2491
Nature Type ID Name Page
HasMember 113 Improper Neutralization of CRLF Sequences in HTTP
Headers ('HTTP Request/Response Splitting')
1344 271
HasMember 116 Improper Encoding or Escaping of Output 1344 281
HasMember 138 Improper Neutralization of Special Elements 1344 373
HasMember 184 Incomplete List of Disallowed Inputs 1344 459
HasMember 470 Use of Externally-Controlled Input to Select Classes or
Code ('Unsafe Reflection')
1344 1118
HasMember 471 Modification of Assumed-Immutable Data (MAID) 1344 1121
HasMember 564 SQL Injection: Hibernate 1344 1282
HasMember 610 Externally Controlled Reference to a Resource in
Another Sphere
1344 1364
HasMember 643 Improper Neutralization of Data within XPath
Expressions ('XPath Injection')
1344 1419
HasMember 644 Improper Neutralization of HTTP Headers for Scripting
Syntax
1344 1422
HasMember 652 Improper Neutralization of Data within XQuery
Expressions ('XQuery Injection')
1344 1435
HasMember 917 Improper Neutralization of Special Elements used
in an Expression Language Statement ('Expression
Language Injection')
1344 1818
Notes
Maintenance
As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings
cited in the 2021 OWASP Top Ten. These mappings include high-level Class and/or Pillar
weaknesses. The CWE Program will work with OWASP to improve these mappings, possibly
including modifications to CWE itself.
References
[REF-1209]"A03:2021 - Injection". 2021 September 4. OWASP. < https://owasp.org/Top10/
A03_2021-Injection/ >.
[REF-1206]"OWASP Top 10:2021". 2021 September 4. OWASP. < https://owasp.org/Top10/ >.
Category-1348: OWASP Top Ten 2021 Category A04:2021 - Insecure Design
Category ID : 1348
Summary
Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top
Ten 2021.
Membership
Nature Type ID Name Page
MemberOf 1344 Weaknesses in OWASP Top Ten (2021) 1344 2593
HasMember 73 External Control of File Name or Path 1344 132
HasMember 183 Permissive List of Allowed Inputs 1344 458
HasMember 209 Generation of Error Message Containing Sensitive
Information
1344 533
HasMember 213 Exposure of Sensitive Information Due to Incompatible
Policies
1344 547
CWE Version 4.14
CWE-1348: OWASP Top Ten 2021 Category A04:2021 - Insecure Design
CWE-1348: OWASP Top Ten 2021 Category A04:2021 - Insecure Design