2021 CWE Top 25 Most Dangerous Software Errors mapped to Klocwork C and C++ checkers

Rank and CWE ID	Klocwork Checker
#01 - CWE-787: Out-of-bounds Write	`ABV.ANY_SIZE_ARRAY` `ABV.GENERAL` `ABV.ITERATOR` `ABV.MEMBER` `ABV.STACK` `ABV.TAINTED` `ABV.UNICODE.BOUND_MAP` `ABV.UNICODE.FAILED_MAP` `ABV.UNICODE.NNTS_MAP` `ABV.UNICODE.SELF_MAP` `ABV.UNKNOWN_SIZE` `NNTS.MIGHT` `NNTS.MUST` `NNTS.TAINTED` `RABV.CHECK` `RN.INDEX` `SV.FMT_STR.BAD_SCAN_FORMAT` `SV.STRBO.BOUND_COPY.OVERFLOW` `SV.STRBO.BOUND_COPY.UNTERM` `SV.STRBO.BOUND_SPRINTF` `SV.STRBO.UNBOUND_COPY` `SV.STRBO.UNBOUND_SPRINTF` `SV.UNBOUND_STRING_INPUT.CIN` `SV.UNBOUND_STRING_INPUT.FUNC`
#02 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	`SV.TAINTED.XSS.REFLECTED`
#03 - CWE-125: Out-of-bounds Read	`ABV.ANY_SIZE_ARRAY` `ABV.GENERAL` `ABV.ITERATOR` `ABV.MEMBER` `ABV.STACK` `ABV.TAINTED` `ABV.UNICODE.BOUND_MAP` `ABV.UNICODE.FAILED_MAP` `ABV.UNICODE.NNTS_MAP` `ABV.UNICODE.SELF_MAP` `ABV.UNKNOWN_SIZE` `NNTS.MIGHT` `NNTS.MUST` `NNTS.TAINTED` `RABV.CHECK` `RN.INDEX` `SV.FMT_STR.BAD_SCAN_FORMAT` `SV.STRBO.BOUND_COPY.OVERFLOW` `SV.STRBO.BOUND_COPY.UNTERM` `SV.STRBO.BOUND_SPRINTF` `SV.STRBO.UNBOUND_COPY` `SV.STRBO.UNBOUND_SPRINTF` `SV.UNBOUND_STRING_INPUT.CIN` `SV.UNBOUND_STRING_INPUT.FUNC`
#04 - CWE-20: Improper Input Validation	`ABV.TAINTED` `NNTS.TAINTED` `SV.CODE_INJECTION.SHELL_EXEC` `SV.TAINTED.ALLOC_SIZE` `SV.TAINTED.BINOP` `SV.TAINTED.CALL.BINOP` `SV.TAINTED.CALL.DEREF` `SV.TAINTED.CALL.INDEX_ACCESS` `SV.TAINTED.CALL.LOOP_BOUND` `SV.TAINTED.DEREF` `SV.TAINTED.FMTSTR` `SV.TAINTED.INDEX_ACCESS` `SV.TAINTED.INJECTION` `SV.TAINTED.LOOP_BOUND` `SV.TAINTED.PATH_TRAVERSAL` `SV.TAINTED.SECURITY_DECISION`
#05 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	`SV.CODE_INJECTION.SHELL_EXEC` `SV.TAINTED.INJECTION`
#06 - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	`CXX.SQL.INJECT`
#07 - CWE-416: Use After Free	`CL.FFM.ASSIGN` `CL.FFM.COPY` `CL.SELF-ASSIGN` `CL.SHALLOW.ASSIGN` `CL.SHALLOW.COPY` `LOCRET.ARG` `LOCRET.GLOB` `LOCRET.RET` `UFM.DEREF.MIGHT` `UFM.DEREF.MUST` `UFM.FFM.MIGHT` `UFM.FFM.MUST` `UFM.RETURN.MIGHT` `UFM.RETURN.MUST` `UFM.USE.MIGHT` `UFM.USE.MUST`
#08 - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	`SV.DLLPRELOAD.NONABSOLUTE.DLL` `SV.DLLPRELOAD.NONABSOLUTE.EXE` `SV.DLLPRELOAD.SEARCHPATH` `SV.TAINTED.PATH_TRAVERSAL`
#09 - CWE-352: Cross-Site Request Forgery (CSRF)	Currently, there is no applicable checker for this rule.
#10 - CWE-434: Unrestricted Upload of File with Dangerous Type	Currently, there is no applicable checker for this rule.
#11 - CWE-306: Missing Authentication for Critical Function	Currently, there is no applicable checker for this rule.
#12 - CWE-190: Integer Overflow or Wraparound	`NUM.OVERFLOW` `SV.TAINTED.BINOP` `SV.TAINTED.CALL.BINOP`
#13 - CWE-502: Deserialization of Untrusted Data	Currently, there is no applicable checker for this rule.
#14 - CWE-287: Improper Authentication	Currently, there is no applicable checker for this rule.
#15 - CWE-476: NULL Pointer Dereference	`NPD.CHECK.CALL.MIGHT` `NPD.CHECK.CALL.MUST` `NPD.CHECK.MIGHT` `NPD.CHECK.MUST` `NPD.CONST.CALL` `NPD.CONST.DEREF` `NPD.FUNC.CALL.MIGHT` `NPD.FUNC.CALL.MUST` `NPD.FUNC.MIGHT` `NPD.FUNC.MUST` `NPD.GEN.CALL.MIGHT` `NPD.GEN.CALL.MUST` `NPD.GEN.MIGHT` `NPD.GEN.MUST` `RNPD.CALL` `RNPD.DEREF`
#16 - CWE-798: Use of Hard-coded Credentials	`HCC.PWD` `HCC.USER` `HCC`
#17 - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer	`ABV.ANY_SIZE_ARRAY` `ABV.GENERAL` `ABV.ITERATOR` `ABV.MEMBER` `ABV.STACK` `ABV.TAINTED` `ABV.UNICODE.BOUND_MAP` `ABV.UNICODE.FAILED_MAP` `ABV.UNICODE.NNTS_MAP` `ABV.UNICODE.SELF_MAP` `ABV.UNKNOWN_SIZE` `NNTS.MIGHT` `NNTS.MUST` `NNTS.TAINTED` `RABV.CHECK` `RN.INDEX` `SV.FMT_STR.BAD_SCAN_FORMAT` `SV.STRBO.BOUND_COPY.OVERFLOW` `SV.STRBO.BOUND_COPY.UNTERM` `SV.STRBO.BOUND_SPRINTF` `SV.STRBO.UNBOUND_COPY` `SV.STRBO.UNBOUND_SPRINTF` `SV.UNBOUND_STRING_INPUT.CIN` `SV.UNBOUND_STRING_INPUT.FUNC`
#18 - CWE-862: Missing Authorization	Currently, there is no applicable checker for this rule.
#19 - CWE-276: Incorrect Default Permissions	Currently, there is no applicable checker for this rule.
#20 - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor	`SPECTRE.VARIANT1`
#21 - CWE-522: Insufficiently Protected Credentials	Currently, there is no applicable checker for this rule.
#22 - CWE-732: Incorrect Permission Assignment for Critical Resource	`SV.USAGERULES.PERMISSIONS`
#23 - CWE-611: Improper Restriction of XML External Entity Reference	Currently, there is no applicable checker for this rule.
#24 - CWE-918: Server-Side Request Forgery (SSRF)	Currently, there is no applicable checker for this rule.
#25 - CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')	`SV.CODE_INJECTION.SHELL_EXEC` `SV.TAINTED.INJECTION`

Support Summary:

15 of 25 weaknesses