Comprehensive Categorization for Software Assurance Trends

Opis

Wpisy w tej grupie

• CWE-1396 Comprehensive Categorization: Access Control
• CWE-1397 Comprehensive Categorization: Comparison
• CWE-1398 Comprehensive Categorization: Component Interaction
• CWE-1401 Comprehensive Categorization: Concurrency
• CWE-1402 Comprehensive Categorization: Encryption
• CWE-1403 Comprehensive Categorization: Exposed Resource
• CWE-1404 Comprehensive Categorization: File Handling
• CWE-1405 Comprehensive Categorization: Improper Check or Handling of Exceptional Conditions
• CWE-1406 Comprehensive Categorization: Improper Input Validation
• CWE-1407 Comprehensive Categorization: Improper Neutralization
• CWE-1408 Comprehensive Categorization: Incorrect Calculation
• CWE-1409 Comprehensive Categorization: Injection
• CWE-1410 Comprehensive Categorization: Insufficient Control Flow Management
• CWE-1411 Comprehensive Categorization: Insufficient Verification of Data Authenticity
• CWE-1399 Comprehensive Categorization: Memory Safety
• CWE-1412 Comprehensive Categorization: Poor Coding Practices
• CWE-1413 Comprehensive Categorization: Protection Mechanism Failure
• CWE-1414 Comprehensive Categorization: Randomness
• CWE-1415 Comprehensive Categorization: Resource Control
• CWE-1416 Comprehensive Categorization: Resource Lifecycle Management
• CWE-1417 Comprehensive Categorization: Sensitive Information Exposure
• CWE-1418 Comprehensive Categorization: Violation of Secure Design Principles

Uwagi

This view is different than the software development view (CWE-699) because this view is expected to include all weaknesses regardless of abstraction, while view 699 uses a largely-fixed Base level of abstraction related only to software weaknesses. It is different from the Research view (CWE-1000) because while comprehensive for all weaknesses, the view uses a deep hierarchical structure and excludes categories.