2495
Nature Type ID Name Page
MemberOf 1344 Weaknesses in OWASP Top Ten (2021) 1344 2593
HasMember 255 Credentials Management Errors 1344 2315
HasMember 259 Use of Hard-coded Password 1344 623
HasMember 287 Improper Authentication 1344 692
HasMember 288 Authentication Bypass Using an Alternate Path or
Channel
1344 700
HasMember 290 Authentication Bypass by Spoofing 1344 705
HasMember 294 Authentication Bypass by Capture-replay 1344 712
HasMember 295 Improper Certificate Validation 1344 714
HasMember 297 Improper Validation of Certificate with Host Mismatch 1344 722
HasMember 300 Channel Accessible by Non-Endpoint 1344 730
HasMember 302 Authentication Bypass by Assumed-Immutable Data 1344 735
HasMember 304 Missing Critical Step in Authentication 1344 738
HasMember 306 Missing Authentication for Critical Function 1344 741
HasMember 307 Improper Restriction of Excessive Authentication
Attempts
1344 747
HasMember 346 Origin Validation Error 1344 853
HasMember 384 Session Fixation 1344 936
HasMember 521 Weak Password Requirements 1344 1223
HasMember 613 Insufficient Session Expiration 1344 1371
HasMember 620 Unverified Password Change 1344 1383
HasMember 640 Weak Password Recovery Mechanism for Forgotten
Password
1344 1409
HasMember 798 Use of Hard-coded Credentials 1344 1690
HasMember 940 Improper Verification of Source of a Communication
Channel
1344 1842
HasMember 1216 Lockout Mechanism Errors 1344 2478
Notes
Maintenance
As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings
cited in the 2021 OWASP Top Ten. These mappings include categories, which are discouraged
for mapping, as well as high-level weaknesses. The CWE Program will work with OWASP to
improve these mappings, possibly requiring modifications to CWE itself.
References
[REF-1213]"A07:2021 - Identification and Authentication Failures". 2021 September 4. OWASP. <
https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ >.
[REF-1206]"OWASP Top 10:2021". 2021 September 4. OWASP. < https://owasp.org/Top10/ >.
Category-1354: OWASP Top Ten 2021 Category A08:2021 - Software and Data
Integrity Failures
Category ID : 1354
Summary
Weaknesses in this category are related to the A08 category "Software and Data Integrity Failures"
in the OWASP Top Ten 2021.
Membership
CWE Version 4.14
CWE-1355: OWASP Top Ten 2021 Category A09:2021 - Security Logging and Monitoring Failures
CWE-1355: OWASP Top Ten 2021 Category
A09:2021 - Security Logging and Monitoring Failures 2496
Nature Type ID Name Page
MemberOf 1344 Weaknesses in OWASP Top Ten (2021) 1344 2593
HasMember 345 Insufficient Verification of Data Authenticity 1344 851
HasMember 353 Missing Support for Integrity Check 1344 874
HasMember 426 Untrusted Search Path 1344 1028
HasMember 494 Download of Code Without Integrity Check 1344 1185
HasMember 502 Deserialization of Untrusted Data 1344 1204
HasMember 565 Reliance on Cookies without Validation and Integrity
Checking
1344 1283
HasMember 784 Reliance on Cookies without Validation and Integrity
Checking in a Security Decision
1344 1653
HasMember 829 Inclusion of Functionality from Untrusted Control Sphere 1344 1741
HasMember 830 Inclusion of Web Functionality from an Untrusted
Source
1344 1747
HasMember 915 Improperly Controlled Modification of Dynamically-
Determined Object Attributes
1344 1809
Notes
Maintenance
As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings
cited in the 2021 OWASP Top Ten. The CWE Program will work with OWASP to improve these
mappings, possibly requiring modifications to CWE itself.
References
[REF-1214]"A08:2021 - Software and Data Integrity Failures". 2021 September 4. OWASP. <
https://owasp.org/Top10/A08_2021-Software_and_Data_Integrity_Failures/ >.
[REF-1206]"OWASP Top 10:2021". 2021 September 4. OWASP. < https://owasp.org/Top10/ >.
Category-1355: OWASP Top Ten 2021 Category A09:2021 - Security Logging
and Monitoring Failures
Category ID : 1355
Summary
Weaknesses in this category are related to the A09 category "Security Logging and Monitoring
Failures" in the OWASP Top Ten 2021.
Membership
Nature Type ID Name Page
MemberOf 1344 Weaknesses in OWASP Top Ten (2021) 1344 2593
HasMember 117 Improper Output Neutralization for Logs 1344 288
HasMember 223 Omission of Security-relevant Information 1344 559
HasMember 532 Insertion of Sensitive Information into Log File 1344 1241
HasMember 778 Insufficient Logging 1344 1638
Notes
Maintenance
As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings
cited in the 2021 OWASP Top Ten. The CWE Program will work with OWASP to improve these
mappings, possibly requiring modifications to CWE itself.
CWE Version 4.14
CWE-1356: OWASP Top Ten 2021 Category A10:2021 - Server-Side Request Forgery (SSRF)
CWE-1356: OWASP Top Ten 2021 Category
A10:2021 - Server-Side Request Forgery (SSRF)