To get a trial key
fill out the form below
Team license
Enterprise license
** By clicking this button you agree to our Privacy Policy statement

Request our prices
New License
License Renewal
--Select currency--
USD
EUR
RUB
* By clicking this button you agree to our Privacy Policy statement

Free PVS-Studio license for Microsoft MVP specialists
** By clicking this button you agree to our Privacy Policy statement

To get the licence for your open-source project, please fill out this form
** By clicking this button you agree to our Privacy Policy statement

I am interested to try it on the platforms:
** By clicking this button you agree to our Privacy Policy statement

Message submitted.

Your message has been sent. We will email you at


If you haven't received our response, please do the following:
check your Spam/Junk folder and click the "Not Spam" button for our message.
This way, you won't miss messages from our team in the future.

>
>
>
Common Weakness Enumeration (CWE)

Common Weakness Enumeration (CWE)

Jul 15 2021

Common Weakness Enumeration (CWE) is a community-developed list of security weaknesses. CWE is used as a common language to describe (and, therefore, to prevent) software and hardware weaknesses. Security weaknesses are flaws and errors in software or hardware implementation, design, architecture, etc., that might lead to vulnerabilities exploited by attackers.

The main goal of CWE is to prevent vulnerabilities by educating software developers how to avoid the most common errors. That is, CWE allows programmers to eliminate software and hardware vulnerabilities.

CWE helps to:

  • describe and discuss software and hardware weaknesses in a common language;
  • check for security flaws in existing software and hardware;
  • evaluate the capabilities of tools targeting security weaknesses;
  • prevent software and hardware vulnerabilities prior to deployment.

Various static code analyzers can be used to detect the errors listed in the CWE. PVS-Studio is one of such tools. See also the classification of PVS-Studio warnings according to the Common Weakness Enumeration.

It's wrong to say that analyzers issue warnings for code fragments containing vulnerabilities. Not every error classified according to the CWE is a vulnerability. Most software errors cannot be used for malicious purposes. Therefore, it's better to say that static analyzers detect potential vulnerabilities.

Comments (0)

Next comments
Unicorn with delicious cookie
Our website uses cookies to enhance your browsing experience. Would you like to learn more?
Accept