to the top
close form
To get a trial key
fill out the form below
Team license
Enterprise license
** By clicking this button you agree to our Privacy Policy statement

close form
Request our prices
New License
License Renewal
--Select currency--
USD
EUR
* By clicking this button you agree to our Privacy Policy statement

close form
Free PVS-Studio license for Microsoft MVP specialists
** By clicking this button you agree to our Privacy Policy statement

close form
To get the licence for your open-source project, please fill out this form
** By clicking this button you agree to our Privacy Policy statement

close form
I am interested to try it on the platforms:
** By clicking this button you agree to our Privacy Policy statement

close form
check circle
Message submitted.

Your message has been sent. We will email you at


If you haven't received our response, please do the following:
check your Spam/Junk folder and click the "Not Spam" button for our message.
This way, you won't miss messages from our team in the future.

>
>
>
Common Weakness Enumeration (CWE)

Common Weakness Enumeration (CWE)

Jul 15 2021

Common Weakness Enumeration (CWE) is a community-developed list of security weaknesses. CWE is used as a common language to describe (and, therefore, to prevent) software and hardware weaknesses. Security weaknesses are flaws and errors in software or hardware implementation, design, architecture, etc., that might lead to vulnerabilities exploited by attackers.

The main goal of CWE is to prevent vulnerabilities by educating software developers how to avoid the most common errors. That is, CWE allows programmers to eliminate software and hardware vulnerabilities.

CWE helps to:

  • describe and discuss software and hardware weaknesses in a common language;
  • check for security flaws in existing software and hardware;
  • evaluate the capabilities of tools targeting security weaknesses;
  • prevent software and hardware vulnerabilities prior to deployment.

Various static code analyzers can be used to detect the errors listed in the CWE. PVS-Studio is one of such tools. See also the classification of PVS-Studio warnings according to the Common Weakness Enumeration.

It's wrong to say that analyzers issue warnings for code fragments containing vulnerabilities. Not every error classified according to the CWE is a vulnerability. Most software errors cannot be used for malicious purposes. Therefore, it's better to say that static analyzers detect potential vulnerabilities.

Comments (0)

Next comments next comments
close comment form
Unicorn with delicious cookie
Our website uses cookies to enhance your browsing experience.
Accept