 | 4 | 24 |
| CWE-184 | Incomplete List of Disallowed Inputs | 11 | 11 | 40 |
| CWE-185 | Incorrect Regular Expression | 1 | 1 | 12 |
| CWE-187 | Partial String Comparison | 1 | 1 | 9 |
| CWE-189 | Numeric Errors | 1 | 1 | 5 |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | 114 | 103 | 94 |
| CWE-201 | Insertion of Sensitive Information Into Sent Data | 1 | 1 | 3 |
| CWE-203 | Observable Discrepancy | 1 | 1 | 2 |
| CWE-206 | Observable Internal Behavioral Discrepancy | 1 | 1 | 3 |
| CWE-209 | Generation of Error Message Containing Sensitive Information | 4 | 4 | 13 |
| CWE-233 | Improper Handling of Parameters | 1 | 1 | 3 |
| CWE-250 | Execution with Unnecessary Privileges | 2 | 2 | 12 |
| CWE-252 | Unchecked Return Value | 1 | 1 | 1 |
| CWE-253 | Incorrect Check of Function Return Value | 1 | 1 | 9 |
| CWE-255 | Credentials Management Errors | 12 | 11 | 18 |
| CWE-259 | Use of Hard-coded Password | 3 | 3 | 4 |
| CWE-264 | Permissions, Privileges, and Access Controls | 31 | 27 | 46 |
| CWE-266 | Incorrect Privilege Assignment | 5 | 5 | 26 |
| CWE-269 | Improper Privilege Management | 29 | 27 | 61 |
| CWE-276 | Incorrect Default Permissions | 3 | 2 | 13 |
| CWE-284 | Improper Access Control | 132 | 110 | 72 |
| CWE-285 | Improper Authorization | 16 | 16 | 47 |
| CWE-287 | Improper Authentication | 75 | 71 | 86 |
| CWE-288 | Authentication Bypass Using an Alternate Path or Channel | 15 | 14 | 39 |
| CWE-289 | Authentication Bypass by Alternate Name | 1 | 1 | 1 |
| CWE-290 | Authentication Bypass by Spoofing | 4 | 4 | 12 |
| CWE-294 | Authentication Bypass by Capture-replay | 1 | 1 | 2 |
| CWE-295 | Improper Certificate Validation | 2 | 1 | 22 |
| CWE-303 | Incorrect Implementation of Authentication Algorithm | 2 | 2 | 6 |
| CWE-305 | Authentication Bypass by Primary Weakness | 3 | 3 | 17 |
| CWE-306 | Missing Authentication for Critical Function | 111 | 102 | 101 |
| CWE-310 | Cryptographic Issues | 5 | 3 | 9 |
| CWE-312 | Cleartext Storage of Sensitive Information | 2 | 2 | 3 |
| CWE-319 | Cleartext Transmission of Sensitive Information | 2 | 2 | 5 |
| CWE-321 | Use of Hard-coded Cryptographic Key | 1 | 1 | 9 |
| CWE-326 | Inadequate Encryption Strength | 3 | 2 | 5 |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | 4 | 4 | 15 |
| CWE-330 | Use of Insufficiently Random Values | 1 | 1 | 4 |
| CWE-345 | Insufficient Verification of Data Authenticity | 9 | 9 | 23 |
| CWE-346 | Origin Validation Error | 3 | 3 | 7 |
| CWE-350 | Reliance on Reverse DNS Resolution for a Security-Critical Action | 3 | 3 | 18 |
| CWE-352 | Cross-Site Request Forgery (CSRF) | 50 | 49 | 84 |
| CWE-359 | Exposure of Private Personal Information to an Unauthorized Actor | 1 | 1 | 3 |
| CWE-361 | 7PK - Time and State | 1 | 1 | 7 |
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | 2 | 2 | 5 |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | 14 | 13 | 12 |
| CWE-384 | Session Fixation | 2 | 2 | 10 |
| CWE-399 | Resource Management Errors | 3 | 3 | 3 |
| CWE-400 | Uncontrolled Resource Consumption | 4 | 4 | 8 |
| CWE-416 | Use After Free | 5 | 3 | 5 |
| CWE-420 | Unprotected Alternate Channel | 1 | 1 | 1 |
| CWE-424 | Improper Protection of Alternate Path | 2 | 1 | 4 |
| CWE-425 | Direct Request ('Forced Browsing') | 9 | 9 | 26 |
| CWE-427 | Uncontrolled Search Path Element | 2 | 2 | 5 |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | 361 | 327 | 105 |
| CWE-436 | Interpretation Conflict | 2 | 2 | 16 |
| CWE-441 | Unintended Proxy or Intermediary ('Confused Deputy') | 7 | 7 | 16 |
| CWE-444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') | 10 | 9 | 31 |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | 11 | 10 | 26 |
| CWE-472 | External Control of Assumed-Immutable Web Parameter | 2 | 2 | 4 |
| CWE-473 | PHP External Variable Modification | 1 | 1 | 2 |
| CWE-489 | Active Debug Code | 3 | 3 | 5 |
| CWE-494 | Download of Code Without Integrity Check | 3 | 3 | 18 |
| CWE-497 | Exposure of Sensitive System Information to an Unauthorized Control Sphere | 3 | 2 | 7 |
| CWE-501 | Trust Boundary Violation | 1 | 1 | 12 |
| CWE-502 | Deserialization of Untrusted Data | 96 | 87 | 75 |
| CWE-521 | Weak Password Requirements | 1 | 1 | 10 |
| CWE-522 | Insufficiently Protected Credentials | 9 | 8 | 12 |
| CWE-532 | Insertion of Sensitive Information into Log File | 6 | 6 | 9 |
| CWE-534 | DEPRECATED: Information Exposure Through Debug Log Files | 1 | 1 | 3 |
| CWE-538 | Insertion of Sensitive Information into Externally-Accessible File or Directory | 2 | 2 | 2 |
| CWE-551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization | 1 | 1 | 1 |
| CWE-552 | Files or Directories Accessible to External Parties | 22 | 21 | 24 |
| CWE-564 | SQL Injection: Hibernate | 1 | 1 | 12 |
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | 109 | 94 | 40 |
| CWE-602 | Client-Side Enforcement of Server-Side Security | 2 | 2 | 4 |
| CWE-610 | Externally Controlled Reference to a Resource in Another Sphere | 8 | 6 | 24 |
| CWE-611 | Improper Restriction of XML External Entity Reference | 48 | 42 | 42 |
| CWE-625 | Permissive Regular Expression | 3 | 3 | 20 |
| CWE-639 | Authorization Bypass Through User-Controlled Key | 11 | 11 | 36 |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | 2 | 2 | 12 |
| CWE-641 | Improper Restriction of Names for Files and Other Resources | 1 | 1 | 12 |
| CWE-642 | External Control of Critical State Data | 1 | 1 | 4 |
| CWE-644 | Improper Neutralization of HTTP Headers for Scripting Syntax | 2 | 2 | 13 |
| CWE-647 | Use of Non-Canonical URL Paths for Authorization Decisions | 1 | 1 | 1 |
| CWE-665 | Improper Initialization | 2 | 2 | 7 |
| CWE-668 | Exposure of Resource to Wrong Sphere | 4 | 4 | 12 |
| CWE-669 | Incorrect Resource Transfer Between Spheres | 2 | 2 | 13 |
| CWE-674 | Uncontrolled Recursion | 1 | 1 | 6 |
| CWE-693 | Protection Mechanism Failure | 5 | 4 | 22 |
| CWE-697 | Incorrect Comparison | 4 | 4 | 17 |
| CWE-698 | Execution After Redirect (EAR) | 2 | 2 | 6 |
| CWE-704 | Incorrect Type Conversion or Cast | 1 | 1 | 4 |
| CWE-705 | Incorrect Control Flow Scoping | 1 | 1 | 5 |
| CWE-706 | Use of Incorrectly-Resolved Name or Reference | 6 | 6 | 10 |
| CWE-707 | Improper Neutralization | 3 | 2 | 2 |
| CWE-732 | Incorrect Permission Assignment for Critical Resource | 9 | 9 | 33 |
| CWE-749 | Exposed Dangerous Method or Function | 4 | 3 | 28 |
| CWE-755 | Improper Handling of Exceptional Conditions | 3 | 2 | 7 |
| CWE-770 | Allocation of Resources Without Limits or Throttling | 2 | 2 | 7 |
| CWE-776 | Improper Restriction of Recursive Entity References in DTDs ('XML Entity Expansion') | 2 | 2 | 9 |
| CWE-787 | Out-of-bounds Write | 10 | 9 | 20 |
| CWE-791 | Incomplete Filtering of Special Elements | 4 | 4 | 13 |
| CWE-798 | Use of Hard-coded Credentials | 22 | 22 | 66 |
| CWE-824 | Access of Uninitialized Pointer | 3 | 2 | 8 |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | 16 | 14 | 33 |
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | 1 | 1 | 12 |
| CWE-836 | Use of Password Hash Instead of Password for Authentication | 1 | 1 | 14 |
| CWE-862 | Missing Authorization | 62 | 58 | 77 |
| CWE-863 | Incorrect Authorization | 25 | 25 | 49 |
| CWE-913 | Improper Control of Dynamically-Managed Code Resources | 6 | 6 | 23 |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | 5 | 5 | 30 |
| CWE-916 | Use of Password Hash With Insufficient Computational Effort | 1 | 1 | 8 |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') | 12 | 10 | 27 |
| CWE-918 | Server-Side Request Forgery (SSRF) | 616 | 438 | 94 |
| CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | 3 | 3 | 15 |
| CWE-1021 | Improper Restriction of Rendered UI Layers or Frames | 1 | 1 | 1 |
| CWE-1188 | Initialization of a Resource with an Insecure Default | 10 | 10 | 43 |
| CWE-1220 | Insufficient Granularity of Access Control | 1 | 1 | 4 |
| CWE-1258 | Exposure of Sensitive System Information Due to Uncleared Debug Information | 1 | 1 | 1 |
| CWE-1284 | Improper Validation of Specified Quantity in Input | 3 | 3 | 17 |
| CWE-1286 | Improper Validation of Syntactic Correctness of Input | 1 | 1 | 6 |
| CWE-1287 | Improper Validation of Specified Type of Input | 2 | 2 | 5 |
| CWE-1289 | Improper Validation of Unsafe Equivalence in Input | 1 | 1 | 1 |
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | 4 | 4 | 23 |
| CWE-1325 | Improperly Controlled Sequential Memory Allocation | 2 | 1 | 4 |
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | 22 | 20 | 41 |
| CWE-1385 | Missing Origin Validation in WebSockets | 1 | 1 | 1 |
| CWE-1389 | Incorrect Parsing of Numbers with Different Radices | 1 | 1 | 7 |
| CWE-1390 | Weak Authentication | 1 | 1 | 1 |
| CWE-1391 | Use of Weak Credentials | 1 | 1 | 1 |
| CWE-1392 | Use of Default Credentials | 1 | 1 | 12 |
| CWE-1393 | Use of Default Password | 1 | 1 | 6 |