Weaknesses in OWASP Top Ten (2004)

Opis

CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2004, and as required for compliance with PCI DSS version 1.1. This view is considered obsolete as a newer version of the OWASP Top Ten is available.

Wpisy w tej grupie

• CWE-722 OWASP Top Ten 2004 Category A1 - Unvalidated Input
• CWE-723 OWASP Top Ten 2004 Category A2 - Broken Access Control
• CWE-724 OWASP Top Ten 2004 Category A3 - Broken Authentication and Session Management
• CWE-725 OWASP Top Ten 2004 Category A4 - Cross-Site Scripting (XSS) Flaws
• CWE-726 OWASP Top Ten 2004 Category A5 - Buffer Overflows
• CWE-727 OWASP Top Ten 2004 Category A6 - Injection Flaws
• CWE-728 OWASP Top Ten 2004 Category A7 - Improper Error Handling
• CWE-729 OWASP Top Ten 2004 Category A8 - Insecure Storage
• CWE-730 OWASP Top Ten 2004 Category A9 - Denial of Service
• CWE-731 OWASP Top Ten 2004 Category A10 - Insecure Configuration Management

Uwagi

CWE relationships for this view were obtained by examining the OWASP document and mapping to any items that were specifically mentioned within the text of a category. As a result, this mapping is not complete with respect to all of CWE. In addition, some concepts were mentioned in multiple Top Ten items, which caused them to be mapped to multiple CWE categories. For example, SQL injection is mentioned in both A1 (CWE-722) and A6 (CWE-727) categories.

As of 2008, some parts of CWE were not fully clarified out in terms of weaknesses. When these areas were mentioned in the OWASP Top Ten, category entries were mapped, although general mapping practice would usually favor mapping only to weaknesses.

Źródła