Types of Weaknesses

These are the list of weakness types on HackerOne that you can choose from when submitting a report:

External ID Weakness Type Description
CWE-770 Allocation of Resources Without Limits or Throttling The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on how many resources can be allocated, in violation of the intended security policy for that actor.
CWE-129 Array Index Underflow The product uses untrusted input when calculating or using an array index, but the product does not validate or incorrectly validates the index to ensure the index references a valid position within the array.
CWE-288 Authentication Bypass Using an Alternate Path or Channel A product requires authentication, but the product has an alternate path or channel that does not require authentication.
CWE-307 Brute Force The software does not implement sufficient measures to prevent multiple failed authentication attempts within in a short time frame, making it more susceptible to brute force attacks.
CWE-126 Buffer Over-read The software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations after the targeted buffer.
CWE-124 Buffer Underflow The software writes to a buffer using an index or pointer that references a memory location prior to the beginning of the buffer.
CWE-127 Buffer Under-read The software reads from a buffer using buffer access mechanisms such as indexes or pointers that reference memory locations prior to the targeted buffer.
CWE-840 Business Logic Errors Weaknesses in this category identify some of the underlying problems that commonly allow attackers to manipulate the business logic of an application.
CWE-120 Classic Buffer Overflow The program copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
CWE-312 Cleartext Storage of Sensitive Information The application stores sensitive information in cleartext within a resource that might be accessible to another control sphere.
CWE-319 Cleartext Transmission of Sensitive Information The software transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
CWE-602 Client-Side Enforcement of Server-Side Security The software is composed of a server that relies on the client to implement a mechanism that is intended to protect the server.
CWE-94 Code Injection The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
CWE-77 Command Injection - Generic The software constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') The program contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.
CWE-93 CRLF Injection The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.
CWE-352 Cross-Site Request Forgery (CSRF) The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CWE-79 Cross-site Scripting (XSS) - DOM In DOM-based XSS, the client performs the injection of XSS into the page; in the other types, the server performs the injection. DOM-based XSS generally involves server-controlled, trusted script that is sent to the client, such as Javascript that performs sanity checks on a form before the user submits it. If the server-supplied script processes user-supplied data and then injects it back into the web page (such as with dynamic HTML), then DOM-based XSS is possible.
CWE-79 Cross-site Scripting (XSS) - Generic The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-79 Cross-site Scripting (XSS) - Reflected The server reads data directly from the HTTP request and reflects it back in the HTTP response. Reflected XSS exploits occur when an attacker causes a victim to supply dangerous content to a vulnerable web application, which is then reflected back to the victim and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to the victim. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces a victim to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the victim, the content is executed by the victim's browser.
CWE-79 Cross-site Scripting (XSS) - Stored The application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content. From an attacker's perspective, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. For example, the attacker might inject XSS into a log message, which might not be handled properly when an administrator views the logs.
CWE-310 Cryptographic Issues - Generic Weaknesses in this category are related to the use of cryptography.
CWE-400 Denial of Service The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.
CWE-502 Deserialization of Untrusted Data The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
CWE-415 Double Free The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.
CWE-506 Embedded Malicious Code The application contains code that appears to be malicious in nature.
CWE-749 Exposed Dangerous Method or Function The software provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
CWE-642 External Control of Critical State Data The software stores security-critical state information about its users, or the software itself, in a location that is accessible to unauthorized actors.
CWE-610 Externally Controlled Reference to a Resource in Another Sphere The product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) The software does not adequately filter user-controlled input for special elements with control implications.
CWE-538 File and Directory Information Exposure The product stores sensitive information in files or directories that are accessible to actors outside of the intended control sphere.
CWE-425 Forced Browsing The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
CWE-122 Heap Overflow A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc().
CWE-444 HTTP Request Smuggling When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being aware of it.
CWE-113 HTTP Response Splitting The software receives data from an upstream component, but does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.
CWE-284 Improper Access Control - Generic The software does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
CWE-287 Improper Authentication - Generic When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.
CWE-285 Improper Authorization The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
CWE-295 Improper Certificate Validation The software does not validate, or incorrectly validates, a certificate.
CWE-703 Improper Check or Handling of Exceptional Conditions The software does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the software.
CWE-926 Improper Export of Android Application Components The Android application exports a component for use by other applications, but does not properly restrict which applications can launch the component or access the data it contains.
CWE-296 Improper Following of a Certificate's Chain of Trust The software does not follow, or incorrectly follows, the chain of trust for a certificate back to a trusted root certificate, resulting in incorrect trust of any resource that is associated with that certificate.
CWE-409 Improper Handling of Highly Compressed Data (Data Amplification) The software does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
CWE-280 Improper Handling of Insufficient Permissions or Privileges The application does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the application in an invalid state.
CWE-177 Improper Handling of URL Encoding (Hex Encoding) The software does not properly handle when all or part of an input has been URL encoded.
CWE-20 Improper Input Validation The product does not validate or incorrectly validates input that can affect the control flow or data flow of a program.
CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could be interpreted as escape, meta, or control character sequences when they are sent to a downstream component.
CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax The application does not neutralize or incorrectly neutralizes web scripting syntax in HTTP headers that can be used by web browser components that can process raw headers, such as Flash.
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CWE-170 Improper Null Termination The software does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.
CWE-269 Improper Privilege Management The software does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
CWE-326 Inadequate Encryption Strength The software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CWE-184 Incomplete Denylist An application uses a "denylist" of prohibited values, but the denylist is incomplete.
CWE-863 Incorrect Authorization The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CWE-131 Incorrect Calculation of Buffer Size The software does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.
CWE-697 Incorrect Comparison The software compares two entities in a security-relevant context, but the comparison is incorrect, which may lead to resultant weaknesses.
CWE-200 Information Disclosure An information disclosure is the intentional or unintentional disclosure of information to an actor that is not explicitly authorized to have access to that information.
CWE-209 Information Exposure Through an Error Message The software generates an error message that includes sensitive information about its environment, users, or associated data.
CWE-215 Information Exposure Through Debug Information The application contains debugging code that can expose sensitive information to untrusted parties.
CWE-548 Information Exposure Through Directory Listing A directory listing is inappropriately exposed, yielding potentially sensitive information to attackers.
CWE-203 Information Exposure Through Discrepancy The product behaves differently or sends different responses in a way that exposes security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-201 Information Exposure Through Sent Data The accidental exposure of sensitive information through sent data refers to the transmission of data which are either sensitive in and of itself or useful in the further exploitation of the system through standard data channels.
CWE-208 Information Exposure Through Timing Discrepancy Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.
CWE-639 Insecure Direct Object Reference (IDOR) The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
CWE-922 Insecure Storage of Sensitive Information The software stores sensitive information without properly limiting read or write access by unauthorized actors.
CWE-377 Insecure Temporary File Creating and using insecure temporary files can leave application and system data vulnerable to attack.
CWE-522 Insufficiently Protected Credentials This weakness occurs when the application transmits or stores authentication credentials and uses an insecure method that is susceptible to unauthorized interception and/or retrieval.
CWE-613 Insufficient Session Expiration According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."
CWE-190 Integer Overflow The software performs a calculation that can produce an integer overflow or wraparound, when the logic assumes that the resulting value will always be larger than the original value. This can introduce other weaknesses when the calculation is used for resource management or execution control.
CWE-191 Integer Underflow The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
CWE-322 Key Exchange without Entity Authentication The software performs a key exchange with an actor without verifying the identity of that actor.
CWE-90 LDAP Injection The software constructs all or part of an LDAP query using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended LDAP query when it is sent to a downstream component.
CWE-489 Leftover Debug Code (Backdoor) The application was deployed with active debugging code that can create unintended entry points.
capec-549 Malware An adversary installs and executes malicious code on the target system in an effort to achieve a negative technical impact.
CWE-300 Man-in-the-Middle The product does not adequately verify the identity of actors at both ends of a communication channel, or does not adequately ensure the integrity of the channel, in a way that allows the channel to be accessed or influenced by an actor that is not an endpoint.
CWE-119 Memory Corruption - Generic The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.
CWE-311 Missing Encryption of Sensitive Data The software does not encrypt sensitive or critical information before storage or transmission.
CWE-325 Missing Required Cryptographic Step The software does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than advertised by that algorithm.
CWE-471 Modification of Assumed-Immutable Data (MAID) The software does not properly protect an assumed-immutable element from being modified by an attacker.
CWE-476 NULL Pointer Dereference A NULL pointer dereference occurs when the application dereferences a pointer that it expects to be valid, but is NULL, typically causing a crash or exit.
CWE-193 Off-by-one Error A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
CWE-601 Open Redirect A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks.
CWE-78 OS Command Injection The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CWE-125 Out-of-bounds Read The software reads data past the end, or before the beginning, of the intended buffer.
CWE-260 Password in Configuration File The software stores a password in a configuration file that might be accessible to actors who do not know the password.
CWE-22 Path Traversal The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CWE-35 Path Traversal: '.../...//' The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize '.../...//' (doubled triple dot slash) sequences that can resolve to a location that is outside of that directory.
capec-98 Phishing Phishing is a social engineering technique where an attacker masquerades as a legitimate entity with which the victim might do business in order to prompt the user to reveal some confidential information (very frequently authentication credentials) that can later be used by an attacker. Phishing is essentially a form of information gathering or "fishing" for information.
CWE-256 Plaintext Storage of a Password Storing a password in plaintext may result in a system compromise.
CWE-359 Privacy Violation The software does not properly prevent private data (such as credit card numbers) from being accessed by actors who either (1) are not explicitly authorized to access the data or (2) do not have the implicit consent of the people to which the data is related.
capec-233 Privilege Escalation An adversary exploits a weakness enabling them to elevate their privilege and perform an action that they are not supposed to be authorized to perform.
CWE-23 Relative Path Traversal The software uses external input to construct a pathname that should be within a restricted directory, but it does not properly neutralize sequences such as ".." that can resolve to a location that is outside of that directory.
CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision The application uses a protection mechanism that relies on the existence or values of a cookie, but it does not properly ensure that the cookie is valid for the associated user.
CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action The software performs reverse DNS resolution on an IP address to obtain the hostname and make a security decision, but it does not properly ensure that the IP address is truly associated with the hostname.
CWE-807 Reliance on Untrusted Inputs in a Security Decision The application uses a protection mechanism that relies on the existence or values of an input, but the input can be modified by an untrusted actor in a way that bypasses the protection mechanism.
CWE-98 Remote File Inclusion The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.
CWE-509 Replicating Malicious Code (Virus or Worm) Replicating malicious code, including viruses and worms, will attempt to attack other systems once it has successfully compromised the target system or software.
CWE-99 Resource Injection The software receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.
CWE-323 Reusing a Nonce, Key Pair in Encryption Nonces should be used for the present occasion and only once.
CWE-328 Reversible One-Way Hash The product uses a hashing algorithm that produces a hash value that can be used to determine the original input, or to find an input that can produce the same hash, more efficiently than brute force techniques.
CWE-656 Security Through Obscurity The software uses a protection mechanism whose strength depends heavily on its obscurity, such that knowledge of its algorithms or key data is sufficient to defeat the mechanism.
CWE-918 Server-Side Request Forgery (SSRF) The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.
CWE-384 Session Fixation Authenticating a user, or otherwise establishing a new user session, without invalidating any existing session identifier gives an attacker the opportunity to steal authenticated sessions.
CWE-89 SQL Injection The software constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component.
CWE-121 Stack Overflow A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
CWE-257 Storing Passwords in a Recoverable Format The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.
CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition The software checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check. This can cause the software to perform invalid actions when the resource is in an unexpected state.
CWE-360 Trust of System Event Data Security based on event locations are insecure and can be spoofed.
CWE-843 Type Confusion The program allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.
capec-103 UI Redressing (Clickjacking) In a clickjacking attack the victim is tricked into unknowingly initiating some action in one system while interacting with the UI from seemingly completely different system.
CWE-391 Unchecked Error Condition Ignoring exceptions and other error conditions may allow an attacker to induce unexpected behavior unnoticed.
CWE-674 Uncontrolled Recursion The product does not properly control the amount of recursion that takes place, which consumes excessive resources, such as allocated memory or the program stack.
CWE-523 Unprotected Transport of Credentials Login pages not using adequate measures to protect the user name and password while they are in transit from the client to the server.
CWE-426 Untrusted Search Path The application searches for critical resources using an externally-supplied search path that can point to resources that are not under the application's direct control.
CWE-620 Unverified Password Change When setting a new password for a user, the product does not require knowledge of the original password, or using another form of authentication.
CWE-416 Use After Free Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.
CWE-327 Use of a Broken or Risky Cryptographic Algorithm The use of a broken or risky cryptographic algorithm is an unnecessary risk that may result in the exposure of sensitive information.
CWE-324 Use of a Key Past its Expiration Date The product uses a cryptographic key or password past its expiration date, which diminishes its safety significantly by increasing the timing window for cracking attacks against that key.
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG is not cryptographically strong.
CWE-134 Use of Externally-Controlled Format String The software uses a function that accepts a format string as an argument, but the format string originates from an external source.
CWE-798 Use of Hard-coded Credentials The software contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data.
CWE-321 Use of Hard-coded Cryptographic Key The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.
CWE-259 Use of Hard-coded Password The software contains a hard-coded password, which it uses for its own inbound authentication or for outbound communication to external components.
CWE-242 Use of Inherently Dangerous Function The program calls a function that can never be guaranteed to work safely.
CWE-330 Use of Insufficiently Random Values The software may use insufficiently random numbers or values in a security context that depends on unpredictable numbers.
CWE-451 User Interface (UI) Misrepresentation of Critical Information The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
CWE-657 Violation of Secure Design Principles The product violates well-established principles for secure design.
CWE-261 Weak Cryptography for Passwords Obscuring a password with a trivial encoding does not protect the password.
CWE-640 Weak Password Recovery Mechanism for Forgotten Password The software contains a mechanism for users to recover or change their passwords without knowing the original password, but the mechanism is weak.
CWE-128 Wrap-around Error Wrap around errors occur whenever a value is incremented past the maximum value for its type and therefore "wraps around" to a very small, negative, or undefined value.
CWE-123 Write-what-where Condition Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.
CWE-776 XML Entity Expansion The software uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.
CWE-611 XML External Entities (XXE) The software processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.
CWE-91 XML Injection The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system.
CAPEC-209 XSS Using MIME Type Mismatch An adversary creates a file with scripting content but where the specified MIME type of the file is such that scripting is not expected. The adversary tricks the victim into accessing a URL that responds with the script file. Some browsers will detect that the specified MIME type of the file does not match the actual type of its content and will automatically switch to using an interpreter for the real content type. If the browser does not invoke script filters before doing this, the adversary's script may run on the target unsanitized, possibly revealing the victim's cookies or executing arbitrary script in their browser.