CWE — cumulative coverage

179 of 969 CWE items carry higher-evidence control / attack-technique coverage. Each control's verdict is the strongest single inbound mapping; the bar shows the spread and the row shows how many sources (and from which frameworks) contribute. Authoritative mappings only.

← All cross-walks

Methodology update (2026-07-25). A policy control that mandates a technical control is no longer counted as partial coverage of it: a policy analyzes and blocks nothing, so it provides none of that control's protective effect. Those cross-layer links are re-authored as a distinct governs / implements governance relation, off the coverage scale. Coverage numbers for policy-heavy families drop accordingly — the honest correction, not a regression. Explore both on the framework map (governance toggle).

Base

108/539 · 108 covered

CWE-288Authentication Bypass Using an Alternate Path or ChannelFull8 src · DISA STIG Rhel 7 3, DISA STIG Oracle Linux 9 2, DISA STIG Oracle Linux 8 2, MITRE ATT&CK 1

CWE-347Improper Verification of Cryptographic SignatureFull8 src · DISA STIG Oracle Linux 9 2, DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 2, DISA STIG Rhel 8 1, DISA STIG Rhel 9 1

CWE-494Download of Code Without Integrity CheckFull8 src · DISA STIG Rhel 7 2, MITRE ATT&CK 2, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 8 1, DISA STIG Oracle Linux 8 1, DISA STIG Rhel 9 1

CWE-295Improper Certificate ValidationFull7 src · DISA STIG Oracle Linux 8 3, DISA STIG Rhel 7 2, DISA STIG Rhel 8 2

CWE-354Improper Validation of Integrity Check ValueFull7 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 2, DISA STIG Rhel 8 2, DISA STIG Oracle Linux 9 1

CWE-1188Initialization of a Resource with an Insecure DefaultFull6 src · DISA STIG Rhel 7 1, DISA STIG Windows Server 2019 1, DISA STIG Ubuntu 22 04 1, DISA STIG Ubuntu 24 04 1, DISA STIG Windows Server 2016 1, DISA STIG Oracle Linux 8 1

CWE-306Missing Authentication for Critical FunctionFull6 src · DISA STIG Rhel 8 2, DISA STIG Rhel 7 2, DISA STIG Oracle Linux 8 2

CWE-1240Use of a Cryptographic Primitive with a Risky ImplementationFull5 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 8 2, DISA STIG Oracle Linux 9 1

CWE-223Omission of Security-relevant InformationFull4 src · DISA STIG Ubuntu 22 04 2, DISA STIG Ubuntu 24 04 2

CWE-296Improper Following of a Certificate's Chain of TrustFull4 src · DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-757Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')Full4 src · DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1, MITRE ATT&CK 1

CWE-328Use of Weak HashFull3 src · DISA STIG Windows Server 2016 1, DISA STIG Windows 10 1, DISA STIG Windows Server 2019 1

CWE-419Unprotected Primary ChannelFull3 src · DISA STIG Oracle Linux 8 2, DISA STIG Oracle Linux 9 1

CWE-778Insufficient LoggingMostly9 src · DISA STIG Rhel 8 4, DISA STIG Oracle Linux 8 2, NIST CSF 2.0 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-266Incorrect Privilege AssignmentMostly8 src · DISA STIG Ubuntu 24 04 2, DISA STIG Ubuntu 22 04 2, DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 8 1, DISA STIG Rhel 9 1

CWE-308Use of Single-factor AuthenticationMostly7 src · MITRE ATT&CK 7

CWE-325Missing Cryptographic StepMostly7 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 8 1, DISA STIG Ubuntu 22 04 1, DISA STIG Ubuntu 24 04 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 7 1

CWE-497Exposure of Sensitive System Information to an Unauthorized Control SphereMostly6 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 8 1, DISA STIG Ubuntu 22 04 1, DISA STIG Ubuntu 24 04 1, MITRE ATT&CK 1

CWE-654Reliance on a Single Factor in a Security DecisionMostly6 src · MITRE ATT&CK 3, DISA STIG Ubuntu 22 04 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-770Allocation of Resources Without Limits or ThrottlingMostly6 src · DISA STIG Oracle Linux 8 2, DISA STIG Oracle Linux 9 2, DISA STIG Rhel 8 1, MITRE ATT&CK 1

CWE-1125Excessive Attack SurfaceMostly5 src · DISA STIG Rhel 7 2, DISA STIG Oracle Linux 8 2, DISA STIG Rhel 8 1

CWE-212Improper Removal of Sensitive Information Before Storage or TransferMostly5 src · DISA STIG Oracle Linux 8 3, DISA STIG Rhel 8 1, DISA STIG Oracle Linux 9 1

CWE-276Incorrect Default PermissionsMostly5 src · DISA STIG Windows Server 2016 2, DISA STIG Windows Server 2019 2, MITRE ATT&CK 1

CWE-290Authentication Bypass by SpoofingMostly5 src · MITRE ATT&CK 2, DISA STIG Oracle Linux 8 1, DISA STIG Rhel 7 1, DISA STIG Rhel 8 1

CWE-294Authentication Bypass by Capture-replayMostly5 src · MITRE ATT&CK 5

CWE-353Missing Support for Integrity CheckMostly5 src · DISA STIG Oracle Linux 8 3, DISA STIG Rhel 8 1, MITRE ATT&CK 1

CWE-842Placement of User into Incorrect GroupMostly5 src · DISA STIG Windows Server 2016 2, DISA STIG Windows Server 2019 2, DISA STIG Windows 10 1

CWE-1220Insufficient Granularity of Access ControlMostly4 src · NIST CSF 2.0 2, DISA STIG Windows Server 2016 1, MITRE ATT&CK 1

CWE-1241Use of Predictable Algorithm in Random Number GeneratorMostly4 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 8 2

CWE-250Execution with Unnecessary PrivilegesMostly4 src · NIST CSF 2.0 1, DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1

CWE-312Cleartext Storage of Sensitive InformationMostly4 src · DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 8 1, MITRE ATT&CK 1

CWE-331Insufficient EntropyMostly4 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 1, DISA STIG Rhel 8 1

CWE-348Use of Less Trusted SourceMostly4 src · DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 7 1, MITRE ATT&CK 1

CWE-749Exposed Dangerous Method or FunctionMostly4 src · DISA STIG Ubuntu 22 04 3, DISA STIG Ubuntu 24 04 1

CWE-924Improper Enforcement of Message Integrity During Transmission in a Communication ChannelMostly4 src · DISA STIG Oracle Linux 8 4

CWE-1204Generation of Weak Initialization Vector (IV)Mostly3 src · DISA STIG Rhel 7 1, DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-1269Product Released in Non-Release ConfigurationMostly3 src · DISA STIG Rhel 7 1, DISA STIG Oracle Linux 8 1, MITRE ATT&CK 1

CWE-304Missing Critical Step in AuthenticationMostly3 src · DISA STIG Rhel 7 2, DISA STIG Ubuntu 22 04 1

CWE-307Improper Restriction of Excessive Authentication AttemptsMostly3 src · DISA STIG Rhel 7 2, MITRE ATT&CK 1

CWE-338Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)Mostly3 src · DISA STIG Oracle Linux 8 1, DISA STIG Ubuntu 22 04 1, DISA STIG Rhel 8 1

CWE-649Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity CheckingMostly3 src · DISA STIG Rhel 8 2, DISA STIG Oracle Linux 9 1

CWE-289Authentication Bypass by Alternate NameMostly2 src · DISA STIG Oracle Linux 8 1, DISA STIG Rhel 7 1

CWE-342Predictable Exact Value from Previous ValuesMostly2 src · DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-523Unprotected Transport of CredentialsMostly2 src · DISA STIG Rhel 8 2

CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Mostly2 src · NIST CSF 2.0 2

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')Mostly2 src · NIST CSF 2.0 2

CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Mostly2 src · NIST CSF 2.0 2

CWE-1274Improper Access Control for Volatile Memory Containing Boot CodeMostly1 src · NIST CSF 2.0 1

CWE-281Improper Preservation of PermissionsMostly1 src · DISA STIG Windows Server 2019 1

CWE-343Predictable Value Range from Previous ValuesMostly1 src · DISA STIG Oracle Linux 8 1

CWE-349Acceptance of Extraneous Untrusted Data With Trusted DataMostly1 src · DISA STIG Oracle Linux 8 1

CWE-471Modification of Assumed-Immutable Data (MAID)Mostly1 src · DISA STIG Windows 10 1

CWE-708Incorrect Ownership AssignmentMostly1 src · DISA STIG Rhel 7 1

CWE-94Improper Control of Generation of Code ('Code Injection')Mostly1 src · NIST CSF 2.0 1

CWE-829Inclusion of Functionality from Untrusted Control SpherePartial12 src · MITRE ATT&CK 6, DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 7 1, DISA STIG Rhel 8 1, DISA STIG Rhel 9 1, DISA STIG Windows 10 1

CWE-552Files or Directories Accessible to External PartiesPartial10 src · MITRE ATT&CK 8, DISA STIG Oracle Linux 8 2

CWE-309Use of Password System for Primary AuthenticationPartial7 src · MITRE ATT&CK 6, DISA STIG Oracle Linux 8 1

CWE-267Privilege Defined With Unsafe ActionsPartial6 src · DISA STIG Ubuntu 22 04 3, MITRE ATT&CK 2, DISA STIG Oracle Linux 9 1

CWE-521Weak Password RequirementsPartial6 src · MITRE ATT&CK 4, DISA STIG Rhel 7 2

CWE-15External Control of System or Configuration SettingPartial5 src · MITRE ATT&CK 5

CWE-205Observable Behavioral DiscrepancyPartial5 src · DISA STIG Oracle Linux 8 2, MITRE ATT&CK 2, DISA STIG Oracle Linux 9 1

CWE-226Sensitive Information in Resource Not Removed Before ReusePartial5 src · DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 8 1, DISA STIG Rhel 9 1, MITRE ATT&CK 1

CWE-268Privilege ChainingPartial5 src · DISA STIG Ubuntu 22 04 1, DISA STIG Ubuntu 24 04 1, DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1

CWE-280Improper Handling of Insufficient Permissions or PrivilegesPartial5 src · DISA STIG Rhel 9 2, DISA STIG Oracle Linux 8 2, DISA STIG Oracle Linux 9 1

CWE-509Replicating Malicious Code (Virus or Worm)Partial4 src · DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1, DISA STIG Oracle Linux 8 1

CWE-1068Inconsistency Between Implementation and Documented DesignPartial3 src · DISA STIG Rhel 7 2, DISA STIG Oracle Linux 8 1

CWE-123Write-what-where ConditionPartial3 src · DISA STIG Windows 10 1, DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-1295Debug Messages Revealing Unnecessary InformationPartial3 src · DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1

CWE-262Not Using Password AgingPartial3 src · MITRE ATT&CK 3

CWE-274Improper Handling of Insufficient PrivilegesPartial3 src · DISA STIG Oracle Linux 9 2, DISA STIG Rhel 9 1

CWE-507Trojan HorsePartial3 src · MITRE ATT&CK 2, DISA STIG Oracle Linux 9 1

CWE-1050Excessive Platform Resource Consumption within a LoopPartial2 src · DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-1104Use of Unmaintained Third Party ComponentsPartial2 src · DISA STIG Oracle Linux 8 1, NIST CSF 2.0 1

CWE-1256Improper Restriction of Software Interfaces to Hardware FeaturesPartial2 src · NIST CSF 2.0 2

CWE-213Exposure of Sensitive Information Due to Incompatible PoliciesPartial2 src · DISA STIG Ubuntu 24 04 1, DISA STIG Windows Server 2019 1

CWE-272Least Privilege ViolationPartial2 src · DISA STIG Ubuntu 24 04 1, DISA STIG Windows 10 1

CWE-283Unverified OwnershipPartial2 src · DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1

CWE-305Authentication Bypass by Primary WeaknessPartial2 src · DISA STIG Ubuntu 22 04 1, DISA STIG Ubuntu 24 04 1

CWE-335Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)Partial2 src · DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-359Exposure of Private Personal Information to an Unauthorized ActorPartial2 src · DISA STIG Ubuntu 22 04 1, DISA STIG Ubuntu 24 04 1

CWE-426Untrusted Search PathPartial2 src · MITRE ATT&CK 2

CWE-427Uncontrolled Search Path ElementPartial2 src · DISA STIG Oracle Linux 8 1, MITRE ATT&CK 1

CWE-508Non-Replicating Malicious CodePartial2 src · DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1

CWE-538Insertion of Sensitive Information into Externally-Accessible File or DirectoryPartial2 src · DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-1021Improper Restriction of Rendered UI Layers or FramesPartial1 src · MITRE ATT&CK 1

CWE-1051Initialization with Hard-Coded Network Resource Configuration DataPartial1 src · NIST CSF 2.0 1

CWE-1100Insufficient Isolation of System-Dependent FunctionsPartial1 src · DISA STIG Oracle Linux 9 1

CWE-1224Improper Restriction of Write-Once Bit FieldsPartial1 src · NIST CSF 2.0 1

CWE-1268Policy Privileges are not Assigned Consistently Between Control and Data AgentsPartial1 src · NIST CSF 2.0 1

CWE-1273Device Unlock Credential SharingPartial1 src · NIST CSF 2.0 1

CWE-1277Firmware Not UpdateablePartial1 src · NIST CSF 2.0 1

CWE-1323Improper Management of Sensitive Trace DataPartial1 src · MITRE ATT&CK 1

CWE-1426Improper Validation of Generative AI OutputPartial1 src · NIST CSF 2.0 1

CWE-204Observable Response DiscrepancyPartial1 src · MITRE ATT&CK 1

CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Partial1 src · NIST CSF 2.0 1

CWE-260Password in Configuration FilePartial1 src · DISA STIG Rhel 7 1

CWE-263Password Aging with Long ExpirationPartial1 src · MITRE ATT&CK 1

CWE-270Privilege Context Switching ErrorPartial1 src · DISA STIG Ubuntu 22 04 1

CWE-302Authentication Bypass by Assumed-Immutable DataPartial1 src · MITRE ATT&CK 1

CWE-379Creation of Temporary File in Directory with Insecure PermissionsPartial1 src · DISA STIG Oracle Linux 8 1

CWE-412Unrestricted Externally Accessible LockPartial1 src · MITRE ATT&CK 1

CWE-430Deployment of Wrong HandlerPartial1 src · MITRE ATT&CK 1

CWE-449The UI Performs the Wrong ActionPartial1 src · DISA STIG Ubuntu 22 04 1

CWE-524Use of Cache Containing Sensitive InformationPartial1 src · MITRE ATT&CK 1

CWE-567Unsynchronized Access to Shared Data in a Multithreaded ContextPartial1 src · MITRE ATT&CK 1

CWE-59Improper Link Resolution Before File Access ('Link Following')Partial1 src · MITRE ATT&CK 1

CWE-798Use of Hard-coded CredentialsPartial1 src · NIST CSF 2.0 1

CWE-823Use of Out-of-range Pointer OffsetPartial1 src · DISA STIG Windows 10 1

Class

42/114 · 42 covered

CWE-311Missing Encryption of Sensitive DataFull8 src · NIST CSF 2.0 2, DISA STIG Windows Server 2019 1, DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 8 1, DISA STIG Rhel 9 1, DISA STIG Windows Server 2016 1

CWE-327Use of a Broken or Risky Cryptographic AlgorithmFull5 src · DISA STIG Windows 10 1, DISA STIG Windows Server 2019 1, DISA STIG Oracle Linux 8 1, DISA STIG Windows Server 2016 1, NIST CSF 2.0 1

CWE-732Incorrect Permission Assignment for Critical ResourceFull5 src · DISA STIG Windows Server 2016 2, DISA STIG Windows Server 2019 2, DISA STIG Oracle Linux 8 1

CWE-1357Reliance on Insufficiently Trustworthy ComponentMostly26 src · NIST CSF 2.0 18, DISA STIG Oracle Linux 9 3, DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 2, DISA STIG Rhel 8 1

CWE-200Exposure of Sensitive Information to an Unauthorized ActorMostly21 src · NIST CSF 2.0 15, DISA STIG Ubuntu 24 04 2, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1, DISA STIG Ubuntu 22 04 1, DISA STIG Windows 10 1

CWE-287Improper AuthenticationMostly14 src · NIST CSF 2.0 6, DISA STIG Rhel 7 3, DISA STIG Ubuntu 24 04 2, DISA STIG Ubuntu 22 04 1, DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-1391Use of Weak CredentialsMostly11 src · NIST CSF 2.0 6, DISA STIG Oracle Linux 8 3, DISA STIG Rhel 7 1, DISA STIG Rhel 8 1

CWE-285Improper AuthorizationMostly10 src · NIST CSF 2.0 4, DISA STIG Rhel 7 3, DISA STIG Oracle Linux 8 2, DISA STIG Rhel 8 1

CWE-330Use of Insufficiently Random ValuesMostly8 src · DISA STIG Oracle Linux 8 3, DISA STIG Rhel 8 3, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-345Insufficient Verification of Data AuthenticityMostly8 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 2, DISA STIG Rhel 8 2, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-269Improper Privilege ManagementMostly7 src · NIST CSF 2.0 4, DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1

CWE-114Process ControlMostly6 src · DISA STIG Oracle Linux 8 3, DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1

CWE-405Asymmetric Resource Consumption (Amplification)Mostly6 src · DISA STIG Oracle Linux 8 2, DISA STIG Oracle Linux 9 2, DISA STIG Rhel 8 2

CWE-657Violation of Secure Design PrinciplesMostly6 src · DISA STIG Windows Server 2016 2, DISA STIG Windows Server 2019 2, DISA STIG Ubuntu 24 04 1, DISA STIG Ubuntu 22 04 1

CWE-668Exposure of Resource to Wrong SphereMostly6 src · DISA STIG Oracle Linux 8 2, DISA STIG Windows Server 2019 1, DISA STIG Rhel 7 1, DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1

CWE-1390Weak AuthenticationMostly5 src · DISA STIG Rhel 7 1, DISA STIG Rhel 8 1, DISA STIG Ubuntu 22 04 1, DISA STIG Windows 10 1, DISA STIG Oracle Linux 8 1

CWE-300Channel Accessible by Non-EndpointMostly5 src · DISA STIG Oracle Linux 8 4, DISA STIG Oracle Linux 9 1

CWE-653Improper Isolation or CompartmentalizationMostly5 src · DISA STIG Rhel 9 2, DISA STIG Oracle Linux 9 1, DISA STIG Windows 10 1, DISA STIG Windows Server 2016 1

CWE-923Improper Restriction of Communication Channel to Intended EndpointsMostly5 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 8 2, DISA STIG Rhel 7 1

CWE-1263Improper Physical Access ControlMostly4 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 2

CWE-326Inadequate Encryption StrengthMostly4 src · DISA STIG Oracle Linux 9 1, DISA STIG Rhel 8 1, DISA STIG Rhel 9 1, DISA STIG Windows Server 2016 1

CWE-340Generation of Predictable Numbers or IdentifiersMostly4 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 1, DISA STIG Rhel 8 1

CWE-642External Control of Critical State DataMostly4 src · DISA STIG Oracle Linux 9 2, DISA STIG Oracle Linux 8 1, DISA STIG Rhel 7 1

CWE-862Missing AuthorizationMostly4 src · DISA STIG Rhel 7 2, DISA STIG Oracle Linux 8 2

CWE-863Incorrect AuthorizationMostly4 src · DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 1, DISA STIG Rhel 8 1

CWE-346Origin Validation ErrorMostly3 src · DISA STIG Oracle Linux 8 3

CWE-754Improper Check for Unusual or Exceptional ConditionsMostly3 src · DISA STIG Oracle Linux 8 2, DISA STIG Oracle Linux 9 1

CWE-1395Dependency on Vulnerable Third-Party ComponentMostly2 src · NIST CSF 2.0 2

CWE-402Transmission of Private Resources into a New Sphere ('Resource Leak')Mostly2 src · DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1

CWE-673External Influence of Sphere DefinitionMostly1 src · DISA STIG Rhel 8 1

CWE-410Insufficient Resource PoolPartial5 src · DISA STIG Oracle Linux 9 2, DISA STIG Rhel 8 2, DISA STIG Oracle Linux 8 1

CWE-424Improper Protection of Alternate PathPartial4 src · DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1, DISA STIG Ubuntu 22 04 1, DISA STIG Ubuntu 24 04 1

CWE-922Insecure Storage of Sensitive InformationPartial3 src · DISA STIG Windows Server 2016 2, DISA STIG Windows Server 2019 1

CWE-286Incorrect User ManagementPartial2 src · DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-506Embedded Malicious CodePartial2 src · DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1

CWE-1059Insufficient Technical DocumentationPartial1 src · NIST CSF 2.0 1

CWE-1177Use of Prohibited CodePartial1 src · NIST CSF 2.0 1

CWE-20Improper Input ValidationPartial1 src · DISA STIG Rhel 8 1

CWE-282Improper Ownership ManagementPartial1 src · DISA STIG Windows Server 2016 1

CWE-610Externally Controlled Reference to a Resource in Another SpherePartial1 src · DISA STIG Oracle Linux 8 1

CWE-684Incorrect Provision of Specified FunctionalityPartial1 src · DISA STIG Rhel 9 1

CWE-913Improper Control of Dynamically-Managed Code ResourcesPartial1 src · DISA STIG Windows 10 1

Variant

23/299 · 23 covered

CWE-258Empty Password in Configuration FileFull6 src · DISA STIG Oracle Linux 8 2, DISA STIG Oracle Linux 9 2, DISA STIG Rhel 7 2

CWE-313Cleartext Storage in a File or on DiskFull4 src · DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 8 1, DISA STIG Rhel 9 1

CWE-333Improper Handling of Insufficient Entropy in TRNGMostly6 src · DISA STIG Oracle Linux 8 3, DISA STIG Rhel 8 2, DISA STIG Oracle Linux 9 1

CWE-277Insecure Inherited PermissionsMostly4 src · DISA STIG Windows Server 2016 2, DISA STIG Windows Server 2019 2

CWE-337Predictable Seed in Pseudo-Random Number Generator (PRNG)Mostly3 src · DISA STIG Oracle Linux 8 3

CWE-416Use After FreeMostly3 src · DISA STIG Rhel 9 1, DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-1004Sensitive Cookie Without 'HttpOnly' FlagMostly2 src · NIST CSF 2.0 2

CWE-332Insufficient Entropy in PRNGMostly2 src · DISA STIG Oracle Linux 8 1, DISA STIG Rhel 8 1

CWE-539Use of Persistent Cookies Containing Sensitive InformationMostly2 src · MITRE ATT&CK 2

CWE-780Use of RSA Algorithm without OAEPMostly1 src · DISA STIG Oracle Linux 8 1

CWE-230Improper Handling of Missing ValuesPartial6 src · DISA STIG Oracle Linux 8 4, DISA STIG Rhel 7 1, DISA STIG Ubuntu 24 04 1

CWE-318Cleartext Storage of Sensitive Information in ExecutablePartial4 src · DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1, DISA STIG Rhel 9 1, MITRE ATT&CK 1

CWE-121Stack-based Buffer OverflowPartial2 src · DISA STIG Oracle Linux 8 1, DISA STIG Oracle Linux 9 1

CWE-314Cleartext Storage in the RegistryPartial2 src · DISA STIG Oracle Linux 8 1, MITRE ATT&CK 1

CWE-370Missing Check for Certificate Revocation after Initial CheckPartial2 src · DISA STIG Rhel 7 1, DISA STIG Ubuntu 24 04 1

CWE-591Sensitive Data Storage in Improperly Locked MemoryPartial2 src · NIST CSF 2.0 1, DISA STIG Oracle Linux 8 1

CWE-12ASP.NET Misconfiguration: Missing Custom Error PagePartial1 src · NIST CSF 2.0 1

CWE-173Improper Handling of Alternate EncodingPartial1 src · MITRE ATT&CK 1

CWE-207Observable Behavioral Discrepancy With Equivalent ProductsPartial1 src · DISA STIG Oracle Linux 8 1

CWE-315Cleartext Storage of Sensitive Information in a CookiePartial1 src · MITRE ATT&CK 1

CWE-316Cleartext Storage of Sensitive Information in MemoryPartial1 src · DISA STIG Oracle Linux 9 1

CWE-415Double FreePartial1 src · DISA STIG Oracle Linux 8 1

CWE-528Exposure of Core Dump File to an Unauthorized Control SpherePartial1 src · DISA STIG Oracle Linux 8 1

Pillar

5/10 · 5 covered

CWE-284Improper Access ControlMostly18 src · NIST CSF 2.0 10, DISA STIG Oracle Linux 9 2, DISA STIG Oracle Linux 8 2, DISA STIG Rhel 7 2, DISA STIG Rhel 8 2

CWE-693Protection Mechanism FailureMostly6 src · DISA STIG Windows 10 2, DISA STIG Oracle Linux 8 2, DISA STIG Windows Server 2016 1, DISA STIG Windows Server 2019 1

CWE-664Improper Control of a Resource Through its LifetimeMostly3 src · DISA STIG Windows Server 2016 2, DISA STIG Windows Server 2019 1

CWE-691Insufficient Control Flow ManagementPartial1 src · DISA STIG Windows 10 1

CWE-707Improper NeutralizationPartial1 src · DISA STIG Oracle Linux 9 1

Compound

1/7 · 1 covered

CWE-61UNIX Symbolic Link (Symlink) FollowingMostly1 src · DISA STIG Oracle Linux 8 1

"Cumulative" here means breadth of corroboration, not summed coverage: overlapping partial mappings are NOT added up into "full". The headline per control is the best-attested single mapping, shown alongside the count and source frameworks behind it.