CISQ Quality Measures - Security

Opis

Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.

Wpisy w tej grupie

• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
• CWE-91 XML Injection (aka Blind XPath Injection)
• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-129 Improper Validation of Array Index
• CWE-134 Use of Externally-Controlled Format String
• CWE-252 Unchecked Return Value
• CWE-404 Improper Resource Shutdown or Release
• CWE-424 Improper Protection of Alternate Path
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-477 Use of Obsolete Function
• CWE-480 Use of Incorrect Operator
• CWE-502 Deserialization of Untrusted Data
• CWE-570 Expression is Always False
• CWE-571 Expression is Always True
• CWE-606 Unchecked Input for Loop Condition
• CWE-611 Improper Restriction of XML External Entity Reference
• CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
• CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
• CWE-662 Improper Synchronization
• CWE-665 Improper Initialization
• CWE-672 Operation on a Resource after Expiration or Release
• CWE-681 Incorrect Conversion between Numeric Types
• CWE-682 Incorrect Calculation
• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-778 Insufficient Logging
• CWE-783 Operator Precedence Logic Error
• CWE-789 Memory Allocation with Excessive Size Value
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-798 Use of Hard-coded Credentials
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')

Źródła