2492
Nature Type ID Name Page
HasMember 235 Improper Handling of Extra Parameters 1344 578
HasMember 256 Plaintext Storage of a Password 1344 615
HasMember 257 Storing Passwords in a Recoverable Format 1344 618
HasMember 266 Incorrect Privilege Assignment 1344 638
HasMember 269 Improper Privilege Management 1344 646
HasMember 280 Improper Handling of Insufficient Permissions or
Privileges
1344 672
HasMember 311 Missing Encryption of Sensitive Data 1344 757
HasMember 312 Cleartext Storage of Sensitive Information 1344 764
HasMember 313 Cleartext Storage in a File or on Disk 1344 770
HasMember 316 Cleartext Storage of Sensitive Information in Memory 1344 775
HasMember 419 Unprotected Primary Channel 1344 1017
HasMember 430 Deployment of Wrong Handler 1344 1042
HasMember 434 Unrestricted Upload of File with Dangerous Type 1344 1048
HasMember 444 Inconsistent Interpretation of HTTP Requests ('HTTP
Request/Response Smuggling')
1344 1068
HasMember 451 User Interface (UI) Misrepresentation of Critical
Information
1344 1079
HasMember 472 External Control of Assumed-Immutable Web
Parameter
1344 1123
HasMember 501 Trust Boundary Violation 1344 1203
HasMember 522 Insufficiently Protected Credentials 1344 1225
HasMember 525 Use of Web Browser Cache Containing Sensitive
Information
1344 1233
HasMember 539 Use of Persistent Cookies Containing Sensitive
Information
1344 1250
HasMember 579 J2EE Bad Practices: Non-serializable Object Stored in
Session
1344 1309
HasMember 598 Use of GET Request Method With Sensitive Query
Strings
1344 1340
HasMember 602 Client-Side Enforcement of Server-Side Security 1344 1350
HasMember 642 External Control of Critical State Data 1344 1414
HasMember 646 Reliance on File Name or Extension of Externally-
Supplied File
1344 1425
HasMember 650 Trusting HTTP Permission Methods on the Server Side 1344 1432
HasMember 653 Improper Isolation or Compartmentalization 1344 1437
HasMember 656 Reliance on Security Through Obscurity 1344 1444
HasMember 657 Violation of Secure Design Principles 1344 1446
HasMember 799 Improper Control of Interaction Frequency 1344 1699
HasMember 807 Reliance on Untrusted Inputs in a Security Decision 1344 1714
HasMember 840 Business Logic Errors 1344 2360
HasMember 841 Improper Enforcement of Behavioral Workflow 1344 1772
HasMember 927 Use of Implicit Intent for Sensitive Communication 1344 1836
HasMember 1021 Improper Restriction of Rendered UI Layers or Frames 1344 1860
HasMember 1173 Improper Use of Validation Framework 1344 1969
Notes
Maintenance
As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings
cited in the 2021 OWASP Top Ten. These mappings include categories, which are discouraged
CWE Version 4.14
CWE-1349: OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration
CWE-1349: OWASP Top Ten 2021 Category A05:2021 - Security Misconfiguration