2521
Nature Type ID Name Page
HasMember 522 Insufficiently Protected Credentials 1400 1225
HasMember 523 Unprotected Transport of Credentials 1400 1230
HasMember 549 Missing Password Field Masking 1400 1262
HasMember 551 Incorrect Behavior Order: Authorization Before Parsing
and Canonicalization
1400 1264
HasMember 555 J2EE Misconfiguration: Plaintext Password in
Configuration File
1400 1270
HasMember 556 ASP.NET Misconfiguration: Use of Identity
Impersonation
1400 1271
HasMember 566 Authorization Bypass Through User-Controlled SQL
Primary Key
1400 1286
HasMember 593 Authentication Bypass: OpenSSL CTX Object Modified
after SSL Objects are Created
1400 1331
HasMember 599 Missing Validation of OpenSSL Certificate 1400 1341
HasMember 601 URL Redirection to Untrusted Site ('Open Redirect') 1400 1345
HasMember 603 Use of Client-Side Authentication 1400 1354
HasMember 611 Improper Restriction of XML External Entity Reference 1400 1367
HasMember 612 Improper Authorization of Index Containing Sensitive
Information
1400 1370
HasMember 613 Insufficient Session Expiration 1400 1371
HasMember 620 Unverified Password Change 1400 1383
HasMember 623 Unsafe ActiveX Control Marked Safe For Scripting 1400 1389
HasMember 639 Authorization Bypass Through User-Controlled Key 1400 1406
HasMember 640 Weak Password Recovery Mechanism for Forgotten
Password
1400 1409
HasMember 645 Overly Restrictive Account Lockout Mechanism 1400 1423
HasMember 647 Use of Non-Canonical URL Paths for Authorization
Decisions
1400 1426
HasMember 648 Incorrect Use of Privileged APIs 1400 1428
HasMember 708 Incorrect Ownership Assignment 1400 1548
HasMember 732 Incorrect Permission Assignment for Critical Resource 1400 1551
HasMember 798 Use of Hard-coded Credentials 1400 1690
HasMember 804 Guessable CAPTCHA 1400 1701
HasMember 836 Use of Password Hash Instead of Password for
Authentication
1400 1761
HasMember 842 Placement of User into Incorrect Group 1400 1775
HasMember 862 Missing Authorization 1400 1780
HasMember 863 Incorrect Authorization 1400 1787
HasMember 918 Server-Side Request Forgery (SSRF) 1400 1820
HasMember 921 Storage of Sensitive Data in a Mechanism without
Access Control
1400 1824
HasMember 923 Improper Restriction of Communication Channel to
Intended Endpoints
1400 1827
HasMember 925 Improper Verification of Intent by Broadcast Receiver 1400 1831
HasMember 926 Improper Export of Android Application Components 1400 1833
HasMember 927 Use of Implicit Intent for Sensitive Communication 1400 1836
HasMember 939 Improper Authorization in Handler for Custom URL
Scheme
1400 1840
HasMember 940 Improper Verification of Source of a Communication
Channel
1400 1842
CWE Version 4.14
CWE-1396: Comprehensive Categorization: Access Control
CWE-1396: Comprehensive Categorization: Access Control