OWASP Top Ten 2021 Category A02:2021 - Cryptographic Failures

Opis

Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021.

Wpisy w tej grupie

• CWE-261 Weak Encoding for Password
• CWE-296 Improper Following of a Certificate's Chain of Trust
• CWE-310 Cryptographic Issues
• CWE-319 Cleartext Transmission of Sensitive Information
• CWE-321 Use of Hard-coded Cryptographic Key
• CWE-322 Key Exchange without Entity Authentication
• CWE-323 Reusing a Nonce, Key Pair in Encryption
• CWE-324 Use of a Key Past its Expiration Date
• CWE-325 Missing Cryptographic Step
• CWE-326 Inadequate Encryption Strength
• CWE-327 Use of a Broken or Risky Cryptographic Algorithm
• CWE-328 Use of Weak Hash
• CWE-329 Generation of Predictable IV with CBC Mode
• CWE-330 Use of Insufficiently Random Values
• CWE-331 Insufficient Entropy
• CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
• CWE-336 Same Seed in Pseudo-Random Number Generator (PRNG)
• CWE-337 Predictable Seed in Pseudo-Random Number Generator (PRNG)
• CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CWE-340 Generation of Predictable Numbers or Identifiers
• CWE-347 Improper Verification of Cryptographic Signature
• CWE-523 Unprotected Transport of Credentials
• CWE-720 OWASP Top Ten 2007 Category A9 - Insecure Communications
• CWE-757 Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
• CWE-759 Use of a One-Way Hash without a Salt
• CWE-760 Use of a One-Way Hash with a Predictable Salt
• CWE-780 Use of RSA Algorithm without OAEP
• CWE-818 OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection
• CWE-916 Use of Password Hash With Insufficient Computational Effort

Uwagi

As of CWE 4.6, the relationships in this category were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła