2489
Membership
Nature Type ID Name Page
MemberOf 1344 Weaknesses in OWASP Top Ten (2021) 1344 2593
HasMember 261 Weak Encoding for Password 1344 631
HasMember 296 Improper Following of a Certificate's Chain of Trust 1344 719
HasMember 310 Cryptographic Issues 1344 2318
HasMember 319 Cleartext Transmission of Sensitive Information 1344 779
HasMember 321 Use of Hard-coded Cryptographic Key 1344 785
HasMember 322 Key Exchange without Entity Authentication 1344 788
HasMember 323 Reusing a Nonce, Key Pair in Encryption 1344 790
HasMember 324 Use of a Key Past its Expiration Date 1344 792
HasMember 325 Missing Cryptographic Step 1344 794
HasMember 326 Inadequate Encryption Strength 1344 796
HasMember 327 Use of a Broken or Risky Cryptographic Algorithm 1344 799
HasMember 328 Use of Weak Hash 1344 806
HasMember 329 Generation of Predictable IV with CBC Mode 1344 811
HasMember 330 Use of Insufficiently Random Values 1344 814
HasMember 331 Insufficient Entropy 1344 821
HasMember 335 Incorrect Usage of Seeds in Pseudo-Random Number
Generator (PRNG)
1344 829
HasMember 336 Same Seed in Pseudo-Random Number Generator
(PRNG)
1344 832
HasMember 337 Predictable Seed in Pseudo-Random Number
Generator (PRNG)
1344 834
HasMember 338 Use of Cryptographically Weak Pseudo-Random
Number Generator (PRNG)
1344 837
HasMember 340 Generation of Predictable Numbers or Identifiers 1344 842
HasMember 347 Improper Verification of Cryptographic Signature 1344 857
HasMember 523 Unprotected Transport of Credentials 1344 1230
HasMember 720 OWASP Top Ten 2007 Category A9 - Insecure
Communications
1344 2333
HasMember 757 Selection of Less-Secure Algorithm During Negotiation
('Algorithm Downgrade')
1344 1581
HasMember 759 Use of a One-Way Hash without a Salt 1344 1585
HasMember 760 Use of a One-Way Hash with a Predictable Salt 1344 1589
HasMember 780 Use of RSA Algorithm without OAEP 1344 1644
HasMember 818 OWASP Top Ten 2010 Category A9 - Insufficient
Transport Layer Protection
1344 2359
HasMember 916 Use of Password Hash With Insufficient Computational
Effort
1344 1813
Notes
Maintenance
As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings
cited in the 2021 OWASP Top Ten. These mappings include categories, which are discouraged
for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with
OWASP to improve these mappings, possibly requiring modifications to CWE itself.
References
[REF-1208]"A02:2021 - Cryptographic Failures". 2021 September 4. OWASP. < https://owasp.org/
Top10/A02_2021-Cryptographic_Failures/ >.
CWE Version 4.14
CWE-1347: OWASP Top Ten 2021 Category A03:2021 - Injection
CWE-1347: OWASP Top Ten 2021 Category A03:2021 - Injection