Common Weakness Enumeration (CWE)

Common Weakness Enumeration (CWE) is a community-developed list of security weaknesses. CWE is used as a common language to describe (and, therefore, to prevent) software and hardware weaknesses. Security weaknesses are flaws and errors in software or hardware implementation, design, architecture, etc., that might lead to vulnerabilities exploited by attackers.

The main goal of CWE is to prevent vulnerabilities by educating software developers how to avoid the most common errors. That is, CWE allows programmers to eliminate software and hardware vulnerabilities.

CWE helps to:

• describe and discuss software and hardware weaknesses in a common language;
• check for security flaws in existing software and hardware;
• evaluate the capabilities of tools targeting security weaknesses;
• prevent software and hardware vulnerabilities prior to deployment.

Various static code analyzers can be used to detect the errors listed in the CWE. PVS-Studio is one of such tools. See also the classification of PVS-Studio warnings according to the Common Weakness Enumeration.

It's wrong to say that analyzers issue warnings for code fragments containing vulnerabilities. Not every error classified according to the CWE is a vulnerability. Most software errors cannot be used for malicious purposes. Therefore, it's better to say that static analyzers detect potential vulnerabilities.

211

0

0

1

SHARE

We can email you a selection of our best articles once a month