Weaknesses Originally Used by NVD from 2008 to 2016

Opis

CWE nodes in this view (slice) were used by NIST to categorize vulnerabilities within NVD, from 2008 to 2016. This original version has been used by many other projects.

Wpisy w tej grupie

• CWE-16 Configuration
• CWE-189 Numeric Errors
• CWE-255 Credentials Management Errors
• CWE-264 Permissions, Privileges, and Access Controls
• CWE-310 Cryptographic Issues
• CWE-399 Resource Management Errors
• CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
• CWE-134 Use of Externally-Controlled Format String
• CWE-20 Improper Input Validation
• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-287 Improper Authentication
• CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• CWE-352 Cross-Site Request Forgery (CSRF)

Uwagi

<xhtml:p>In Summer 2007, NIST began using this set of CWE elements to classify CVE entries within the National Vulnerability Database (NVD). The data was made publicly available beginning in 2008. In 2016, NIST began using a different list as derived from the "Weaknesses for Simplified Mapping of Published Vulnerabilities" view (CWE-1003).</xhtml:p>

Źródła