CWE IDs mapped to Klocwork Java checkers

ANDROID.LIFECYCLE.SV.GETEXTRA   Unvalidated external data

SV.TAINT   Tainted data

SV.TAINT_NATIVE   Tainted data goes to native code

SV.PATH   Path and file name injection

SV.PATH.INJ   File injection

SV.TMPFILE   Temporary file path tampering

JAVA.SV.XML.INVALID   XML is not validated before being unmarshalled to a Java object

SV.EXEC   Process Injection

SV.EXEC.DIR   Process Injection. Working Directory

SV.EXEC.ENV   Process Injection. Environment Variables

SV.EXEC.LOCAL   Process Injection. Local Arguments

SV.XSS.DB   Cross Site Scripting (Stored XSS)

SV.XSS.REF   Cross Site Scripting (Reflected XSS)

SV.DATA.DB   Data injection

SV.SQL   Sql Injection

SV.SQL.DBSOURCE   Unchecked information from the database is used in SQL statements

SV.LDAP   Unvalidated user input is used as LDAP filter

SV.DATA.DB   Data injection

SV.SQL   Sql Injection

SV.SQL.DBSOURCE   Unchecked information from the database is used in SQL statements

SV.STRUTS.VALIDMET   Struts Forms: validate method

SV.STRUTS.NOTVALID   Struts Forms: inconsistent validate

SV.HTTP_SPLIT   Http Response Splitting

SV.LOADLIB.INJ   Untrusted call to 'loadLibrary' method

SV.LOG_FORGING   Log Forging

SV.DOS.ARRINDEX   Tainted index used for array access

SV.INT_OVF   Tainted data may lead to Integer Overflow

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.STRUTS.NOTRESET   Struts Forms: inconsistent reset

SV.STRUTS.RESETMET   Struts Forms: reset method

SV.UMC.JDBC   Application should avoid calling to DriverManager.getConnection() directly

SV.SOCKETS   Bad practices: use of sockets

JD.UNCAUGHT   Uncaught exception

SV.PASSWD.HC   Hardcoded Password

SV.PASSWD.HC.EMPTY   Empty Password

SV.PRIVILEGE.MISSING   Method invoked should not be inside doPrivileged block

SV.AUTH.BYPASS.MIGHT   Incorrect Authentication

SV.AUTH.BYPASS.MUST   Incorrect Authentication

SV.AUTH.HASH.MIGHT   Use of weak cryptographic algorithm

SV.AUTH.HASH.MUST   Use of weak cryptographic algorithm

SV.LDAP.ANON   Incorrect authentication

JAVA.SV.EMAIL.HOST   Sending e-mails to Host without validation.

SV.ECV   Empty certificate validation

SV.ECV.TRUSTMANAGER   Unsafe implementation of the interface X509TrustManager.

SPRING.AUTHC.ABSENT   No configuration for a critical resource

SPRING.AUTHC.MISSING   Missing authentication for critical function

SV.SENSITIVE.DATA   Unencrypted sensitive data is written

SV.SENSITIVE.OBJ   Object with unencrypted sensitive data is stored

SV.XSS.COOKIE.SECURE   Sensitive cookie without Secure protocol

SV.XSS.COOKIE.SECURE   Sensitive cookie without Secure protocol

SV.WEAK.KEYS.AES   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DH   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DSA   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.EC   Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.RSA   Insufficient key length in Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.WEAK.CRYPT   Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS   Weak SSL/TLS protocols should not be used.

SV.RANDOM   Use of insecure Random number generator

SV.CSRF.GET   CSRF Token in GET request

SV.CSRF.ORIGIN   Request handler without an origin check

SV.CSRF.TOKEN   State changing request handler without a CSRF check

SV.EXPOSE.RET   Internal representation may be exposed

SV.EXPOSE.STORE   Method stores reference to mutable object

SV.UMC.EXIT   The System.exit() and Runtime.exit() method calls should not be used in servlets code

UMC.EXIT   The System.exit() method call is unwanted

SV.UMC.THREADS   Bad practices: use of thread management

SV.SESSION.FIXATION.COOKIE   Cookies should not be vulnerable to session fixation

SV.SPRING.FIXATION   Session fixation protection is disabled

ECC.EMPTY   Empty catch clause

RI.IGNOREDCALL   The value returned by a method called on immutable object is ignored

RI.IGNOREDNEW   Newly created object is ignored

RR.IGNORED   The returned value is ignored

EXC.BROADTHROWS   Method has an overly broad throws declaration

JD.INF.ALLOC   Allocation within infinite loop

SV.DOS.ARRSIZE   Tainted size used for array allocation

RLK.FIELD   Possible leak of system resource stored in a field

RLK.IN   Input stream is not closed on exit

RLK.OUT   Output stream is not closed on exit

RLK.SQLCON   Sql connection is not closed on exit

RLK.SWT   SWT object is not disposed on exit

SV.EXEC.PATH   Untrusted Search Path

SV.DATA.FILE   A potentially harmful file could be uploaded and automatically processed

SV.DOS.TMPFILEDEL   Leaving temporary file for lifetime of JVM

SV.DOS.TMPFILEEXIT   Leaving temporary file

SV.EMAIL   Unchecked e-mail

ANDROID.NPE   Dereference of a null value in an Android application

NPE.COND   Null pointer dereference where null comes from condition

NPE.CONST   Null pointer dereference where null comes from constant

NPE.RET   Dereference of a null value which is returned from a method

NPE.RET.UTIL   Dereference of a null value which is returned from a map or a collection

NPE.STAT   Null pointer dereference of a return value (statistical)

REDUN.EQNULL   Suspicious equals() called with expression and null (never true)

REDUN.NULL   Usage of variable instead of null constant

RNU.THIS   Compare this and null but this cannot be null

CMP.CLASS   Comparing by classname

SV.UMD.MAIN   Leftover debug code - main method

SV.EXPOSE.FIELD   Static field may be changed by malicious code

SV.IL.DEV   Design information leakage

SV.STRUTS.STATIC   Struts Forms: static fields

SV.DATA.BOUND   Untrusted Data leaks into trusted storage

SV.SERIAL.NOFINAL   Methods readObject() and writeObject() in serializable classes should be final

SV.SERIAL.NOREAD   Method readObject() should be defined for a serializable class

SV.SERIAL.NOWRITE   Method writeObject() should be defined for a serializable class

SV.SERIAL.OVERRIDE   Do not invoke overridable methods from the readObject() method

SV.SERIAL.SIG   Methods readObject() and writeObject() in serializable classes should have correct signature

SV.PASSWD.PLAIN   Plain-text Password

SV.PASSWD.PLAIN.HC   Plain-text Password

SV.IL.FILE   File Name Leaking

SV.SHARED.VAR   Unsynchronized access to static variable from servlet

FIN.EMPTY   Empty finalize() method should be removed

FIN.NOSUPER   Implementation of the finalize() method should call super.finalize()

REDUN.EQNULL   Suspicious equals() called with expression and null (never true)

REDUN.EQ   Suspicious equals() called with same expression on both sides

UMC.SYSERR   Debug print using System.err method calls is unwanted

UMC.SYSOUT   Debug print using System.out method calls is unwanted

SV.CLONE.SUP   Class implements 'clone' method but does not implement Cloneable

EHC.EQ   Class defines hashCode() but does not define equals()

EHC.HASH   Class defines equals() but does not define hashCode()

SV.EXPOSE.FIN   Method finalize() should have protected access modifier, not public

CMP.OBJ   Comparing objects with ==

SV.XXE.DBF   Possibility for XML External Entity attack

SV.XXE.SF   Possibility for XML External Entity attack

SV.XXE.SPF   Possibility for XML External Entity attack

SV.XXE.TF   Possibility for XML External Entity attack

SV.XXE.XIF   Possibility for XML External Entity attack

SV.XXE.XRF   Possibility for XML External Entity attack

SV.XSS.COOKIE.SECURE   Sensitive cookie without Secure protocol

SV.PERMS.HOME   File created in user home directory, without setting permissions

SV.PERMS.WIDE   Too wide permissions

SV.HASH.NO_SALT   Use of a one-way cryptographic hash without a salt

RLK.AWT   AWT object is not disposed on exit

RLK.FIELD   Possible leak of system resource stored in a field

RLK.HIBERNATE   Hibernate object is not closed on exit

RLK.IMAGEIO   ImageIO stream is not closed on exit

RLK.IN   Input stream is not closed on exit

RLK.JNDI   JNDI context is not closed on exit

RLK.MAIL   Java mail object is not closed on exit

RLK.MICRO   Java Microedition connection is not closed on exit

RLK.NIO   NIO object is not closed on exit

RLK.OUT   Output stream is not closed on exit

RLK.SOCK   Socket is not closed on exit

RLK.SQLCON   Sql connection is not closed on exit

RLK.SQLOBJ   Sql object is not closed on exit

RLK.SWT   SWT object is not disposed on exit

RLK.ZIP   Zip file is not closed on exit

SV.IL.SESSION.CLIENT   HttpServletRequest.getRequestedSessionId method should not be used.

SV.CLASSDEF.INJ   Runtime Class Definition Injection

SV.CLASSLOADER.INJ   Class Loader URL Injection

SV.SCRIPT   Script Execution

SPRING.AUTHZ.ABSENT   No configuration for protected resource

SPRING.AUTHZ.MISSING   Missing Authorization

SV.SSRF.URI   URI based on invalidated user input.

SV.XSS.COOKIE   Sensitive cookie without setHttpOnly flag

ECC.EMPTY   Empty catch clause

EXC.BROADTHROWS   Method has an overly broad throws declaration

JD.CATCH   Catching runtime exception

JD.FINRET   Return inside finally

JD.UNCAUGHT   Uncaught exception

SV.IL.DEV   Design information leakage

SV.IL.FILE   File Name Leaking

UMC.SYSERR   Debug print using System.err method calls is unwanted

UMC.SYSOUT   Debug print using System.out method calls is unwanted

SV.STRUTS.VER   Usage of vulnerable Apache Struts version