CWE-1409 · Kategoria
Comprehensive Categorization: Injection
- Status
- Niekompletny
- Dodano
- 25 kwietnia 2023
- Ostatnia zmiana
- 19 listopada 2024
Opis
Weaknesses in this category are related to injection.
Wpisy w tej grupie
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
- CWE-76 Improper Neutralization of Equivalent Special Elements
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CWE-81 Improper Neutralization of Script in an Error Message Web Page
- CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
- CWE-83 Improper Neutralization of Script in Attributes in a Web Page
- CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page
- CWE-85 Doubled Character XSS Manipulations
- CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages
- CWE-87 Improper Neutralization of Alternate XSS Syntax
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
- CWE-91 XML Injection (aka Blind XPath Injection)
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CWE-94 Improper Control of Generation of Code ('Code Injection')
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
- CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
- CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
- CWE-102 Struts: Duplicate Validation Forms
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
- CWE-564 SQL Injection: Hibernate
- CWE-621 Variable Extraction Error
- CWE-624 Executable Regular Expression Error
- CWE-627 Dynamic Variable Evaluation
- CWE-641 Improper Restriction of Names for Files and Other Resources
- CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
- CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
- CWE-692 Incomplete Denylist to Cross-Site Scripting
- CWE-694 Use of Multiple Resources with Duplicate Identifier
- CWE-914 Improper Control of Dynamically-Identified Variables
- CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
- CWE-943 Improper Neutralization of Special Elements in Data Query Logic
- CWE-1236 Improper Neutralization of Formula Elements in a CSV File
- CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine
- CWE-1426 Improper Validation of Generative AI Output
- CWE-1427 Improper Neutralization of Input Used for LLM Prompting
Źródła
Wpis z katalogu CWE 4.20.