| MemberOf |  Category - a CWE entry that contains a set of other entries that share a common characteristic. | 896 | SFP Primary Cluster: Tainted Input |
| HasMember |  Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness. | 74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness. | 75 | Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) |
| HasMember |  Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 76 | Improper Neutralization of Equivalent Special Elements |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness. | 77 | Improper Neutralization of Special Elements used in a Command ('Command Injection') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 78 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| HasMember |  Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 80 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 81 | Improper Neutralization of Script in an Error Message Web Page |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 82 | Improper Neutralization of Script in Attributes of IMG Tags in a Web Page |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 83 | Improper Neutralization of Script in Attributes in a Web Page |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 84 | Improper Neutralization of Encoded URI Schemes in a Web Page |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 85 | Doubled Character XSS Manipulations |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 86 | Improper Neutralization of Invalid Characters in Identifiers in Web Pages |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 87 | Improper Neutralization of Alternate XSS Syntax |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 88 | Argument Injection or Modification |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 90 | Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 91 | XML Injection (aka Blind XPath Injection) |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 95 | Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 96 | Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 97 | Improper Neutralization of Server-Side Includes (SSI) Within a Web Page |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 99 | Improper Control of Resource Identifiers ('Resource Injection') |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 102 | Struts: Duplicate Validation Forms |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 103 | Struts: Incomplete validate() Method Definition |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 104 | Struts: Form Bean Does Not Extend Validation Class |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 105 | Struts: Form Field Without Validator |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 106 | Struts: Plug-in Framework not in Use |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 107 | Struts: Unused Validation Form |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 108 | Struts: Unvalidated Action Form |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 109 | Struts: Validator Turned Off |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 110 | Struts: Validator Without Form Field |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 112 | Missing XML Validation |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 130 | Improper Handling of Length Parameter Inconsistency |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 134 | Use of Externally-Controlled Format String |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness. | 138 | Improper Neutralization of Special Elements |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 140 | Improper Neutralization of Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 141 | Improper Neutralization of Parameter/Argument Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 142 | Improper Neutralization of Value Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 143 | Improper Neutralization of Record Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 144 | Improper Neutralization of Line Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 145 | Improper Neutralization of Section Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 146 | Improper Neutralization of Expression/Command Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 147 | Improper Neutralization of Input Terminators |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 148 | Improper Neutralization of Input Leaders |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 149 | Improper Neutralization of Quoting Syntax |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 150 | Improper Neutralization of Escape, Meta, or Control Sequences |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 151 | Improper Neutralization of Comment Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 152 | Improper Neutralization of Macro Symbols |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 153 | Improper Neutralization of Substitution Characters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 154 | Improper Neutralization of Variable Name Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 155 | Improper Neutralization of Wildcards or Matching Symbols |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 156 | Improper Neutralization of Whitespace |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 157 | Failure to Sanitize Paired Delimiters |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 158 | Improper Neutralization of Null Byte or NUL Character |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness. | 159 | Failure to Sanitize Special Element |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 160 | Improper Neutralization of Leading Special Elements |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 161 | Improper Neutralization of Multiple Leading Special Elements |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 162 | Improper Neutralization of Trailing Special Elements |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 163 | Improper Neutralization of Multiple Trailing Special Elements |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 164 | Improper Neutralization of Internal Special Elements |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 165 | Improper Neutralization of Multiple Internal Special Elements |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 183 | Permissive Whitelist |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 184 | Incomplete Blacklist |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness. | 185 | Incorrect Regular Expression |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 186 | Overly Restrictive Regular Expression |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 444 | Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 553 | Command Shell in Externally Accessible Directory |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 554 | ASP.NET Misconfiguration: Not Using Input Validation Framework |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 564 | SQL Injection: Hibernate |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 601 | URL Redirection to Untrusted Site ('Open Redirect') |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 611 | Improper Restriction of XML External Entity Reference ('XXE') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 619 | Dangling Database Cursor ('Cursor Injection') |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 621 | Variable Extraction Error |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 624 | Executable Regular Expression Error |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 625 | Permissive Regular Expression |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 626 | Null Byte Interaction Error (Poison Null Byte) |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 627 | Dynamic Variable Evaluation |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 641 | Improper Restriction of Names for Files and Other Resources |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 643 | Improper Neutralization of Data within XPath Expressions ('XPath Injection') |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 644 | Improper Neutralization of HTTP Headers for Scripting Syntax |
| HasMember | Variant - a weakness that is described at a very low level of detail, typically limited to a specific language or technology. More specific than a Base weakness. | 646 | Reliance on File Name or Extension of Externally-Supplied File |
| HasMember | Base - a weakness that is described in an abstract fashion, but with sufficient details to infer specific methods for detection and prevention. More general than a Variant weakness, but more specific than a Class weakness. | 652 | Improper Neutralization of Data within XQuery Expressions ('XQuery Injection') |
| HasMember | Class - a weakness that is described in a very abstract fashion, typically independent of any specific language or technology. More general than a Base weakness. | 707 | Improper Enforcement of Message or Data Structure |
Summary
Content History
