Common Weakness Enumeration

291

Reliance on IP Address for Authentication

293

Using Referer Field for Authentication

294

Authentication Bypass by Capture-replay

295

Improper Certificate Validation

296

Improper Following of a Certificate's Chain of Trust

297

Improper Validation of Certificate with Host Mismatch

298

Improper Validation of Certificate Expiration

299

Improper Check for Certificate Revocation

300

Channel Accessible by Non-Endpoint

301

Reflection Attack in an Authentication Protocol

302

Authentication Bypass by Assumed-Immutable Data

303

Incorrect Implementation of Authentication Algorithm

304

Missing Critical Step in Authentication

305

Authentication Bypass by Primary Weakness

306

Missing Authentication for Critical Function

307

Improper Restriction of Excessive Authentication Attempts

308

Use of Single-factor Authentication

309

Use of Password System for Primary Authentication

311

Missing Encryption of Sensitive Data

312

Cleartext Storage of Sensitive Information

313

Cleartext Storage in a File or on Disk

314

Cleartext Storage in the Registry

315

Cleartext Storage of Sensitive Information in a Cookie

316

Cleartext Storage of Sensitive Information in Memory

317

Cleartext Storage of Sensitive Information in GUI

318

Cleartext Storage of Sensitive Information in Executable

319

Cleartext Transmission of Sensitive Information

321

Use of Hard-coded Cryptographic Key

322

Key Exchange without Entity Authentication

323

Reusing a Nonce, Key Pair in Encryption

324

Use of a Key Past its Expiration Date

325

Missing Cryptographic Step

326

Inadequate Encryption Strength

327

Use of a Broken or Risky Cryptographic Algorithm

328

Use of Weak Hash

329

Generation of Predictable IV with CBC Mode

330

Use of Insufficiently Random Values

331

Insufficient Entropy

332

Insufficient Entropy in PRNG

333

Improper Handling of Insufficient Entropy in TRNG

334

Small Space of Random Values

335

Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)

336

Same Seed in Pseudo-Random Number Generator (PRNG)

337

Predictable Seed in Pseudo-Random Number Generator (PRNG)

338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

339

Small Seed Space in PRNG

340

Generation of Predictable Numbers or Identifiers

341

Predictable from Observable State

342

Predictable Exact Value from Previous Values

343

Predictable Value Range from Previous Values