CWE-990 · Kategoria
SFP Secondary Cluster: Tainted Input to Command
- Status
- Niekompletny
- Dodano
- 29 lipca 2014
- Ostatnia zmiana
- 29 czerwca 2023
Opis
This category identifies Software Fault Patterns (SFPs) within the Tainted Input to Command cluster (SFP24).
Wpisy w tej grupie
- CWE-102 Struts: Duplicate Validation Forms
- CWE-103 Struts: Incomplete validate() Method Definition
- CWE-104 Struts: Form Bean Does Not Extend Validation Class
- CWE-105 Struts: Form Field Without Validator
- CWE-106 Struts: Plug-in Framework not in Use
- CWE-107 Struts: Unused Validation Form
- CWE-108 Struts: Unvalidated Action Form
- CWE-109 Struts: Validator Turned Off
- CWE-110 Struts: Validator Without Form Field
- CWE-112 Missing XML Validation
- CWE-113 Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')
- CWE-130 Improper Handling of Length Parameter Inconsistency
- CWE-134 Use of Externally-Controlled Format String
- CWE-138 Improper Neutralization of Special Elements
- CWE-140 Improper Neutralization of Delimiters
- CWE-141 Improper Neutralization of Parameter/Argument Delimiters
- CWE-142 Improper Neutralization of Value Delimiters
- CWE-143 Improper Neutralization of Record Delimiters
- CWE-144 Improper Neutralization of Line Delimiters
- CWE-145 Improper Neutralization of Section Delimiters
- CWE-146 Improper Neutralization of Expression/Command Delimiters
- CWE-147 Improper Neutralization of Input Terminators
- CWE-148 Improper Neutralization of Input Leaders
- CWE-149 Improper Neutralization of Quoting Syntax
- CWE-150 Improper Neutralization of Escape, Meta, or Control Sequences
- CWE-151 Improper Neutralization of Comment Delimiters
- CWE-152 Improper Neutralization of Macro Symbols
- CWE-153 Improper Neutralization of Substitution Characters
- CWE-154 Improper Neutralization of Variable Name Delimiters
- CWE-155 Improper Neutralization of Wildcards or Matching Symbols
- CWE-156 Improper Neutralization of Whitespace
- CWE-157 Failure to Sanitize Paired Delimiters
- CWE-158 Improper Neutralization of Null Byte or NUL Character
- CWE-159 Improper Handling of Invalid Use of Special Elements
- CWE-160 Improper Neutralization of Leading Special Elements
- CWE-161 Improper Neutralization of Multiple Leading Special Elements
- CWE-162 Improper Neutralization of Trailing Special Elements
- CWE-163 Improper Neutralization of Multiple Trailing Special Elements
- CWE-164 Improper Neutralization of Internal Special Elements
- CWE-165 Improper Neutralization of Multiple Internal Special Elements
- CWE-183 Permissive List of Allowed Inputs
- CWE-184 Incomplete List of Disallowed Inputs
- CWE-185 Incorrect Regular Expression
- CWE-186 Overly Restrictive Regular Expression
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')
- CWE-553 Command Shell in Externally Accessible Directory
- CWE-554 ASP.NET Misconfiguration: Not Using Input Validation Framework
- CWE-564 SQL Injection: Hibernate
- CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
- CWE-611 Improper Restriction of XML External Entity Reference
- CWE-619 Dangling Database Cursor ('Cursor Injection')
- CWE-621 Variable Extraction Error
- CWE-624 Executable Regular Expression Error
- CWE-625 Permissive Regular Expression
- CWE-626 Null Byte Interaction Error (Poison Null Byte)
- CWE-627 Dynamic Variable Evaluation
- CWE-641 Improper Restriction of Names for Files and Other Resources
- CWE-643 Improper Neutralization of Data within XPath Expressions ('XPath Injection')
- CWE-644 Improper Neutralization of HTTP Headers for Scripting Syntax
- CWE-646 Reliance on File Name or Extension of Externally-Supplied File
- CWE-652 Improper Neutralization of Data within XQuery Expressions ('XQuery Injection')
- CWE-687 Function Call With Incorrectly Specified Argument Value
- CWE-707 Improper Neutralization
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- CWE-75 Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
- CWE-76 Improper Neutralization of Equivalent Special Elements
- CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CWE-81 Improper Neutralization of Script in an Error Message Web Page
- CWE-82 Improper Neutralization of Script in Attributes of IMG Tags in a Web Page
- CWE-83 Improper Neutralization of Script in Attributes in a Web Page
- CWE-84 Improper Neutralization of Encoded URI Schemes in a Web Page
- CWE-85 Doubled Character XSS Manipulations
- CWE-86 Improper Neutralization of Invalid Characters in Identifiers in Web Pages
- CWE-87 Improper Neutralization of Alternate XSS Syntax
- CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
- CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
- CWE-90 Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection')
- CWE-91 XML Injection (aka Blind XPath Injection)
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')
- CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
- CWE-96 Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
- CWE-97 Improper Neutralization of Server-Side Includes (SSI) Within a Web Page
- CWE-99 Improper Control of Resource Identifiers ('Resource Injection')
Wpis z katalogu CWE 4.20.