CWE ID	Klocwork Checker Code and Description
CWE-20: Improper Input Validation	`ANDROID.LIFECYCLE.SV.GETEXTRA` `SV.TAINT` `SV.TAINT_NATIVE`
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')	`SV.PATH` `SV.PATH.INJ`
CWE-73: External Control of File Name or Path	`SV.TMPFILE`
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')	`SV.EXEC` `SV.EXEC.DIR` `SV.EXEC.ENV` `SV.EXEC.LOCAL`
CWE-79: Improper Neutralization of Input During Web Page Generation	`SV.XSS.DB` `SV.XSS.REF`
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')	`SV.DATA.DB` `SV.SQL` `SV.SQL.DBSOURCE`
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')	`SV.LDAP`
CWE-103: Struts: Incomplete validate() Method Definition	`SV.STRUTS.VALIDMET`
CWE-105: Struts: Form Field Without Validator	`SV.STRUTS.NOTVALID`
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')	`SV.HTTP_SPLIT`
CWE-117: Improper Output Neutralization for Logs	`SV.LOG_FORGING`
CWE-129: Improper Validation of Array Index	`SV.DOS.ARRINDEX`
CWE-130: Improper Handling of Length Parameter Inconsistency	`SV.DOS.ARRSIZE`
CWE-190: Integer Overflow or Wraparound	`SV.INT_OVF`
CWE-226: Sensitive Information Uncleared Before Release	`SV.STRUTS.NOTRESET` `SV.STRUTS.RESETMET`
CWE-245: J2EE Bad Practices: Direct Management of Connections	`SV.UMC.JDBC`
CWE-246: J2EE Bad Practices: Direct Use of Sockets	`SV.SOCKETS`
CWE-248: Uncaught Exception	`JD.UNCAUGHT`
CWE-258: Empty Password in Configuration File	`SV.PASSWD.HC.EMPTY`
CWE-311: Missing Encryption of Sensitive Data	`SV.SENSITIVE.DATA` `SV.SENSITIVE.OBJ`
CWE-327: Use of a Broken or Risky Cryptographic Algorithm	`SV.WEAK.CRYPT`
CWE-330: Use of Insufficiently Random Values	`SV.RANDOM`
CWE-352: Cross-Site Request Forgery (CSRF)	`SV.CSRF.GET` `SV.CSRF.TOKEN` `SV.CSRF.ORIGIN`
CWE-374: Passing Mutable Objects to an Untrusted Method	`SV.EXPOSE.RET` `SV.EXPOSE.STORE`
CWE-382: J2EE Bad Practices: Use of System.exit()	`SV.UMC.EXIT` `UMC.EXIT`
CWE-383: J2EE Bad Practices: Direct Use of Threads	`SV.UMC.THREADS`
CWE-391: Unchecked Error Condition	`ECC.EMPTY` `RI.IGNOREDCALL` `RI.IGNOREDNEW` `RR.IGNORED`
CWE-396: Declaration of Catch for Generic Exception	`EXC.BROADTHROWS`
CWE-404: Improper Resource Shutdown or Release	`RLK.FIELD` `RLK.IN` `RLK.OUT` `RLK.SQLCON` `RLK.SWT`
CWE-459: Incomplete Cleanup	`SV.DOS.TMPFILEDEL` `SV.DOS.TMPFILEEXIT`
CWE-472: External Control of Assumed-Immutable Web Parameter	`SV.EMAIL`
CWE-476: NULL Pointer Dereference	`RNU.THIS`
CWE-486: Comparison of Classes by Name	`CMP.CLASS`
CWE-489: Leftover Debug Code	`SV.UMD.MAIN`
CWE-493: Critical Public Variable Without Final Modifier	`SV.EXPOSE.FIELD`
CWE-497: Exposure of System Data to an Unauthorized Control Sphere	`SV.IL.DEV`
CWE-500: Public Static Field Not Marked Final	`SV.STRUTS.STATIC`
CWE-501: Trust Boundary Violation	`SV.DATA.BOUND`
CWE-548: Information Exposure Through Directory Listing	`SV.IL.FILE`
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File	`SV.PASSWD.PLAIN`
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context	`SV.SHARED.VAR`
CWE-568: finalize() Method Without super.finalize()	`FIN.EMPTY` `FIN.NOSUPER`
CWE-570: Expression is Always False	`REDUN.EQNULL`
CWE-571: Expression is Always True	`REDUN.EQ`
CWE-576: EJB Bad Practices: Use of Java I/O	`UMC.SYSERR` `UMC.SYSOUT`
CWE-580: clone() Method Without super.clone()	`SV.CLONE.SUP`
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined	`EHC.EQ` `EHC.HASH`
CWE-583: finalize() Method Declared Public	`SV.EXPOSE.FIN`
CWE-595: Comparison of Object References Instead of Object Contents	`CMP.OBJ`
CWE-759: Use of a One-Way Hash without a Salt	`SV.HASH.NO_SALT`
CWE-798: Use of Hard-coded Credentials	`SV.PASSWD.HC`
CWE-829: Inclusion of Functionality from Untrusted Control Sphere	`SV.SCRIPT` `SV.CLASSLOADER.INJ` `SV.CLASSDEF.INJ`

Support Summary:

52 rules