CWE Top 25 Most Dangerous Software Weaknesses (2024)

Rank 17 in the 2024 CWE Top 25 (frequency x severity of CVEs). The product exposes sensitive information to an actor that is not explicitly authorised to have access to it.

• Data classification and need-to-know access; minimised error/debug output
• Review of responses, logs and headers for sensitive leakage

• Verbose errors or debug data in responses
• Over-broad API responses

Rank 5 in the 2024 CWE Top 25 (frequency x severity of CVEs). Path Traversal: user input used in a file path is not properly neutralised, allowing access to files and directories outside the intended location.

• Canonicalisation and allow-list validation of file paths
• Tests covering ../ and absolute-path payloads

• Direct use of user input in file paths
• Validation before canonicalisation

Rank 15 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software does not properly assign, track, or relinquish privileges, allowing actors to gain unintended elevated access.

• Least-privilege role assignment and privilege-drop after use
• Review of privilege transitions and admin grants

• Excessive default privileges
• Privileges not dropped after elevation

Rank 4 in the 2024 CWE Top 25 (frequency x severity of CVEs). The web application does not verify that a state-changing request was intentionally sent by the user, allowing an attacker to force the victim's browser to submit requests.

• Anti-CSRF tokens and/or SameSite cookies on state-changing requests
• Tests confirming forged cross-origin requests are rejected

• No CSRF token on state-changing endpoints
• Relying solely on a session cookie

Rank 9 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software does not perform an authorization check when an actor attempts to access a resource or perform an action.

• Server-side authorization checks on every protected resource/action
• Tests for forced-browsing and IDOR

• Authorization enforced only in the UI
• Object access without ownership checks

Rank 18 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software performs an authorization check but does so incorrectly, granting access that should be denied.

• Centralised, correct authorization logic with deny-by-default
• Tests for privilege-escalation and role-confusion

• Flawed role/scope comparison
• Authorization decisions split across inconsistent checks

Rank 14 in the 2024 CWE Top 25 (frequency x severity of CVEs). When an actor claims to have a given identity, the software does not prove or insufficiently proves that the claim is correct.

• Strong authentication with MFA where appropriate; correct credential verification
• Tests for auth bypass and weak verification

• Authentication logic that can be bypassed
• Comparisons vulnerable to timing or type confusion

Rank 25 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software does not perform any authentication for functionality that requires a provable user identity or consumes significant resources.

• Authentication enforced on all critical/administrative functions
• Tests confirming critical endpoints reject unauthenticated access

• Admin/critical endpoints exposed without authentication
• Hidden endpoints assumed safe by obscurity

Rank 22 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software contains hard-coded credentials, such as a password or cryptographic key, used for authentication or encryption.

• Secrets stored in a secrets manager, not source; secret-scanning in CI
• Rotation process for any embedded keys

• Credentials/keys committed to source or config
• No secret scanning

Rank 24 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software does not properly control the allocation and maintenance of a limited resource, enabling denial of service.

• Rate limiting, quotas, timeouts and input-size limits
• Load/abuse testing of resource-intensive endpoints

• No limits on request size, recursion or concurrency
• Unbounded resource allocation from input

Rank 16 in the 2024 CWE Top 25 (frequency x severity of CVEs). The application deserialises untrusted data without sufficient verification, allowing object/state manipulation and often remote code execution.

• Avoiding native deserialisation of untrusted data; safe formats and allow-listed types with integrity checks
• Tests with malicious serialised payloads

• Native deserialisation of attacker-controlled data
• No type allow-list or integrity check

Rank 19 in the 2024 CWE Top 25 (frequency x severity of CVEs). The web server receives a URL or request from an upstream component and retrieves it without sufficiently validating the destination.

• Allow-list of permitted destinations; block internal/metadata ranges; no redirects to untrusted hosts
• Tests targeting internal and cloud-metadata endpoints

• Fetching arbitrary user-supplied URLs
• No egress restrictions to internal networks

Rank 12 in the 2024 CWE Top 25 (frequency x severity of CVEs). The product does not validate, or incorrectly validates, input that affects the control flow or data flow of the program.

• Allow-list input validation at trust boundaries with canonical forms and length/range/type checks
• Negative test cases for malformed input

• No validation at the boundary
• Blacklist-only validation

Rank 10 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software allows the upload of files that can be automatically processed or executed within the product's environment.

• File-type/content validation, storage outside webroot, non-executable handling
• Tests with disguised and dangerous file types

• Trusting client-provided content type or extension
• Uploaded files served from an executable path

Rank 13 in the 2024 CWE Top 25 (frequency x severity of CVEs). Command Injection: untrusted input is incorporated into a command without neutralisation, allowing alteration of the intended command.

• Parameterised command APIs and strict argument validation
• Tests for command-separator and metacharacter payloads

• Concatenating commands from user input

Rank 7 in the 2024 CWE Top 25 (frequency x severity of CVEs). OS Command Injection: untrusted input is incorporated into a command executed by the OS, allowing arbitrary command execution.

• Avoiding shell invocation; using parameterised APIs/arg arrays
• Allow-list validation of any command arguments

• Building shell strings from user input
• Use of shell=true with untrusted args

Rank 1 in the 2024 CWE Top 25 (frequency x severity of CVEs). Cross-site Scripting (XSS): the software does not neutralise user-controllable input before it is placed in output used as a web page, allowing attacker-supplied script to execute in victims' browsers.

• Context-aware output encoding and a Content Security Policy
• SAST/DAST results showing no reflected/stored/DOM XSS
• Code review of all sinks that render user input

• Output not encoded for the HTML/JS/URL context
• No CSP
• Relying on input blacklists

Rank 3 in the 2024 CWE Top 25 (frequency x severity of CVEs). SQL Injection: user input is incorporated into an SQL query without proper neutralisation, allowing modification of query logic and unauthorised data access.

• Parameterised queries / prepared statements throughout
• SAST/DAST evidence of no SQLi
• Least-privilege database accounts

• String-concatenated SQL
• ORM raw queries with untrusted input

Rank 11 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software constructs code from externally-influenced input without neutralising special elements, allowing injection of executable code.

• Avoiding dynamic eval/code generation from untrusted input
• Sandboxing where dynamic execution is unavoidable

• Use of eval/exec on user input
• Template engines run with untrusted templates

Rank 20 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software performs operations on a memory buffer but can read from or write to a location outside the intended boundary.

• Bounds-checked operations and memory-safe languages
• Fuzzing and sanitizer coverage of buffer operations

• Unchecked length/size in buffer operations

Rank 6 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software reads data past the end, or before the beginning, of the intended buffer, disclosing memory contents or causing crashes.

• Bounds checking and memory-safe APIs
• Fuzzing and sanitizer results for read paths

• Unchecked read offsets/lengths from untrusted input

Rank 23 in the 2024 CWE Top 25 (frequency x severity of CVEs). An integer calculation can produce a value that wraps around, often leading to undersized allocations and subsequent memory corruption.

• Checked/safe arithmetic and validation of size calculations
• Fuzzing of size/length handling

• Unchecked arithmetic on attacker-influenced sizes

Rank 8 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software references memory after it has been freed, leading to crashes, data corruption, or code execution.

• Memory-safe languages or RAII/smart pointers; nulling freed pointers
• Sanitizer (ASan/UBSan) and fuzzing coverage

• Manual memory management without ownership discipline
• No use-after-free detection in CI

Rank 21 in the 2024 CWE Top 25 (frequency x severity of CVEs). The application dereferences a pointer it expects to be valid but is NULL, typically causing a crash or denial of service.

• Null checks after allocation/return; static analysis for nullability
• Tests covering allocation-failure and unexpected-null paths

• Unchecked return values from allocation/lookup

Rank 2 in the 2024 CWE Top 25 (frequency x severity of CVEs). The software writes data past the end, or before the beginning, of the intended buffer, leading to corruption, crashes, or code execution.

• Use of memory-safe languages or bounds-checked APIs
• Fuzzing and AddressSanitizer/static-analysis results
• Code review of buffer/index arithmetic

• Unchecked array indices or pointer arithmetic
• No fuzzing of parsers handling untrusted input