Encrypt Data

Opis

Weaknesses in this category are related to the design and architecture of data confidentiality in a system. Frequently these deal with the use of encryption libraries. The weaknesses in this category could lead to a degradation of the quality data encryption if they are not addressed when designing or implementing a secure architecture.

Wpisy w tej grupie

• CWE-256 Plaintext Storage of a Password
• CWE-257 Storing Passwords in a Recoverable Format
• CWE-260 Password in Configuration File
• CWE-261 Weak Encoding for Password
• CWE-311 Missing Encryption of Sensitive Data
• CWE-312 Cleartext Storage of Sensitive Information
• CWE-313 Cleartext Storage in a File or on Disk
• CWE-314 Cleartext Storage in the Registry
• CWE-315 Cleartext Storage of Sensitive Information in a Cookie
• CWE-316 Cleartext Storage of Sensitive Information in Memory
• CWE-317 Cleartext Storage of Sensitive Information in GUI
• CWE-318 Cleartext Storage of Sensitive Information in Executable
• CWE-319 Cleartext Transmission of Sensitive Information
• CWE-321 Use of Hard-coded Cryptographic Key
• CWE-323 Reusing a Nonce, Key Pair in Encryption
• CWE-324 Use of a Key Past its Expiration Date
• CWE-325 Missing Cryptographic Step
• CWE-326 Inadequate Encryption Strength
• CWE-327 Use of a Broken or Risky Cryptographic Algorithm
• CWE-328 Use of Weak Hash
• CWE-330 Use of Insufficiently Random Values
• CWE-331 Insufficient Entropy
• CWE-332 Insufficient Entropy in PRNG
• CWE-333 Improper Handling of Insufficient Entropy in TRNG
• CWE-334 Small Space of Random Values
• CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
• CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG)
• CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
• CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CWE-339 Small Seed Space in PRNG
• CWE-347 Improper Verification of Cryptographic Signature
• CWE-522 Insufficiently Protected Credentials
• CWE-523 Unprotected Transport of Credentials
• CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
• CWE-759 Use of a One-Way Hash without a Salt
• CWE-760 Use of a One-Way Hash with a Predictable Salt
• CWE-780 Use of RSA Algorithm without OAEP
• CWE-922 Insecure Storage of Sensitive Information

Źródła