| MemberOf | Prohibited | V | 1400 | Comprehensive Categorization for Software Assurance Trends |
| HasMember | Allowed | V | 1004 | Sensitive Cookie Without 'HttpOnly' Flag |
| HasMember | Allowed | B | 1021 | Improper Restriction of Rendered UI Layers or Frames |
| HasMember | Allowed | V | 1022 | Use of Web Link to Untrusted Target with window.opener Access |
| HasMember | Allowed | B | 1191 | On-Chip Debug and Test Interface With Improper Access Control |
| HasMember | Allowed | B | 1220 | Insufficient Granularity of Access Control |
| HasMember | Allowed | V | 1222 | Insufficient Granularity of Address Regions Protected by Register Locks |
| HasMember | Allowed | B | 1224 | Improper Restriction of Write-Once Bit Fields |
| HasMember | Allowed | B | 1230 | Exposure of Sensitive Information Through Metadata |
| HasMember | Allowed | B | 1231 | Improper Prevention of Lock Bit Modification |
| HasMember | Allowed | B | 1233 | Security-Sensitive Hardware Controls with Missing Lock Bit Protection |
| HasMember | Allowed | B | 1242 | Inclusion of Undocumented Features or Chicken Bits |
| HasMember | Allowed | B | 1243 | Sensitive Non-Volatile Information Not Protected During Debug |
| HasMember | Allowed | B | 1244 | Internal Asset Exposed to Unsafe Debug Access Level or State |
| HasMember | Allowed | B | 1252 | CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations |
| HasMember | Allowed | B | 1256 | Improper Restriction of Software Interfaces to Hardware Features |
| HasMember | Allowed | B | 1257 | Improper Access Control Applied to Mirrored or Aliased Memory Regions |
| HasMember | Allowed | B | 1259 | Improper Restriction of Security Token Assignment |
| HasMember | Allowed | B | 1260 | Improper Handling of Overlap Between Protected Memory Ranges |
| HasMember | Allowed | B | 1262 | Improper Access Control for Register Interface |
| HasMember | Allowed-with-Review | C | 1263 | Improper Physical Access Control |
| HasMember | Allowed | B | 1267 | Policy Uses Obsolete Encoding |
| HasMember | Allowed | B | 1268 | Policy Privileges are not Assigned Consistently Between Control and Data Agents |
| HasMember | Allowed | B | 1270 | Generation of Incorrect Security Tokens |
| HasMember | Allowed | B | 1274 | Improper Access Control for Volatile Memory Containing Boot Code |
| HasMember | Allowed | V | 1275 | Sensitive Cookie with Improper SameSite Attribute |
| HasMember | Allowed | B | 1276 | Hardware Child Block Incorrectly Connected to Parent System |
| HasMember | Allowed | B | 1283 | Mutable Attestation or Measurement Reporting Data |
| HasMember | Allowed | B | 1290 | Incorrect Decoding of Security Identifiers |
| HasMember | Allowed | B | 1292 | Incorrect Conversion of Security Identifiers |
| HasMember | Allowed-with-Review | C | 1294 | Insecure Security Identifier Mechanism |
| HasMember | Allowed | B | 1296 | Incorrect Chaining or Granularity of Debug Components |
| HasMember | Allowed | B | 1297 | Unprotected Confidential Information on Device is Accessible by OSAT Vendors |
| HasMember | Allowed | B | 1299 | Missing Protection Mechanism for Alternate Hardware Interface |
| HasMember | Allowed | V | 13 | ASP.NET Misconfiguration: Password in Configuration File |
| HasMember | Allowed | B | 1302 | Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) |
| HasMember | Allowed | B | 1304 | Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation |
| HasMember | Allowed | B | 1311 | Improper Translation of Security Attributes by Fabric Bridge |
| HasMember | Allowed | B | 1312 | Missing Protection for Mirrored Regions in On-Chip Fabric Firewall |
| HasMember | Allowed | B | 1313 | Hardware Allows Activation of Test or Debug Logic at Runtime |
| HasMember | Allowed | B | 1314 | Missing Write Protection for Parametric Data Values |
| HasMember | Allowed | B | 1315 | Improper Setting of Bus Controlling Capability in Fabric End-point |
| HasMember | Allowed | B | 1316 | Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges |
| HasMember | Allowed | B | 1317 | Improper Access Control in Fabric Bridge |
| HasMember | Allowed | B | 1320 | Improper Protection for Outbound Error Messages and Alert Signals |
| HasMember | Allowed | B | 1323 | Improper Management of Sensitive Trace Data |
| HasMember | Allowed | B | 1328 | Security Version Number Mutable to Older Versions |
| HasMember | Allowed | B | 1334 | Unauthorized Error Injection Can Degrade Hardware Redundancy |
| HasMember | Allowed-with-Review | C | 1390 | Weak Authentication |
| HasMember | Allowed-with-Review | C | 1391 | Use of Weak Credentials |
| HasMember | Allowed | B | 1392 | Use of Default Credentials |
| HasMember | Allowed | B | 1393 | Use of Default Password |
| HasMember | Allowed | B | 1394 | Use of Default Cryptographic Key |
| HasMember | Allowed | B | 202 | Exposure of Sensitive Information Through Data Queries |
| HasMember | Allowed | B | 256 | Plaintext Storage of a Password |
| HasMember | Allowed | B | 257 | Storing Passwords in a Recoverable Format |
| HasMember | Allowed | V | 258 | Empty Password in Configuration File |
| HasMember | Allowed | V | 259 | Use of Hard-coded Password |
| HasMember | Allowed | B | 260 | Password in Configuration File |
| HasMember | Allowed | B | 261 | Weak Encoding for Password |
| HasMember | Allowed | B | 262 | Not Using Password Aging |
| HasMember | Allowed | B | 263 | Password Aging with Long Expiration |
| HasMember | Allowed | B | 266 | Incorrect Privilege Assignment |
| HasMember | Allowed | B | 267 | Privilege Defined With Unsafe Actions |
| HasMember | Allowed | B | 268 | Privilege Chaining |
| HasMember | Discouraged | C | 269 | Improper Privilege Management |
| HasMember | Allowed | B | 270 | Privilege Context Switching Error |
| HasMember | Allowed-with-Review | C | 271 | Privilege Dropping / Lowering Errors |
| HasMember | Allowed | B | 272 | Least Privilege Violation |
| HasMember | Allowed | B | 273 | Improper Check for Dropped Privileges |
| HasMember | Discouraged | B | 274 | Improper Handling of Insufficient Privileges |
| HasMember | Allowed | B | 276 | Incorrect Default Permissions |
| HasMember | Allowed | V | 277 | Insecure Inherited Permissions |
| HasMember | Allowed | V | 278 | Insecure Preserved Inherited Permissions |
| HasMember | Allowed | V | 279 | Incorrect Execution-Assigned Permissions |
| HasMember | Allowed | B | 280 | Improper Handling of Insufficient Permissions or Privileges |
| HasMember | Allowed | B | 281 | Improper Preservation of Permissions |
| HasMember | Allowed-with-Review | C | 282 | Improper Ownership Management |
| HasMember | Allowed | B | 283 | Unverified Ownership |
| HasMember | Discouraged | P | 284 | Improper Access Control |
| HasMember | Allowed | B | 301 | Reflection Attack in an Authentication Protocol |
| HasMember | Discouraged | C | 285 | Improper Authorization |
| HasMember | Allowed-with-Review | C | 286 | Incorrect User Management |
| HasMember | Discouraged | C | 287 | Improper Authentication |
| HasMember | Allowed | B | 288 | Authentication Bypass Using an Alternate Path or Channel |
| HasMember | Allowed | B | 289 | Authentication Bypass by Alternate Name |
| HasMember | Allowed | B | 290 | Authentication Bypass by Spoofing |
| HasMember | Allowed | V | 291 | Reliance on IP Address for Authentication |
| HasMember | Allowed | V | 293 | Using Referer Field for Authentication |
| HasMember | Allowed | B | 294 | Authentication Bypass by Capture-replay |
| HasMember | Allowed | B | 295 | Improper Certificate Validation |
| HasMember | Allowed | B | 296 | Improper Following of a Certificate's Chain of Trust |
| HasMember | Allowed | V | 297 | Improper Validation of Certificate with Host Mismatch |
| HasMember | Allowed | V | 298 | Improper Validation of Certificate Expiration |
| HasMember | Allowed | B | 299 | Improper Check for Certificate Revocation |
| HasMember | Discouraged | C | 300 | Channel Accessible by Non-Endpoint |
| HasMember | Allowed | B | 302 | Authentication Bypass by Assumed-Immutable Data |
| HasMember | Allowed | B | 303 | Incorrect Implementation of Authentication Algorithm |
| HasMember | Allowed | B | 304 | Missing Critical Step in Authentication |
| HasMember | Allowed | B | 305 | Authentication Bypass by Primary Weakness |
| HasMember | Allowed | B | 306 | Missing Authentication for Critical Function |
| HasMember | Allowed | B | 307 | Improper Restriction of Excessive Authentication Attempts |
| HasMember | Allowed | B | 308 | Use of Single-factor Authentication |
| HasMember | Allowed | B | 309 | Use of Password System for Primary Authentication |
| HasMember | Allowed | V | 321 | Use of Hard-coded Cryptographic Key |
| HasMember | Allowed | B | 322 | Key Exchange without Entity Authentication |
| HasMember | Allowed | V | 350 | Reliance on Reverse DNS Resolution for a Security-Critical Action |
| HasMember | Allowed | V | 370 | Missing Check for Certificate Revocation after Initial Check |
| HasMember | Allowed | C | 384 | Session Fixation |
| HasMember | Allowed | B | 419 | Unprotected Primary Channel |
| HasMember | Allowed | B | 420 | Unprotected Alternate Channel |
| HasMember | Allowed | B | 421 | Race Condition During Access to Alternate Channel |
| HasMember | Allowed | V | 422 | Unprotected Windows Messaging Channel ('Shatter') |
| HasMember | Allowed | B | 425 | Direct Request ('Forced Browsing') |
| HasMember | Allowed-with-Review | C | 441 | Unintended Proxy or Intermediary ('Confused Deputy') |
| HasMember | Allowed | V | 520 | .NET Misconfiguration: Use of Impersonation |
| HasMember | Allowed | B | 521 | Weak Password Requirements |
| HasMember | Allowed-with-Review | C | 522 | Insufficiently Protected Credentials |
| HasMember | Allowed | B | 523 | Unprotected Transport of Credentials |
| HasMember | Allowed | B | 549 | Missing Password Field Masking |
| HasMember | Allowed | B | 551 | Incorrect Behavior Order: Authorization Before Parsing and Canonicalization |
| HasMember | Allowed | V | 555 | J2EE Misconfiguration: Plaintext Password in Configuration File |
| HasMember | Allowed | V | 556 | ASP.NET Misconfiguration: Use of Identity Impersonation |
| HasMember | Allowed | V | 566 | Authorization Bypass Through User-Controlled SQL Primary Key |
| HasMember | Allowed | V | 593 | Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created |
| HasMember | Allowed | V | 599 | Missing Validation of OpenSSL Certificate |
| HasMember | Allowed | B | 601 | URL Redirection to Untrusted Site ('Open Redirect') |
| HasMember | Allowed | B | 603 | Use of Client-Side Authentication |
| HasMember | Allowed | B | 611 | Improper Restriction of XML External Entity Reference |
| HasMember | Allowed | B | 612 | Improper Authorization of Index Containing Sensitive Information |
| HasMember | Allowed | B | 613 | Insufficient Session Expiration |
| HasMember | Allowed | B | 620 | Unverified Password Change |
| HasMember | Allowed | V | 623 | Unsafe ActiveX Control Marked Safe For Scripting |
| HasMember | Allowed | B | 639 | Authorization Bypass Through User-Controlled Key |
| HasMember | Allowed-with-Review | B | 640 | Weak Password Recovery Mechanism for Forgotten Password |
| HasMember | Allowed | B | 645 | Overly Restrictive Account Lockout Mechanism |
| HasMember | Allowed | V | 647 | Use of Non-Canonical URL Paths for Authorization Decisions |
| HasMember | Allowed | B | 648 | Incorrect Use of Privileged APIs |
| HasMember | Allowed | B | 708 | Incorrect Ownership Assignment |
| HasMember | Allowed-with-Review | C | 732 | Incorrect Permission Assignment for Critical Resource |
| HasMember | Allowed | B | 798 | Use of Hard-coded Credentials |
| HasMember | Allowed | B | 804 | Guessable CAPTCHA |
| HasMember | Allowed | B | 836 | Use of Password Hash Instead of Password for Authentication |
| HasMember | Allowed | B | 842 | Placement of User into Incorrect Group |
| HasMember | Allowed-with-Review | C | 862 | Missing Authorization |
| HasMember | Allowed-with-Review | C | 863 | Incorrect Authorization |
| HasMember | Allowed | V | 9 | J2EE Misconfiguration: Weak Access Permissions for EJB Methods |
| HasMember | Allowed | B | 918 | Server-Side Request Forgery (SSRF) |
| HasMember | Allowed | B | 921 | Storage of Sensitive Data in a Mechanism without Access Control |
| HasMember | Allowed-with-Review | C | 923 | Improper Restriction of Communication Channel to Intended Endpoints |
| HasMember | Allowed | V | 925 | Improper Verification of Intent by Broadcast Receiver |
| HasMember | Allowed | V | 926 | Improper Export of Android Application Components |
| HasMember | Allowed | V | 927 | Use of Implicit Intent for Sensitive Communication |
| HasMember | Allowed | B | 939 | Improper Authorization in Handler for Custom URL Scheme |
| HasMember | Allowed | B | 940 | Improper Verification of Source of a Communication Channel |
| HasMember | Allowed | B | 941 | Incorrectly Specified Destination in a Communication Channel |
| HasMember | Allowed | V | 942 | Permissive Cross-domain Policy with Untrusted Domains |