OWASP Top Ten 2025 Category A06:2025 - Insecure Design

Opis

Weaknesses in this category are related to the A06 category "Insecure Design" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-1021 Improper Restriction of Rendered UI Layers or Frames
• CWE-1022 Use of Web Link to Untrusted Target with window.opener Access
• CWE-1125 Excessive Attack Surface
• CWE-183 Permissive List of Allowed Inputs
• CWE-256 Plaintext Storage of a Password
• CWE-266 Incorrect Privilege Assignment
• CWE-269 Improper Privilege Management
• CWE-286 Incorrect User Management
• CWE-311 Missing Encryption of Sensitive Data
• CWE-312 Cleartext Storage of Sensitive Information
• CWE-313 Cleartext Storage in a File or on Disk
• CWE-316 Cleartext Storage of Sensitive Information in Memory
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CWE-382 J2EE Bad Practices: Use of System.exit()
• CWE-419 Unprotected Primary Channel
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-436 Interpretation Conflict
• CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
• CWE-451 User Interface (UI) Misrepresentation of Critical Information
• CWE-454 External Initialization of Trusted Variables or Data Stores
• CWE-472 External Control of Assumed-Immutable Web Parameter
• CWE-501 Trust Boundary Violation
• CWE-522 Insufficiently Protected Credentials
• CWE-525 Use of Web Browser Cache Containing Sensitive Information
• CWE-539 Use of Persistent Cookies Containing Sensitive Information
• CWE-598 Use of HTTP Request With Sensitive Query String
• CWE-602 Client-Side Enforcement of Server-Side Security
• CWE-628 Function Call with Incorrectly Specified Arguments
• CWE-642 External Control of Critical State Data
• CWE-646 Reliance on File Name or Extension of Externally-Supplied File
• CWE-653 Improper Isolation or Compartmentalization
• CWE-656 Reliance on Security Through Obscurity
• CWE-657 Violation of Secure Design Principles
• CWE-676 Use of Potentially Dangerous Function
• CWE-693 Protection Mechanism Failure
• CWE-73 External Control of File Name or Path
• CWE-799 Improper Control of Interaction Frequency
• CWE-807 Reliance on Untrusted Inputs in a Security Decision
• CWE-841 Improper Enforcement of Behavioral Workflow

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła