Overview
This reference provides detailed information about each impact category, including which CWEs (Common Weakness Enumeration) map to each impact. Use this to understand what types of vulnerabilities fall under each impact category. For a high-level overview of impacts, see Impacts.Impact details
Execute Commands
Execute Commands
Execute arbitrary code or commands.Associated CWEs:
Takeover Accounts
Takeover Accounts
Authenticate as another user or hijack sessions.Associated CWEs:
Gain Access
Gain Access
Bypass authorization or escalate privileges.Associated CWEs:
Obtain Secrets
Obtain Secrets
Extract credentials or keys for reuse.Associated CWEs:
Access Data
Access Data
Read or manipulate structured data.Associated CWEs:
Access Files
Access Files
Read or modify files or paths.Associated CWEs:
Intercept Traffic
Intercept Traffic
Observe or alter data in transit.Associated CWEs:
Insufficient Data Protection
Insufficient Data Protection
Sensitive data at rest is not adequately protected.Associated CWEs:
Bypass Cryptographic Controls
Bypass Cryptographic Controls
Predict or undermine cryptographic controls.Associated CWEs:
Facilitate Client-side Attacks
Facilitate Client-side Attacks
Target end users.Associated CWEs:
Access Application State
Access Application State
Learn internal state or configuration.Associated CWEs:
Evade Detection
Evade Detection
Avoid logging or monitoring.Associated CWEs:
Degrade Performance
Degrade Performance
Exhaust resources or reduce availability.Associated CWEs:
Related docs
- Impacts: overview of impact categories
- Code Security Rules: security rule coverage by language