Skip to main content

CWE Compatibility

DerScanner provides functionality to address vulnerabilities according to the CWE Vulnerability Classification.

Common Weakness Enumeration (CWE™) is a community-developed list of common software and hardware weakness types that have security ramifications. “Weaknesses” are flaws, faults, bugs, vulnerabilities, or other errors in software or hardware implementation, code, design, or architecture that if left unaddressed could result in systems, networks, or hardware being vulnerable to attack. The CWE List and associated classification taxonomy serve as a language that can be used to identify and describe these weaknesses in terms of CWEs.1

In DerScanner you can:

  • View references to corresponding CWE (version 4.0) items in the rule card or rule tags (see Rules).
  • Search/filter rules by CWE Vulnerability Classification.
  • Create custom rules with references to the corresponding CWE items (see Custom Rules).
  • Map found vulnerabilities to the corresponding CWE items.
  • Generate reports in PDF, HTML, and CSV formats according to the CWE/SANS Top 25 Vulnerability Classification (see Export Report).

In DerScanner interface and reports, every CWE item goes with a corresponding CWE identifier to facilitate the search and navigation.