CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption
Information sent over a network can be compromised while in transit. An attacker may be able to read or modify the contents if the data are sent in plaintext or are weakly encrypted.
CWE Reference
Common Weakness Enumeration intelligence for builders and executives
Search official CWE records, understand business impact, map weaknesses to CVEs and ATT&CK context, and turn recurring weakness patterns into concrete secure design decisions.
1450 normalized records4.20 releaseMITRE-sourcedGlexia analysis
Reference Search
Find a CWE by ID, name, language, phase, or impact
Use exact IDs such as CWE-79, search weakness names, or browse developer-focused filters.
High-Value Resources
Start with the CWE pages teams use most
CWE Top 25Executive risk view of the most dangerous software weaknesses.CWE DictionaryPlain-language definitions for weakness, category, view, abstraction, mapping, and mitigation terms.CWE to CVE MappingConnect vulnerability records back to recurring weakness classes.Root-Cause MappingUse CWE as a secure design and engineering quality lens.
Featured Weaknesses
Common weakness patterns with Glexia guidance
CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length
The J2EE application is configured to use an insufficient session ID length.
CWE-7: J2EE Misconfiguration: Missing Custom Error Page
The default error page of a web application should not display sensitive information about the product.
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote
When an application exposes a remote interface for an entity bean, it might also expose methods that get or set the bean's data. These methods could be leveraged to read sensitive information, or to change data in ways that violate the application's expectations, potentially leading to other vulnerabilities.
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods
If elevated access rights are assigned to EJB methods, then an attacker can take advantage of the permissions to exploit the product.
CWE-11: ASP.NET Misconfiguration: Creating Debug Binary
Debugging messages help attackers learn about the system and plan a form of attack.
Top List
CWE Top 25 quick links
- CWE-787: Out-of-bounds Write
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-352: Cross-Site Request Forgery (CSRF)
- CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- CWE-125: Out-of-bounds Read
- CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-416: Use After Free
- CWE-862: Missing Authorization
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Dictionary
CWE terms in operational language
WeaknessA software or hardware condition that can contribute to exploitable behavior.CategoryA grouping construct used by CWE to organize related weaknesses.ViewA CWE perspective such as research concepts, development concepts, or top-list views.AbstractionThe level of specificity of a weakness, such as class, base, or variant.Mapping NotesGuidance for deciding whether a vulnerability should map to a particular CWE.Observed ExampleA real-world vulnerability or case used by CWE to illustrate the weakness.