Vulnerability classification
XBOW detects vulnerabilities and groups them according to the Common Weakness Enumerations (CWEs) selected by NIST (National Vulnerability Database).
The National Vulnerability Database (NVD) uses CWEs to classify vulnerability types. XBOW uses the CWE classes chosen by the NVD that describe attacks relevant to web applications.
CWEs used to classify findings
The Finding type column indicates whether XBOW validates each CWE and its remediation priority. Finding types are listed from highest to lowest priority for remediation.
- Validated XBOW has created a non-AI, deterministic, exploit validator for this class. All findings reported for this CWE are verified as true vulnerabilities.
- Private preview Identification of this class of findings still results in many false positive results. Talk to XBOW if you want to enable this option.
- Informational An informational finding indicates a potential issue or a non-standard configuration, but is not an immediate, exploitable vulnerability. An informational finding suggests a departure from best practices.
| CWE ID | CWE Name | Finding type | Common Name |
|---|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’) | Validated | Path Traversal |
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component (‘Injection’) | Validated | Injection |
| CWE-77 | Improper Neutralization of Special Elements used in a Command (‘Command Injection’) | Validated | Command Injection |
| CWE-78 | Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) | Validated | OS Command Injection |
| CWE-79 | Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) | Validated | (Stored/DOM) Cross-Site Scripting (XSS) |
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) | Validated | SQL Injection |
| CWE-94 | Improper Control of Generation of Code (‘Code Injection’) | Validated | Code Injection |
| CWE-116 | Improper Neutralization of CRLF Sequences in HTTP Headers (‘HTTP Request/Response Splitting’) | Informational | Improper Encoding or Escaping of Output |
| CWE-287 | Improper Authentication | Informational | Improper Authentication |
| CWE-306 | Missing Authentication for Critical Function | Informational | Missing Authentication for Critical Function |
| CWE-352 | Cross-Site Request Forgery (CSRF) | Informational | Cross-Site Request Forgery (CSRF) |
| CWE-384 | Session Fixation | Informational | Session Fixation |
| CWE-425 | Direct Request (‘Forced Browsing’) | Informational | Direct Request (Forced Browsing) |
| CWE-434 | Unrestricted Upload of File with Dangerous Type | Validated | Unrestricted Upload of File with Dangerous Type |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) | Validated | Unsafe Reflection |
| CWE-502 | Deserialization of Untrusted Data | Validated | Deserialization of Untrusted Data |
| CWE-552 | Files or Directories Accessible to External Parties | Informational | Files or Directories Accessible to External Parties |
| CWE-601 | URL Redirection to Untrusted Site (‘Open Redirect’) | Validated | Open Redirect |
| CWE-611 | Improper Restriction of XML External Entity Reference (‘XXE’) | Validated | XML External Entity Reference (XXE) |
| CWE-639 | Authorization Bypass Through User-Controlled Key | Private preview | Authorization Bypass Through User-Controlled Key (IDOR) |
| CWE-829 | Inclusion of Functionality from Untrusted Control Sphere | Informational | Inclusion of Functionality from Untrusted Control Sphere |
| CWE-862 | Missing Authorization | Validated | Missing Authorization |
| CWE-863 | Incorrect Authorization | Informational | Incorrect Authorization |
| CWE-917 | Improper Neutralization of Special Elements used in an Expression Language Statement (‘Expression Language Injection’) | Validated | Expression Language Injection |
| CWE-918 | Server-Side Request Forgery (SSRF) | Validated | Server-Side Request Forgery (SSRF) |
| CWE-1021 | Clickjacking | Informational | Clickjacking |