2576
This view uses a deep hierarchical organization, with more levels of abstraction than other
classification schemes. The top-level entries are called Pillars. Where possible, this view uses
abstractions that do not consider particular languages, frameworks, technologies, life cycle
development phases, frequency of occurrence, or types of resources. It explicitly identifies
relationships that form chains and composites, which have not been a formal part of past
classification efforts. Chains and composites might help explain why mutual exclusivity is difficult
to achieve within security error taxonomies. This view is roughly aligned with MITRE's research
into vulnerability theory, especially with respect to behaviors and resources. Ideally, this view will
only cover weakness-to-weakness relationships, with minimal overlap and zero categories. It is
expected to include at least one parent/child relationship for every weakness within CWE.
Metrics
CWEs in this view Total CWEs
Weaknesses 938 out of 938
Categories 0 out of 374
Views 0 out of 50
Total 938 out of 1362
View-1003: Weaknesses for Simplified Mapping of Published Vulnerabilities
View ID : 1003
Type : Graph
Objective
CWE entries in this view (graph) may be used to categorize potential weaknesses within sources
that handle public, third-party vulnerability information, such as the National Vulnerability Database
(NVD). By design, this view is incomplete. It is limited to a small number of the most commonlyseen
weaknesses, so that it is easier for humans to use. This view uses a shallow hierarchy of two
levels in order to simplify the complex navigation of the entire CWE corpus.
Membership
Nature Type ID Name Page
HasMember 20 Improper Input Validation 20
HasMember 74 Improper Neutralization of Special Elements in Output Used
by a Downstream Component ('Injection')