Vulnerability classification
XBOW runs a wide variety of attack methods to assess the security of your assets. Each finding is mapped to the most relevant Common Weakness Enumeration (CWE). For an overview of the attack methods, see Attack methods.
Key to the CWE list
Finding type:
- Vulnerability: An exploitable weakness in your asset.
- Informational: A potential issue or a non-standard configuration, rather than an immediately exploitable vulnerability. These findings suggest a departure from best practices.
Validation:
- Deterministic: XBOW confirms findings for this class with a non-AI exploit validator. All findings are verified as true vulnerabilities, so the class reports no false positives.
- AI agent: XBOW uses agents rather than a deterministic validator to confirm findings for this class, so some false positives are possible.
- Not applicable: XBOW does not exploit informational findings, so there is nothing to validate.
Release phase: the phase of the associated attack method. See Release phases.
CWE list
| CWE ID | CWE name | Finding type | Validation | Release phase |
|---|---|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | Vulnerability | Deterministic | GA |
| CWE-73 | External Control of File Name or Path | Vulnerability | AI agent | GA |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) | Vulnerability | Deterministic | GA |
| CWE-77 | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) | Vulnerability | Deterministic | GA |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | Vulnerability | Deterministic | GA |
| CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’, XSS) | Vulnerability | Deterministic | GA |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | Vulnerability | Deterministic | GA |
| CWE-94 | Improper Control of Generation of Code (‘Code Injection’) | Vulnerability | Deterministic | GA |
| CWE-116 | Improper Encoding or Escaping of Output (‘HTTP Request/Response Splitting’) | Informational | Not applicable | GA |
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | Vulnerability | AI agent | GA |
| CWE-204 | Observable Response Discrepancy (‘User Enumeration’) | Vulnerability | AI agent | GA |
| CWE-209 | Generation of Error Message Containing Sensitive Information | Vulnerability | AI agent | GA |
| CWE-269 | Improper Privilege Management | Vulnerability | AI agent | GA |
| CWE-287 | Improper Authentication | Informational | Not applicable | GA |
| CWE-294 | Authentication Bypass by Capture-replay | Vulnerability | AI agent | GA |
| CWE-304 | Missing Critical Step in Authentication | Vulnerability | AI agent | GA |
| CWE-306 | Missing Authentication for Critical Function | Informational | Not applicable | GA |
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | Vulnerability | AI agent | GA |
| CWE-326 | Inadequate Encryption Strength | Vulnerability | AI agent | GA |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | Vulnerability | AI agent | GA |
| CWE-328 | Use of Weak Hash | Vulnerability | AI agent | GA |
| CWE-329 | Generation of Predictable IV with CBC Mode | Vulnerability | AI agent | GA |
| CWE-330 | Use of Insufficiently Random Values | Vulnerability | AI agent | GA |
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | Vulnerability | AI agent | GA |
| CWE-345 | Insufficient Verification of Data Authenticity | Vulnerability | AI agent | GA |
| CWE-347 | Improper Verification of Cryptographic Signature | Vulnerability | AI agent | GA |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Informational | Not applicable | GA |
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization (‘Race Condition’) | Vulnerability | AI agent | GA |
| CWE-367 | Time-of-check Time-of-use (TOCTOU) Race Condition | Vulnerability | AI agent | Public preview |
| CWE-384 | Session Fixation | Informational | Not applicable | GA |
| CWE-400 | Uncontrolled Resource Consumption | Vulnerability | AI agent | GA |
| CWE-425 | Direct Request (‘Forced Browsing’) | Informational | Not applicable | GA |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | Vulnerability | Deterministic | GA |
| CWE-436 | Interpretation Conflict | Vulnerability | AI agent | Public preview |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) | Vulnerability | Deterministic | GA |
| CWE-489 | Active Debug Code | Vulnerability | AI agent | GA |
| CWE-502 | Deserialization of Untrusted Data | Vulnerability | Deterministic | GA |
| CWE-522 | Insufficiently Protected Credentials | Vulnerability | AI agent | GA |
| CWE-524 | Use of Cache Containing Sensitive Information | Vulnerability | AI agent | GA |
| CWE-548 | Exposure of Information Through Directory Listing | Vulnerability | AI agent | Public preview |
| CWE-552 | Files or Directories Accessible to External Parties | Informational | Not applicable | GA |
| CWE-601 | URL Redirection to Untrusted Site (‘Open Redirect’) | Vulnerability | Deterministic | GA |
| CWE-611 | Improper Restriction of XML External Entity Reference (‘XXE’) | Vulnerability | Deterministic | GA |
| CWE-613 | Insufficient Session Expiration | Vulnerability | AI agent | GA |
| CWE-639 | Authorization Bypass Through User-Controlled Key (‘IDOR’) | Vulnerability | AI agent | Public preview |
| CWE-640 | Weak Password Recovery Mechanism for Forgotten Password | Vulnerability | AI agent | GA |
| CWE-770 | Allocation of Resources Without Limits or Throttling | Vulnerability | AI agent | GA |
| CWE-798 | Use of Hard-coded Credentials | Vulnerability | AI agent | GA |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Informational | Not applicable | GA |
| CWE-840 | Business Logic Errors | Vulnerability | AI agent | GA |
| CWE-862 | Missing Authorization | Vulnerability | Deterministic | GA |
| CWE-863 | Incorrect Authorization | Vulnerability | AI agent | GA |
| CWE-915 | Improperly Controlled Modification of Dynamically-Determined Object Attributes | Vulnerability | AI agent | GA |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement (‘Expression Language Injection’) | Vulnerability | Deterministic | GA |
| CWE-918 | Server-Side Request Forgery (SSRF) | Vulnerability | Deterministic | GA |
| CWE-942 | Permissive Cross-domain Security Policy with Untrusted Domains | Vulnerability | AI agent | GA |
| CWE-943 | Improper Neutralization of Special Elements in Data Query Logic | Vulnerability | AI agent | GA |
| CWE-1021 | Clickjacking | Informational | Not applicable | GA |
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes (‘Prototype Pollution’) | Vulnerability | AI agent | GA |
| CWE-1336 | Improper Neutralization of Special Elements Used in a Template Engine | Vulnerability | AI agent | GA |
| CWE-1385 | Missing Origin Validation in WebSockets | Vulnerability | AI agent | GA |
| CWE-1392 | Use of Default Credentials | Vulnerability | AI agent | GA |
| CWE-1395 | Dependency on Vulnerable Third-Party Component (‘Public CVE’) | Vulnerability | AI agent | GA |