OWASP Top Ten 2025 Category A10:2025 - Mishandling of Exceptional Conditions

Opis

Weaknesses in this category are related to the A10 category "Mishandling of Exceptional Conditions" in the OWASP Top Ten 2025.

Wpisy w tej grupie

• CWE-209 Generation of Error Message Containing Sensitive Information
• CWE-215 Insertion of Sensitive Information Into Debugging Code
• CWE-234 Failure to Handle Missing Parameter
• CWE-235 Improper Handling of Extra Parameters
• CWE-248 Uncaught Exception
• CWE-252 Unchecked Return Value
• CWE-274 Improper Handling of Insufficient Privileges
• CWE-280 Improper Handling of Insufficient Permissions or Privileges
• CWE-369 Divide By Zero
• CWE-390 Detection of Error Condition Without Action
• CWE-391 Unchecked Error Condition
• CWE-394 Unexpected Status Code or Return Value
• CWE-396 Declaration of Catch for Generic Exception
• CWE-397 Declaration of Throws for Generic Exception
• CWE-460 Improper Cleanup on Thrown Exception
• CWE-476 NULL Pointer Dereference
• CWE-478 Missing Default Case in Multiple Condition Expression
• CWE-484 Omitted Break Statement in Switch
• CWE-550 Server-generated Error Message Containing Sensitive Information
• CWE-636 Not Failing Securely ('Failing Open')
• CWE-703 Improper Check or Handling of Exceptional Conditions
• CWE-754 Improper Check for Unusual or Exceptional Conditions
• CWE-755 Improper Handling of Exceptional Conditions
• CWE-756 Missing Custom Error Page

Uwagi

As of CWE 4.19, the relationships in this category were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten. These mappings include categories, which are discouraged for mapping, as well as high-level weaknesses such as Pillars. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Źródła