Rank	CWE ID	Description	Klocwork Issue Code
1	89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	Java: SV.SQL SV.SQL.DBSOURCE SV.DATA.DB C#: CS.SQL.INJECT.LOCAL
2	78	Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	C/C++: SV.CODE_INJECTION.SHELL_EXEC NNTS.TAINTED SV.TAINTED.INJECTION Java: SV.EXEC SV.EXEC.DIR SV.EXEC.ENV SV.EXEC.LOCAL
3	120	Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')	C/C++ ABV.GENERAL ABV.MEMBER NNTS.TAINTED SV.STRBO.UNBOUND_COPY SV.STRBO.UNBOUND_SPRINTF SV.UNBOUND_STRING_INPUT.CIN SV.UNBOUND_STRING_INPUT.FUNC
4	79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')	Java: SV.XSS.DB SV.XSS.REF
5	306	Missing Authentication for Critical Function	Although it is possible to use static analysis to detect authorization issues, such analysis requires scanning of configuration files, which is outside the scope of Klocwork analysis. In general, static analysis tools have difficulty producing a viable checker for detecting custom authorization schemes.
6	862	Missing Authorization	Although it is possible to use static analysis to detect authorization issues, such analysis requires scanning with a further context, which is outside the scope of Klocwork analysis. In general, static analysis tools have difficulty producing a viable checker for detecting custom authorization schemes.
7	798	Use of Hard-coded Credentials	C/C++: HCC HCC.PWD HCC.USER Java: SV.PASSWD.HC
8	311	Missing Encryption of Sensitive Data	Java: SV.SENSITIVE.DATA SV.SENSITIVE.OBJ
9	434	Unrestricted Upload of File with Dangerous Type	Not statically verifiable. Typically associated with PHP or ASP.NET code.
10	807	Reliance on Untrusted Inputs in a Security Decision	C/C++: SV.TAINTED.SECURITY_DECISION Java: SV.EMAIL SV.LDAP SV.TAINT
11	250	Execution with Unnecessary Privileges	C/C++: SV.FIU.PROCESS_VARIANTS SV.USAGERULES.PERMISSIONS SV.USAGERULES.PROCESS_VARIANTS
12	352	Cross-Site Request Forgery (CSRF)	Java: SV.CSRF.GET SV.CSRF.ORIGIN SV.CSRF.TOKEN
13	22	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	C/C++: SV.DLLPRELOAD.NONABSOLUTE.DLL SV.DLLPRELOAD.NONABSOLUTE.EXE SV.DLLPRELOAD.SEARCHPATH SV.TAINTED.PATH_TRAVERSAL Java: SV.PATH SV.PATH.INJ
14	494	Download of Code Without Integrity Check	Not statically verifiable. Manual inspection is required.
15	863	Incorrect Authorization	Although it is possible to use static analysis to detect authorization issues, such analysis requires scanning with a further context, which is outside the scope of Klocwork analysis. In general, static analysis tools have difficulty producing a viable checker for detecting custom authorization schemes.
16	829	Inclusion of Functionality from Untrusted Control Sphere	Java: SV.SCRIPT SV.CLASSLOADER.INJ SV.CLASSDEF.INJ
17	732	Incorrect Permission Assignment for Critical Resource	C#: CS.NPS C/C++: Checkers such as SV.USAGERULES.PERMISSIONS do provide some coverage, but typically, loose permissions for operations and custom permission models produce too many warnings from static analysis tools.
18	676	Use of Potentially Dangerous Function	C/C++: SV.BANNED.RECOMMENDED.SCANF Klocwork has built-in support for functions such as "SDL Banned Function Calls". Contact your Klocwork representative for instructions.
19	327	Use of a Broken or Risky Cryptographic Algorithm	C/C++: SV.WEAK_CRYPTO.WEAK_HASH RCA Java: SV.WEAK.CRYPT C#: CS.RCA
20	131	Incorrect Calculation of Buffer Size	C/C++: INCORRECT.ALLOC_SIZE
21	307	Improper Restriction of Excessive Authentication Attempts	No checker currently available.
22	601	URL Redirection to Untrusted Site ('Open Redirect')	Manual inspection is required to determine whether input influences the beginning of a URL.
23	134	Uncontrolled Format String	C/C++: SV.TAINTED.FMTSTR SV.FMTSTR.GENERIC
24	190	Integer Overflow or Wraparound	C/C++: ABV.TAINTED SV.TAINTED.ALLOC_SIZE SV.TAINTED.CALL.INDEX_ACCESS SV.TAINTED.INDEX_ACCESS Java: SV.INT_OVF
25	759	Use of a One-Way Hash without a Salt	C/C++: RCA.HASH.SALT.EMPTY Java: SV.HASH.NO_SALT

Support Summary:

C/C++: 13 rules
Java: 12 rules