CWE IDs: Java

SV.XSS.COOKIE  Sensitive cookie without setHttpOnly flag

ECC.EMPTY  Empty catch clause

EXC.BROADTHROWS  Method has an overly broad throws declaration

JD.CATCH  Catching runtime exception

JD.FINRET  Return inside finally

JD.UNCAUGHT  Uncaught exception

SV.IL.DEV  Design information leakage

SV.IL.FILE  File Name Leaking

UMC.SYSERR  Debug print using System.err method calls is unwanted

UMC.SYSOUT  Debug print using System.out method calls is unwanted

SV.STRUTS.VER  Usage of vulnerable Apache Struts version

SV.STRUTS.VALIDMET  Struts Forms: validate method

SV.STRUTS.NOTVALID  Struts Forms: inconsistent validate

SV.HTTP_SPLIT  Http Response Splitting

SV.LOADLIB.INJ  Untrusted call to 'loadLibrary' method

SV.LOG_FORGING  Log Forging

SV.DOS.ARRINDEX  Tainted index used for array access

SV.INT_OVF  Tainted data may lead to Integer Overflow

SV.SENSITIVE.DATA  Unencrypted sensitive data is written

SV.SENSITIVE.OBJ  Object with unencrypted sensitive data is stored

ANDROID.LIFECYCLE.SV.GETEXTRA  Unvalidated external data

SV.TAINT  Tainted data

SV.TAINT_NATIVE  Tainted data goes to native code

SV.STRUTS.NOTRESET  Struts Forms: inconsistent reset

SV.STRUTS.RESETMET  Struts Forms: reset method

SV.PATH  Path and file name injection

SV.PATH.INJ  File injection

SV.UMC.JDBC  Application should avoid calling to DriverManager.getConnection() directly

SV.SOCKETS  Bad practices: use of sockets

JD.UNCAUGHT  Uncaught exception

SV.PASSWD.HC  Hardcoded Password

SV.PASSWD.HC.EMPTY  Empty Password

SV.PRIVILEGE.MISSING  Method invoked should not be inside doPrivileged block

SV.AUTH.BYPASS.MIGHT  Incorrect Authentication

SV.AUTH.BYPASS.MUST  Incorrect Authentication

SV.AUTH.HASH.MIGHT  Use of weak cryptographic algorithm

SV.AUTH.HASH.MUST  Use of weak cryptographic algorithm

SV.LDAP.ANON  Incorrect authentication

JAVA.SV.EMAIL.HOST  Sending e-mails to Host without validation.

SV.ECV  Empty certificate validation

SV.ECV.TRUSTMANAGER  Unsafe implementation of the interface X509TrustManager.

SPRING.AUTHC.ABSENT  No configuration for a critical resource

SPRING.AUTHC.MISSING  Missing authentication for critical function

SV.SENSITIVE.DATA  Unencrypted sensitive data is written

SV.SENSITIVE.OBJ  Object with unencrypted sensitive data is stored

SV.XSS.COOKIE.SECURE  Sensitive cookie without Secure protocol

SV.XSS.COOKIE.SECURE  Sensitive cookie without Secure protocol

SV.WEAK.KEYS.AES  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DH  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DSA  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.EC  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.RSA  Insufficient key length in Cryptographic Algorithm

SV.WEAK.TLS  Weak SSL/TLS protocols should not be used.

SV.WEAK.CRYPT  Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS  Weak SSL/TLS protocols should not be used.

SV.RANDOM  Use of insecure Random number generator

SV.CSRF.GET  CSRF Token in GET request

SV.CSRF.ORIGIN  Request handler without an origin check

SV.CSRF.TOKEN  State changing request handler without a CSRF check

SV.EXPOSE.RET  Internal representation may be exposed

SV.EXPOSE.STORE  Method stores reference to mutable object

SV.UMC.EXIT  The System.exit() and Runtime.exit() method calls should not be used in servlets code

UMC.EXIT  The System.exit() method call is unwanted

SV.UMC.THREADS  Bad practices: use of thread management

SV.SESSION.FIXATION.COOKIE  Cookies should not be vulnerable to session fixation

SV.SPRING.FIXATION  Session fixation protection is disabled

ECC.EMPTY  Empty catch clause

RI.IGNOREDCALL  The value returned by a method called on immutable object is ignored

RI.IGNOREDNEW  Newly created object is ignored

RR.IGNORED  The returned value is ignored

EXC.BROADTHROWS  Method has an overly broad throws declaration

JD.INF.ALLOC  Allocation within infinite loop

SV.DOS.ARRSIZE  Tainted size used for array allocation

RLK.FIELD  Possible leak of system resource stored in a field

RLK.IN  Input stream is not closed on exit

RLK.OUT  Output stream is not closed on exit

RLK.SQLCON  Sql connection is not closed on exit

RLK.SWT  SWT object is not disposed on exit

SV.EXEC.PATH  Untrusted Search Path

SV.DATA.FILE  A potentially harmful file could be uploaded and automatically processed

SV.DOS.TMPFILEDEL  Leaving temporary file for lifetime of JVM

SV.DOS.TMPFILEEXIT  Leaving temporary file

SV.EMAIL  Unchecked e-mail

ANDROID.NPE  Dereference of a null value in an Android application

NPE.COND  Null pointer dereference where null comes from condition

NPE.CONST  Null pointer dereference where null comes from constant

NPE.RET  Dereference of a null value which is returned from a method

NPE.RET.UTIL  Dereference of a null value which is returned from a map or a collection

NPE.STAT  Null pointer dereference of a return value (statistical)

REDUN.EQNULL  Suspicious equals() called with expression and null (never true)

REDUN.NULL  Usage of variable instead of null constant

RNU.THIS  Compare this and null but this cannot be null

CMP.CLASS  Comparing by classname

SV.UMD.MAIN  Leftover debug code - main method

SV.EXPOSE.FIELD  Static field may be changed by malicious code

SV.IL.DEV  Design information leakage

SV.STRUTS.STATIC  Struts Forms: static fields

SV.DATA.BOUND  Untrusted Data leaks into trusted storage

SV.SERIAL.NOFINAL  Methods readObject() and writeObject() in serializable classes should be final

SV.SERIAL.NOREAD  Method readObject() should be defined for a serializable class

SV.SERIAL.NOWRITE  Method writeObject() should be defined for a serializable class

SV.SERIAL.OVERRIDE  Do not invoke overridable methods from the readObject() method

SV.SERIAL.SIG  Methods readObject() and writeObject() in serializable classes should have correct signature

SV.PASSWD.PLAIN  Plain-text Password

SV.PASSWD.PLAIN.HC  Plain-text Password

SV.IL.FILE  File Name Leaking

SV.SHARED.VAR  Unsynchronized access to static variable from servlet

FIN.EMPTY  Empty finalize() method should be removed

FIN.NOSUPER  Implementation of the finalize() method should call super.finalize()

REDUN.EQNULL  Suspicious equals() called with expression and null (never true)

REDUN.EQ  Suspicious equals() called with same expression on both sides

UMC.SYSERR  Debug print using System.err method calls is unwanted

UMC.SYSOUT  Debug print using System.out method calls is unwanted

SV.CLONE.SUP  Class implements 'clone' method but does not implement Cloneable

EHC.EQ  Class defines hashCode() but does not define equals()

EHC.HASH  Class defines equals() but does not define hashCode()

SV.EXPOSE.FIN  Method finalize() should have protected access modifier, not public

CMP.OBJ  Comparing objects with ==

SV.XXE.DBF  Possibility for XML External Entity attack

SV.XXE.SF  Possibility for XML External Entity attack

SV.XXE.SPF  Possibility for XML External Entity attack

SV.XXE.TF  Possibility for XML External Entity attack

SV.XXE.XIF  Possibility for XML External Entity attack

SV.XXE.XRF  Possibility for XML External Entity attack

SV.XSS.COOKIE.SECURE  Sensitive cookie without Secure protocol

SV.PERMS.HOME  File created in user home directory, without setting permissions

SV.PERMS.WIDE  Too wide permissions

SV.TMPFILE  Temporary file path tampering

JAVA.SV.XML.INVALID  XML is not validated before being unmarshalled to a Java object

SV.HASH.NO_SALT  Use of a one-way cryptographic hash without a salt

RLK.AWT  AWT object is not disposed on exit

RLK.FIELD  Possible leak of system resource stored in a field

RLK.HIBERNATE  Hibernate object is not closed on exit

RLK.IMAGEIO  ImageIO stream is not closed on exit

RLK.IN  Input stream is not closed on exit

RLK.JNDI  JNDI context is not closed on exit

RLK.MAIL  Java mail object is not closed on exit

RLK.MICRO  Java Microedition connection is not closed on exit

RLK.NIO  NIO object is not closed on exit

RLK.OUT  Output stream is not closed on exit

RLK.SOCK  Socket is not closed on exit

RLK.SQLCON  Sql connection is not closed on exit

RLK.SQLOBJ  Sql object is not closed on exit

RLK.SWT  SWT object is not disposed on exit

RLK.ZIP  Zip file is not closed on exit

SV.EXEC  Process Injection

SV.EXEC.DIR  Process Injection. Working Directory

SV.EXEC.ENV  Process Injection. Environment Variables

SV.EXEC.LOCAL  Process Injection. Local Arguments

SV.XSS.DB  Cross Site Scripting (Stored XSS)

SV.XSS.REF  Cross Site Scripting (Reflected XSS)

SV.IL.SESSION.CLIENT  HttpServletRequest.getRequestedSessionId method should not be used.

SV.CLASSDEF.INJ  Runtime Class Definition Injection

SV.CLASSLOADER.INJ  Class Loader URL Injection

SV.SCRIPT  Script Execution

SPRING.AUTHZ.ABSENT  No configuration for protected resource

SPRING.AUTHZ.MISSING  Missing Authorization

SV.DATA.DB  Data injection

SV.SQL  Sql Injection

SV.SQL.DBSOURCE  Unchecked information from the database is used in SQL statements

SV.LDAP  Unvalidated user input is used as LDAP filter

SV.SSRF.URI  URI based on invalidated user input.

SV.DATA.DB  Data injection

SV.SQL  Sql Injection

SV.SQL.DBSOURCE  Unchecked information from the database is used in SQL statements

ANDROID.LIFECYCLE.SV.GETEXTRA  Unvalidated external data

SV.TAINT  Tainted data

SV.TAINT_NATIVE  Tainted data goes to native code

SV.PATH  Path and file name injection

SV.PATH.INJ  File injection

SV.TMPFILE  Temporary file path tampering

JAVA.SV.XML.INVALID  XML is not validated before being unmarshalled to a Java object

SV.EXEC  Process Injection

SV.EXEC.DIR  Process Injection. Working Directory

SV.EXEC.ENV  Process Injection. Environment Variables

SV.EXEC.LOCAL  Process Injection. Local Arguments

SV.XSS.DB  Cross Site Scripting (Stored XSS)

SV.XSS.REF  Cross Site Scripting (Reflected XSS)

SV.DATA.DB  Data injection

SV.SQL  Sql Injection

SV.SQL.DBSOURCE  Unchecked information from the database is used in SQL statements

SV.LDAP  Unvalidated user input is used as LDAP filter

SV.DATA.DB  Data injection

SV.SQL  Sql Injection

SV.SQL.DBSOURCE  Unchecked information from the database is used in SQL statements

SV.STRUTS.VALIDMET  Struts Forms: validate method

SV.STRUTS.NOTVALID  Struts Forms: inconsistent validate

SV.HTTP_SPLIT  Http Response Splitting

SV.LOADLIB.INJ  Untrusted call to 'loadLibrary' method

SV.LOG_FORGING  Log Forging

SV.DOS.ARRINDEX  Tainted index used for array access

SV.INT_OVF  Tainted data may lead to Integer Overflow

SV.SENSITIVE.DATA  Unencrypted sensitive data is written

SV.SENSITIVE.OBJ  Object with unencrypted sensitive data is stored

SV.STRUTS.NOTRESET  Struts Forms: inconsistent reset

SV.STRUTS.RESETMET  Struts Forms: reset method

SV.UMC.JDBC  Application should avoid calling to DriverManager.getConnection() directly

SV.SOCKETS  Bad practices: use of sockets

JD.UNCAUGHT  Uncaught exception

SV.PASSWD.HC  Hardcoded Password

SV.PASSWD.HC.EMPTY  Empty Password

SV.PRIVILEGE.MISSING  Method invoked should not be inside doPrivileged block

SV.AUTH.BYPASS.MIGHT  Incorrect Authentication

SV.AUTH.BYPASS.MUST  Incorrect Authentication

SV.AUTH.HASH.MIGHT  Use of weak cryptographic algorithm

SV.AUTH.HASH.MUST  Use of weak cryptographic algorithm

SV.LDAP.ANON  Incorrect authentication

JAVA.SV.EMAIL.HOST  Sending e-mails to Host without validation.

SV.ECV  Empty certificate validation

SV.ECV.TRUSTMANAGER  Unsafe implementation of the interface X509TrustManager.

SPRING.AUTHC.ABSENT  No configuration for a critical resource

SPRING.AUTHC.MISSING  Missing authentication for critical function

SV.SENSITIVE.DATA  Unencrypted sensitive data is written

SV.SENSITIVE.OBJ  Object with unencrypted sensitive data is stored

SV.XSS.COOKIE.SECURE  Sensitive cookie without Secure protocol

SV.XSS.COOKIE.SECURE  Sensitive cookie without Secure protocol

SV.WEAK.KEYS.AES  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DH  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.DSA  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.EC  Insufficient key length in Cryptographic Algorithm

SV.WEAK.KEYS.RSA  Insufficient key length in Cryptographic Algorithm

SV.WEAK.TLS  Weak SSL/TLS protocols should not be used.

SV.WEAK.CRYPT  Use of a Broken or Risky Cryptographic Algorithm

SV.WEAK.TLS  Weak SSL/TLS protocols should not be used.

SV.RANDOM  Use of insecure Random number generator

SV.CSRF.GET  CSRF Token in GET request

SV.CSRF.ORIGIN  Request handler without an origin check

SV.CSRF.TOKEN  State changing request handler without a CSRF check

SV.EXPOSE.RET  Internal representation may be exposed

SV.EXPOSE.STORE  Method stores reference to mutable object

SV.UMC.EXIT  The System.exit() and Runtime.exit() method calls should not be used in servlets code

UMC.EXIT  The System.exit() method call is unwanted

SV.UMC.THREADS  Bad practices: use of thread management

SV.SESSION.FIXATION.COOKIE  Cookies should not be vulnerable to session fixation

SV.SPRING.FIXATION  Session fixation protection is disabled

ECC.EMPTY  Empty catch clause

RI.IGNOREDCALL  The value returned by a method called on immutable object is ignored

RI.IGNOREDNEW  Newly created object is ignored

RR.IGNORED  The returned value is ignored

EXC.BROADTHROWS  Method has an overly broad throws declaration

JD.INF.ALLOC  Allocation within infinite loop

SV.DOS.ARRSIZE  Tainted size used for array allocation

RLK.FIELD  Possible leak of system resource stored in a field

RLK.IN  Input stream is not closed on exit

RLK.OUT  Output stream is not closed on exit

RLK.SQLCON  Sql connection is not closed on exit

RLK.SWT  SWT object is not disposed on exit

SV.EXEC.PATH  Untrusted Search Path

SV.DATA.FILE  A potentially harmful file could be uploaded and automatically processed

SV.DOS.TMPFILEDEL  Leaving temporary file for lifetime of JVM

SV.DOS.TMPFILEEXIT  Leaving temporary file

SV.EMAIL  Unchecked e-mail

ANDROID.NPE  Dereference of a null value in an Android application

NPE.COND  Null pointer dereference where null comes from condition

NPE.CONST  Null pointer dereference where null comes from constant

NPE.RET  Dereference of a null value which is returned from a method

NPE.RET.UTIL  Dereference of a null value which is returned from a map or a collection

NPE.STAT  Null pointer dereference of a return value (statistical)

REDUN.EQNULL  Suspicious equals() called with expression and null (never true)

REDUN.NULL  Usage of variable instead of null constant

RNU.THIS  Compare this and null but this cannot be null

CMP.CLASS  Comparing by classname

SV.UMD.MAIN  Leftover debug code - main method

SV.EXPOSE.FIELD  Static field may be changed by malicious code

SV.IL.DEV  Design information leakage

SV.STRUTS.STATIC  Struts Forms: static fields

SV.DATA.BOUND  Untrusted Data leaks into trusted storage

SV.SERIAL.NOFINAL  Methods readObject() and writeObject() in serializable classes should be final

SV.SERIAL.NOREAD  Method readObject() should be defined for a serializable class

SV.SERIAL.NOWRITE  Method writeObject() should be defined for a serializable class

SV.SERIAL.OVERRIDE  Do not invoke overridable methods from the readObject() method

SV.SERIAL.SIG  Methods readObject() and writeObject() in serializable classes should have correct signature

SV.PASSWD.PLAIN  Plain-text Password

SV.PASSWD.PLAIN.HC  Plain-text Password

SV.IL.FILE  File Name Leaking

SV.SHARED.VAR  Unsynchronized access to static variable from servlet

FIN.EMPTY  Empty finalize() method should be removed

FIN.NOSUPER  Implementation of the finalize() method should call super.finalize()

REDUN.EQNULL  Suspicious equals() called with expression and null (never true)

REDUN.EQ  Suspicious equals() called with same expression on both sides

UMC.SYSERR  Debug print using System.err method calls is unwanted

UMC.SYSOUT  Debug print using System.out method calls is unwanted

SV.CLONE.SUP  Class implements 'clone' method but does not implement Cloneable

EHC.EQ  Class defines hashCode() but does not define equals()

EHC.HASH  Class defines equals() but does not define hashCode()

SV.EXPOSE.FIN  Method finalize() should have protected access modifier, not public

CMP.OBJ  Comparing objects with ==

SV.XXE.DBF  Possibility for XML External Entity attack

SV.XXE.SF  Possibility for XML External Entity attack

SV.XXE.SPF  Possibility for XML External Entity attack

SV.XXE.TF  Possibility for XML External Entity attack

SV.XXE.XIF  Possibility for XML External Entity attack

SV.XXE.XRF  Possibility for XML External Entity attack

SV.XSS.COOKIE.SECURE  Sensitive cookie without Secure protocol

SV.PERMS.HOME  File created in user home directory, without setting permissions

SV.PERMS.WIDE  Too wide permissions

SV.HASH.NO_SALT  Use of a one-way cryptographic hash without a salt

RLK.AWT  AWT object is not disposed on exit

RLK.FIELD  Possible leak of system resource stored in a field

RLK.HIBERNATE  Hibernate object is not closed on exit

RLK.IMAGEIO  ImageIO stream is not closed on exit

RLK.IN  Input stream is not closed on exit

RLK.JNDI  JNDI context is not closed on exit

RLK.MAIL  Java mail object is not closed on exit

RLK.MICRO  Java Microedition connection is not closed on exit

RLK.NIO  NIO object is not closed on exit

RLK.OUT  Output stream is not closed on exit

RLK.SOCK  Socket is not closed on exit

RLK.SQLCON  Sql connection is not closed on exit

RLK.SQLOBJ  Sql object is not closed on exit

RLK.SWT  SWT object is not disposed on exit

RLK.ZIP  Zip file is not closed on exit

SV.IL.SESSION.CLIENT  HttpServletRequest.getRequestedSessionId method should not be used.

SV.CLASSDEF.INJ  Runtime Class Definition Injection

SV.CLASSLOADER.INJ  Class Loader URL Injection

SV.SCRIPT  Script Execution

SPRING.AUTHZ.ABSENT  No configuration for protected resource

SPRING.AUTHZ.MISSING  Missing Authorization

SV.SSRF.URI  URI based on invalidated user input.

SV.XSS.COOKIE  Sensitive cookie without setHttpOnly flag

ECC.EMPTY  Empty catch clause

EXC.BROADTHROWS  Method has an overly broad throws declaration

JD.CATCH  Catching runtime exception

JD.FINRET  Return inside finally

JD.UNCAUGHT  Uncaught exception

SV.IL.DEV  Design information leakage

SV.IL.FILE  File Name Leaking

UMC.SYSERR  Debug print using System.err method calls is unwanted

UMC.SYSOUT  Debug print using System.out method calls is unwanted

SV.STRUTS.VER  Usage of vulnerable Apache Struts version