CISQ Data Protection Measures

Opis

This view outlines the SMM representation of the Automated Source Code Data Protection Measurement specifications, as identified by the Consortium for Information & Software Quality (CISQ) Working Group.

Wpisy w tej grupie

• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-672 Operation on a Resource after Expiration or Release
• CWE-665 Improper Initialization
• CWE-404 Improper Resource Shutdown or Release
• CWE-611 Improper Restriction of XML External Entity Reference
• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
• CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
• CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
• CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-91 XML Injection (aka Blind XPath Injection)
• CWE-1051 Initialization with Hard-Coded Network Resource Configuration Data
• CWE-424 Improper Protection of Alternate Path
• CWE-798 Use of Hard-coded Credentials
• CWE-681 Incorrect Conversion between Numeric Types
• CWE-662 Improper Synchronization
• CWE-704 Incorrect Type Conversion or Cast
• CWE-562 Return of Stack Variable Address
• CWE-170 Improper Null Termination
• CWE-129 Improper Validation of Array Index
• CWE-134 Use of Externally-Controlled Format String
• CWE-606 Unchecked Input for Loop Condition
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-703 Improper Check or Handling of Exceptional Conditions
• CWE-908 Use of Uninitialized Resource
• CWE-682 Incorrect Calculation
• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-502 Deserialization of Untrusted Data
• CWE-213 Exposure of Sensitive Information Due to Incompatible Policies
• CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
• CWE-311 Missing Encryption of Sensitive Data
• CWE-359 Exposure of Private Personal Information to an Unauthorized Actor
• CWE-284 Improper Access Control

Źródła