CWE-1396 · Kategoria
Comprehensive Categorization: Access Control
- Status
- Niekompletny
- Dodano
- 25 kwietnia 2023
- Ostatnia zmiana
- 29 czerwca 2023
Opis
Weaknesses in this category are related to access control.
Wpisy w tej grupie
- CWE-9 J2EE Misconfiguration: Weak Access Permissions for EJB Methods
- CWE-13 ASP.NET Misconfiguration: Password in Configuration File
- CWE-202 Exposure of Sensitive Information Through Data Queries
- CWE-256 Plaintext Storage of a Password
- CWE-257 Storing Passwords in a Recoverable Format
- CWE-258 Empty Password in Configuration File
- CWE-259 Use of Hard-coded Password
- CWE-260 Password in Configuration File
- CWE-261 Weak Encoding for Password
- CWE-262 Not Using Password Aging
- CWE-263 Password Aging with Long Expiration
- CWE-266 Incorrect Privilege Assignment
- CWE-267 Privilege Defined With Unsafe Actions
- CWE-268 Privilege Chaining
- CWE-269 Improper Privilege Management
- CWE-270 Privilege Context Switching Error
- CWE-271 Privilege Dropping / Lowering Errors
- CWE-272 Least Privilege Violation
- CWE-273 Improper Check for Dropped Privileges
- CWE-274 Improper Handling of Insufficient Privileges
- CWE-276 Incorrect Default Permissions
- CWE-277 Insecure Inherited Permissions
- CWE-278 Insecure Preserved Inherited Permissions
- CWE-279 Incorrect Execution-Assigned Permissions
- CWE-280 Improper Handling of Insufficient Permissions or Privileges
- CWE-281 Improper Preservation of Permissions
- CWE-282 Improper Ownership Management
- CWE-283 Unverified Ownership
- CWE-284 Improper Access Control
- CWE-285 Improper Authorization
- CWE-286 Incorrect User Management
- CWE-287 Improper Authentication
- CWE-288 Authentication Bypass Using an Alternate Path or Channel
- CWE-289 Authentication Bypass by Alternate Name
- CWE-290 Authentication Bypass by Spoofing
- CWE-291 Reliance on IP Address for Authentication
- CWE-293 Using Referer Field for Authentication
- CWE-294 Authentication Bypass by Capture-replay
- CWE-295 Improper Certificate Validation
- CWE-296 Improper Following of a Certificate's Chain of Trust
- CWE-297 Improper Validation of Certificate with Host Mismatch
- CWE-298 Improper Validation of Certificate Expiration
- CWE-299 Improper Check for Certificate Revocation
- CWE-300 Channel Accessible by Non-Endpoint
- CWE-301 Reflection Attack in an Authentication Protocol
- CWE-302 Authentication Bypass by Assumed-Immutable Data
- CWE-303 Incorrect Implementation of Authentication Algorithm
- CWE-304 Missing Critical Step in Authentication
- CWE-305 Authentication Bypass by Primary Weakness
- CWE-306 Missing Authentication for Critical Function
- CWE-307 Improper Restriction of Excessive Authentication Attempts
- CWE-308 Use of Single-factor Authentication
- CWE-309 Use of Password System for Primary Authentication
- CWE-321 Use of Hard-coded Cryptographic Key
- CWE-322 Key Exchange without Entity Authentication
- CWE-350 Reliance on Reverse DNS Resolution for a Security-Critical Action
- CWE-370 Missing Check for Certificate Revocation after Initial Check
- CWE-384 Session Fixation
- CWE-419 Unprotected Primary Channel
- CWE-420 Unprotected Alternate Channel
- CWE-421 Race Condition During Access to Alternate Channel
- CWE-422 Unprotected Windows Messaging Channel ('Shatter')
- CWE-425 Direct Request ('Forced Browsing')
- CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
- CWE-520 .NET Misconfiguration: Use of Impersonation
- CWE-521 Weak Password Requirements
- CWE-522 Insufficiently Protected Credentials
- CWE-523 Unprotected Transport of Credentials
- CWE-549 Missing Password Field Masking
- CWE-551 Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
- CWE-555 J2EE Misconfiguration: Plaintext Password in Configuration File
- CWE-556 ASP.NET Misconfiguration: Use of Identity Impersonation
- CWE-566 Authorization Bypass Through User-Controlled SQL Primary Key
- CWE-593 Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created
- CWE-599 Missing Validation of OpenSSL Certificate
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
- CWE-603 Use of Client-Side Authentication
- CWE-611 Improper Restriction of XML External Entity Reference
- CWE-612 Improper Authorization of Index Containing Sensitive Information
- CWE-613 Insufficient Session Expiration
- CWE-620 Unverified Password Change
- CWE-623 Unsafe ActiveX Control Marked Safe For Scripting
- CWE-639 Authorization Bypass Through User-Controlled Key
- CWE-640 Weak Password Recovery Mechanism for Forgotten Password
- CWE-645 Overly Restrictive Account Lockout Mechanism
- CWE-647 Use of Non-Canonical URL Paths for Authorization Decisions
- CWE-648 Incorrect Use of Privileged APIs
- CWE-708 Incorrect Ownership Assignment
- CWE-732 Incorrect Permission Assignment for Critical Resource
- CWE-798 Use of Hard-coded Credentials
- CWE-804 Guessable CAPTCHA
- CWE-836 Use of Password Hash Instead of Password for Authentication
- CWE-842 Placement of User into Incorrect Group
- CWE-862 Missing Authorization
- CWE-863 Incorrect Authorization
- CWE-918 Server-Side Request Forgery (SSRF)
- CWE-921 Storage of Sensitive Data in a Mechanism without Access Control
- CWE-923 Improper Restriction of Communication Channel to Intended Endpoints
- CWE-925 Improper Verification of Intent by Broadcast Receiver
- CWE-926 Improper Export of Android Application Components
- CWE-927 Use of Implicit Intent for Sensitive Communication
- CWE-939 Improper Authorization in Handler for Custom URL Scheme
- CWE-940 Improper Verification of Source of a Communication Channel
- CWE-941 Incorrectly Specified Destination in a Communication Channel
- CWE-942 Permissive Cross-domain Security Policy with Untrusted Domains
- CWE-1004 Sensitive Cookie Without 'HttpOnly' Flag
- CWE-1021 Improper Restriction of Rendered UI Layers or Frames
- CWE-1022 Use of Web Link to Untrusted Target with window.opener Access
- CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
- CWE-1220 Insufficient Granularity of Access Control
- CWE-1222 Insufficient Granularity of Address Regions Protected by Register Locks
- CWE-1224 Improper Restriction of Write-Once Bit Fields
- CWE-1230 Exposure of Sensitive Information Through Metadata
- CWE-1231 Improper Prevention of Lock Bit Modification
- CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection
- CWE-1242 Inclusion of Undocumented Features or Chicken Bits
- CWE-1243 Sensitive Non-Volatile Information Not Protected During Debug
- CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State
- CWE-1252 CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations
- CWE-1256 Improper Restriction of Software Interfaces to Hardware Features
- CWE-1257 Improper Access Control Applied to Mirrored or Aliased Memory Regions
- CWE-1259 Improper Restriction of Security Token Assignment
- CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges
- CWE-1262 Improper Access Control for Register Interface
- CWE-1263 Improper Physical Access Control
- CWE-1267 Policy Uses Obsolete Encoding
- CWE-1268 Policy Privileges are not Assigned Consistently Between Control and Data Agents
- CWE-1270 Generation of Incorrect Security Tokens
- CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code
- CWE-1275 Sensitive Cookie with Improper SameSite Attribute
- CWE-1276 Hardware Child Block Incorrectly Connected to Parent System
- CWE-1283 Mutable Attestation or Measurement Reporting Data
- CWE-1290 Incorrect Decoding of Security Identifiers
- CWE-1292 Incorrect Conversion of Security Identifiers
- CWE-1294 Insecure Security Identifier Mechanism
- CWE-1296 Incorrect Chaining or Granularity of Debug Components
- CWE-1297 Unprotected Confidential Information on Device is Accessible by OSAT Vendors
- CWE-1299 Missing Protection Mechanism for Alternate Hardware Interface
- CWE-1302 Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC)
- CWE-1304 Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation
- CWE-1311 Improper Translation of Security Attributes by Fabric Bridge
- CWE-1312 Missing Protection for Mirrored Regions in On-Chip Fabric Firewall
- CWE-1313 Hardware Allows Activation of Test or Debug Logic at Runtime
- CWE-1314 Missing Write Protection for Parametric Data Values
- CWE-1315 Improper Setting of Bus Controlling Capability in Fabric End-point
- CWE-1316 Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges
- CWE-1317 Improper Access Control in Fabric Bridge
- CWE-1320 Improper Protection for Outbound Error Messages and Alert Signals
- CWE-1323 Improper Management of Sensitive Trace Data
- CWE-1328 Security Version Number Mutable to Older Versions
- CWE-1334 Unauthorized Error Injection Can Degrade Hardware Redundancy
- CWE-1390 Weak Authentication
- CWE-1391 Use of Weak Credentials
- CWE-1392 Use of Default Credentials
- CWE-1393 Use of Default Password
- CWE-1394 Use of Default Cryptographic Key
Źródła
Wpis z katalogu CWE 4.20.