  The Common Weakness Enumeration (CWE) is a prominent list of software
weakness types. This list is used by vulnerability databases to describe the
underlying security flaws within analyzed vulnerabilities. This linkage opens
the possibility of using the analysis of software vulnerabilities to identify
the most significant weaknesses that enable those vulnerabilities. We
accomplish this through creating mashup views combining CWE weakness taxonomies
with vulnerability analysis data. The resulting graphs have CWEs as nodes,
edges derived from multiple CWE taxonomies, and nodes adorned with
vulnerability analysis information (propagated from children to parents). Using
these graphs, we develop a suite of metrics to identify the most significant
weakness types (using the perspectives of frequency, impact, exploitability,
and overall severity).
