Common Weakness Enumeration

62

UNIX Hard Link

64

Windows Shortcut Following (.LNK)

65

Windows Hard Link

66

Improper Handling of File Names that Identify Virtual Resources

67

Improper Handling of Windows Device Names

69

Improper Handling of Windows ::DATA Alternate Data Stream

72

Improper Handling of Apple HFS+ Alternate Data Stream Path

73

External Control of File Name or Path

74

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

75

Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)

76

Improper Neutralization of Equivalent Special Elements

77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

81

Improper Neutralization of Script in an Error Message Web Page

82

Improper Neutralization of Script in Attributes of IMG Tags in a Web Page

83

Improper Neutralization of Script in Attributes in a Web Page

84

Improper Neutralization of Encoded URI Schemes in a Web Page

85

Doubled Character XSS Manipulations

86

Improper Neutralization of Invalid Characters in Identifiers in Web Pages

87

Improper Neutralization of Alternate XSS Syntax

88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

90

Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')

91

XML Injection (aka Blind XPath Injection)

93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

94

Improper Control of Generation of Code ('Code Injection')

95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

96

Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

97

Improper Neutralization of Server-Side Includes (SSI) Within a Web Page

98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

99

Improper Control of Resource Identifiers ('Resource Injection')

102

Struts: Duplicate Validation Forms

103

Struts: Incomplete validate() Method Definition

104

Struts: Form Bean Does Not Extend Validation Class

105

Struts: Form Field Without Validator

106

Struts: Plug-in Framework not in Use

107

Struts: Unused Validation Form

108

Struts: Unvalidated Action Form

109

Struts: Validator Turned Off

110

Struts: Validator Without Form Field

111

Direct Use of Unsafe JNI

112

Missing XML Validation

113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

114

Process Control

115

Misinterpretation of Input

116

Improper Encoding or Escaping of Output

117

Improper Output Neutralization for Logs

118

Incorrect Access of Indexable Resource ('Range Error')