2022 CWE Top 25 Most Dangerous Software Errors mapped to Klocwork C and C++ checkers

Rank and ID	Checker name
#01 - CWE-787: Out-of-bounds Write	ABV.ANY_SIZE_ARRAY ABV.GENERAL ABV.GENERAL.MULTIDIMENSION ABV.ITERATOR ABV.MEMBER ABV.NON_ARRAY ABV.STACK ABV.TAINTED ABV.UNICODE.BOUND_MAP ABV.UNICODE.FAILED_MAP ABV.UNICODE.NNTS_MAP ABV.UNICODE.SELF_MAP ABV.UNKNOWN_SIZE CXX.SUSPICIOUS_INDEX_CHECK CXX.SUSPICIOUS_INDEX_CHECK.CALL CXX.SUSPICIOUS_INDEX_CHECK.ZERO NNTS.MIGHT NNTS.MUST NNTS.TAINTED RABV.CHECK RN.INDEX SV.FMT_STR.BAD_SCAN_FORMAT SV.STRBO.BOUND_COPY.OVERFLOW SV.STRBO.BOUND_COPY.UNTERM SV.STRBO.BOUND_SPRINTF SV.STRBO.UNBOUND_COPY SV.STRBO.UNBOUND_SPRINTF SV.UNBOUND_STRING_INPUT.CIN SV.UNBOUND_STRING_INPUT.FUNC
#02 - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	SV.TAINTED.XSS.REFLECTED
#03 - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	CXX.SQL.INJECT
#04 - CWE-20: Improper Input Validation	ABV.TAINTED NNTS.TAINTED SV.CODE_INJECTION.SHELL_EXEC SV.TAINTED.ALLOC_SIZE SV.TAINTED.BINOP SV.TAINTED.CALL.BINOP SV.TAINTED.CALL.DEREF SV.TAINTED.CALL.INDEX_ACCESS SV.TAINTED.CALL.LOOP_BOUND SV.TAINTED.DEREF SV.TAINTED.FMTSTR SV.TAINTED.INDEX_ACCESS SV.TAINTED.INJECTION SV.TAINTED.LOOP_BOUND SV.TAINTED.PATH_TRAVERSAL SV.TAINTED.SECURITY_DECISION
#05 - CWE-125: Out-of-bounds Read	ABV.ANY_SIZE_ARRAY ABV.GENERAL ABV.GENERAL.MULTIDIMENSION ABV.ITERATOR ABV.MEMBER ABV.NON_ARRAY ABV.STACK ABV.TAINTED ABV.UNICODE.BOUND_MAP ABV.UNICODE.FAILED_MAP ABV.UNICODE.NNTS_MAP ABV.UNICODE.SELF_MAP ABV.UNKNOWN_SIZE CXX.SUSPICIOUS_INDEX_CHECK CXX.SUSPICIOUS_INDEX_CHECK.CALL CXX.SUSPICIOUS_INDEX_CHECK.ZERO NNTS.MIGHT NNTS.MUST NNTS.TAINTED RABV.CHECK RN.INDEX SV.FMT_STR.BAD_SCAN_FORMAT SV.STRBO.BOUND_COPY.OVERFLOW SV.STRBO.BOUND_COPY.UNTERM SV.STRBO.BOUND_SPRINTF SV.STRBO.UNBOUND_COPY SV.STRBO.UNBOUND_SPRINTF SV.UNBOUND_STRING_INPUT.CIN SV.UNBOUND_STRING_INPUT.FUNC
#06 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	SV.CODE_INJECTION.SHELL_EXEC SV.TAINTED.INJECTION
#07 - CWE-416: Use After Free	CL.FFM.ASSIGN CL.FFM.COPY CL.SELF-ASSIGN CL.SHALLOW.ASSIGN CL.SHALLOW.COPY LOCRET.ARG LOCRET.GLOB LOCRET.RET UFM.DEREF.MIGHT UFM.DEREF.MUST UFM.FFM.MIGHT UFM.FFM.MUST UFM.RETURN.MIGHT UFM.RETURN.MUST UFM.USE.MIGHT UFM.USE.MUST
#08 - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	SV.DLLPRELOAD.NONABSOLUTE.DLL SV.DLLPRELOAD.NONABSOLUTE.EXE SV.DLLPRELOAD.SEARCHPATH SV.TAINTED.PATH_TRAVERSAL
#09 - CWE-352: Cross-Site Request Forgery (CSRF)	Currently, there is no applicable checker for this rule.
#10 - CWE-434: Unrestricted Upload of File with Dangerous Type	Currently, there is no applicable checker for this rule.
#11 - CWE-476: NULL Pointer Dereference	NPD.CHECK.CALL.MIGHT NPD.CHECK.CALL.MUST NPD.CHECK.MIGHT NPD.CHECK.MUST NPD.CONST.CALL NPD.CONST.DEREF NPD.FUNC.CALL.MIGHT NPD.FUNC.CALL.MUST NPD.FUNC.MIGHT NPD.FUNC.MUST NPD.GEN.CALL.MIGHT NPD.GEN.CALL.MUST NPD.GEN.MIGHT NPD.GEN.MUST RNPD.CALL RNPD.DEREF
#12 - CWE-502: Deserialization of Untrusted Data	Currently, there is no applicable checker for this rule.
#13 - CWE-190: Integer Overflow or Wraparound	NUM.OVERFLOW NUM.OVERFLOW.DF SV.TAINTED.BINOP SV.TAINTED.CALL.BINOP
#14 - CWE-287: Improper Authentication	SV.WEAK_CRYPTO.WEAK_HASH HCC HCC.PWD
#15 - CWE-798: Use of Hard-coded Credentials	HCC.PWD HCC.USER HCC
#16 - CWE-862: Missing Authorization	Currently, there is no applicable checker for this rule.
#17 - CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')	SV.CODE_INJECTION.SHELL_EXEC SV.TAINTED.INJECTION
#18 - CWE-306: Missing Authentication for Critical Function	Currently, there is no applicable checker for this rule.
#19 - CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer	ABV.ANY_SIZE_ARRAY ABV.GENERAL ABV.GENERAL.MULTIDIMENSION ABV.ITERATOR ABV.MEMBER ABV.NON_ARRAY ABV.STACK ABV.TAINTED ABV.UNICODE.BOUND_MAP ABV.UNICODE.FAILED_MAP ABV.UNICODE.NNTS_MAP ABV.UNICODE.SELF_MAP ABV.UNKNOWN_SIZE CXX.SUSPICIOUS_INDEX_CHECK CXX.SUSPICIOUS_INDEX_CHECK.CALL CXX.SUSPICIOUS_INDEX_CHECK.ZERO NNTS.MIGHT NNTS.MUST NNTS.TAINTED RABV.CHECK RN.INDEX SV.FMT_STR.BAD_SCAN_FORMAT SV.STRBO.BOUND_COPY.OVERFLOW SV.STRBO.BOUND_COPY.UNTERM SV.STRBO.BOUND_SPRINTF SV.STRBO.UNBOUND_COPY SV.STRBO.UNBOUND_SPRINTF SV.UNBOUND_STRING_INPUT.CIN SV.UNBOUND_STRING_INPUT.FUNC
#20 - CWE-276: Incorrect Default Permissions	SV.USAGERULES.PROCESS_VARIANTS
#21 - CWE-918: Server-Side Request Forgery (SSRF)	Currently, there is no applicable checker for this rule.
#22 - CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')	SV.TOCTOU.FILE_ACCESS
#23 - CWE-400: Uncontrolled Resource Consumption	CL.MLK.ASSIGN CL.MLK.VIRTUAL CL.MLK MLK.MIGHT MLK.MUST MLK.RET.MIGHT MLK.RET.MUST SV.CODE_INJECTION.SHELL_EXEC SV.TAINTED.INJECTION
#24 - CWE-611: Improper Restriction of XML External Entity Reference	CXX.SV.XXE
#25 - CWE-94: Improper Control of Generation of Code ('Code Injection')	SV.CODE_INJECTION.SHELL_EXEC SV.TAINTED.INJECTION