OWASP Top Ten 2025 Category A08:2025 - Software or Data Integrity Failures

Opis

Weaknesses in this category are related to the A08 category "Software or Data Integrity Failures" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-345 Insufficient Verification of Data Authenticity
• CWE-353 Missing Support for Integrity Check
• CWE-426 Untrusted Search Path
• CWE-427 Uncontrolled Search Path Element
• CWE-494 Download of Code Without Integrity Check
• CWE-502 Deserialization of Untrusted Data
• CWE-506 Embedded Malicious Code
• CWE-509 Replicating Malicious Code (Virus or Worm)
• CWE-565 Reliance on Cookies without Validation and Integrity Checking
• CWE-784 Reliance on Cookies without Validation and Integrity Checking in a Security Decision
• CWE-829 Inclusion of Functionality from Untrusted Control Sphere
• CWE-830 Inclusion of Web Functionality from an Untrusted Source
• CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes
• CWE-926 Improper Export of Android Application Components

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła