CWE Cross-section

Opis

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Wpisy w tej grupie

• CWE-14 Compiler Removal of Code to Clear Buffers
• CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
• CWE-23 Relative Path Traversal
• CWE-36 Absolute Path Traversal
• CWE-41 Improper Resolution of Path Equivalence
• CWE-59 Improper Link Resolution Before File Access ('Link Following')
• CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
• CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
• CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
• CWE-94 Improper Control of Generation of Code ('Code Injection')
• CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
• CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
• CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
• CWE-117 Improper Output Neutralization for Logs
• CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
• CWE-129 Improper Validation of Array Index
• CWE-131 Incorrect Calculation of Buffer Size
• CWE-134 Use of Externally-Controlled Format String
• CWE-135 Incorrect Calculation of Multi-Byte String Length
• CWE-170 Improper Null Termination
• CWE-173 Improper Handling of Alternate Encoding
• CWE-174 Double Decoding of the Same Data
• CWE-175 Improper Handling of Mixed Encoding
• CWE-179 Incorrect Behavior Order: Early Validation
• CWE-185 Incorrect Regular Expression
• CWE-190 Integer Overflow or Wraparound
• CWE-191 Integer Underflow (Wrap or Wraparound)
• CWE-193 Off-by-one Error
• CWE-203 Observable Discrepancy
• CWE-209 Generation of Error Message Containing Sensitive Information
• CWE-212 Improper Removal of Sensitive Information Before Storage or Transfer
• CWE-222 Truncation of Security-relevant Information
• CWE-223 Omission of Security-relevant Information
• CWE-228 Improper Handling of Syntactically Invalid Structure
• CWE-244 Improper Clearing of Heap Memory Before Release ('Heap Inspection')
• CWE-248 Uncaught Exception
• CWE-250 Execution with Unnecessary Privileges
• CWE-252 Unchecked Return Value
• CWE-253 Incorrect Check of Function Return Value
• CWE-262 Not Using Password Aging
• CWE-263 Password Aging with Long Expiration
• CWE-266 Incorrect Privilege Assignment
• CWE-267 Privilege Defined With Unsafe Actions
• CWE-268 Privilege Chaining
• CWE-270 Privilege Context Switching Error
• CWE-271 Privilege Dropping / Lowering Errors
• CWE-273 Improper Check for Dropped Privileges
• CWE-283 Unverified Ownership
• CWE-290 Authentication Bypass by Spoofing
• CWE-294 Authentication Bypass by Capture-replay
• CWE-296 Improper Following of a Certificate's Chain of Trust
• CWE-299 Improper Check for Certificate Revocation
• CWE-300 Channel Accessible by Non-Endpoint
• CWE-301 Reflection Attack in an Authentication Protocol
• CWE-304 Missing Critical Step in Authentication
• CWE-306 Missing Authentication for Critical Function
• CWE-307 Improper Restriction of Excessive Authentication Attempts
• CWE-308 Use of Single-factor Authentication
• CWE-312 Cleartext Storage of Sensitive Information
• CWE-319 Cleartext Transmission of Sensitive Information
• CWE-322 Key Exchange without Entity Authentication
• CWE-323 Reusing a Nonce, Key Pair in Encryption
• CWE-325 Missing Cryptographic Step
• CWE-327 Use of a Broken or Risky Cryptographic Algorithm
• CWE-331 Insufficient Entropy
• CWE-334 Small Space of Random Values
• CWE-335 Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG)
• CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
• CWE-341 Predictable from Observable State
• CWE-347 Improper Verification of Cryptographic Signature
• CWE-348 Use of Less Trusted Source
• CWE-349 Acceptance of Extraneous Untrusted Data With Trusted Data
• CWE-352 Cross-Site Request Forgery (CSRF)
• CWE-353 Missing Support for Integrity Check
• CWE-354 Improper Validation of Integrity Check Value
• CWE-364 Signal Handler Race Condition
• CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition
• CWE-369 Divide By Zero
• CWE-390 Detection of Error Condition Without Action
• CWE-392 Missing Report of Error Condition
• CWE-393 Return of Wrong Status Code
• CWE-400 Uncontrolled Resource Consumption
• CWE-406 Insufficient Control of Network Message Volume (Network Amplification)
• CWE-407 Inefficient Algorithmic Complexity
• CWE-408 Incorrect Behavior Order: Early Amplification
• CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
• CWE-434 Unrestricted Upload of File with Dangerous Type
• CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
• CWE-451 User Interface (UI) Misrepresentation of Critical Information
• CWE-453 Insecure Default Variable Initialization
• CWE-454 External Initialization of Trusted Variables or Data Stores
• CWE-455 Non-exit on Failed Initialization
• CWE-456 Missing Initialization of a Variable
• CWE-467 Use of sizeof() on a Pointer Type
• CWE-468 Incorrect Pointer Scaling
• CWE-469 Use of Pointer Subtraction to Determine Size
• CWE-470 Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
• CWE-476 NULL Pointer Dereference
• CWE-478 Missing Default Case in Multiple Condition Expression
• CWE-480 Use of Incorrect Operator
• CWE-483 Incorrect Block Delimitation
• CWE-484 Omitted Break Statement in Switch
• CWE-486 Comparison of Classes by Name
• CWE-494 Download of Code Without Integrity Check
• CWE-495 Private Data Structure Returned From A Public Method
• CWE-496 Public Data Assigned to Private Array-Typed Field
• CWE-498 Cloneable Class Containing Sensitive Information
• CWE-499 Serializable Class Containing Sensitive Data
• CWE-502 Deserialization of Untrusted Data
• CWE-521 Weak Password Requirements
• CWE-522 Insufficiently Protected Credentials
• CWE-546 Suspicious Comment
• CWE-547 Use of Hard-coded, Security-relevant Constants
• CWE-561 Dead Code
• CWE-563 Assignment to Variable without Use
• CWE-567 Unsynchronized Access to Shared Data in a Multithreaded Context
• CWE-587 Assignment of a Fixed Address to a Pointer
• CWE-595 Comparison of Object References Instead of Object Contents
• CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
• CWE-602 Client-Side Enforcement of Server-Side Security
• CWE-605 Multiple Binds to the Same Port
• CWE-617 Reachable Assertion
• CWE-621 Variable Extraction Error
• CWE-627 Dynamic Variable Evaluation
• CWE-628 Function Call with Incorrectly Specified Arguments
• CWE-642 External Control of Critical State Data
• CWE-648 Incorrect Use of Privileged APIs
• CWE-667 Improper Locking
• CWE-672 Operation on a Resource after Expiration or Release
• CWE-674 Uncontrolled Recursion
• CWE-676 Use of Potentially Dangerous Function
• CWE-681 Incorrect Conversion between Numeric Types
• CWE-698 Execution After Redirect (EAR)
• CWE-708 Incorrect Ownership Assignment
• CWE-732 Incorrect Permission Assignment for Critical Resource
• CWE-756 Missing Custom Error Page
• CWE-763 Release of Invalid Pointer or Reference
• CWE-770 Allocation of Resources Without Limits or Throttling
• CWE-772 Missing Release of Resource after Effective Lifetime
• CWE-783 Operator Precedence Logic Error
• CWE-786 Access of Memory Location Before Start of Buffer
• CWE-788 Access of Memory Location After End of Buffer
• CWE-798 Use of Hard-coded Credentials
• CWE-805 Buffer Access with Incorrect Length Value
• CWE-807 Reliance on Untrusted Inputs in a Security Decision
• CWE-822 Untrusted Pointer Dereference
• CWE-825 Expired Pointer Dereference
• CWE-829 Inclusion of Functionality from Untrusted Control Sphere
• CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
• CWE-838 Inappropriate Encoding for Output Context
• CWE-839 Numeric Range Comparison Without Minimum Check
• CWE-841 Improper Enforcement of Behavioral Workflow
• CWE-862 Missing Authorization
• CWE-863 Incorrect Authorization