CISQ Quality Measures (2016) - Security

Opis

Weaknesses in this category are related to the CISQ Quality Measures for Security, as documented in 2016 with the Automated Source Code Security Measure (ASCSM) Specification 1.0. Presence of these weaknesses could reduce the security of the software.

Wpisy w tej grupie

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-129 Improper Validation of Array Index
• CWE-134 Use of Externally-Controlled Format String
• CWE-252 Unchecked Return Value
• CWE-327 Use of a Broken or Risky Cryptographic Algorithm
• CWE-396 Declaration of Catch for Generic Exception
• CWE-397 Declaration of Throws for Generic Exception
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-456 Missing Initialization of a Variable
• CWE-606 Unchecked Input for Loop Condition
• CWE-667 Improper Locking
• CWE-672 Operation on a Resource after Expiration or Release
• CWE-681 Incorrect Conversion between Numeric Types
• CWE-772 Missing Release of Resource after Effective Lifetime
• CWE-789 Memory Allocation with Excessive Size Value
• CWE-798 Use of Hard-coded Credentials
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Źródła