Detail Tampilan CWE-1344

CWE-1344

Weaknesses in OWASP Top Ten (2021)
2021-10-05 +00:00
Incomplete
Graph
2023-06-29 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Weaknesses in OWASP Top Ten (2021)

CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021.

Anggota CWE

CWE-1345: Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Dasar
CWE-23: Relative Path Traversal Dasar
CWE-35: Path Traversal: '.../...//' Dasar
CWE-59: Improper Link Resolution Before File Access Dasar
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Dasar
CWE-201: Insertion of Sensitive Information Into Sent Data Dasar
CWE-219: Storage of File with Sensitive Data Under Web Root Dasar
CWE-264: Permissions, Privileges, and Access Controls Kategori
CWE-275: Permission Issues Kategori
CWE-276: Incorrect Default Permissions Dasar
CWE-284: Improper Access Control Dasar
CWE-285: Improper Authorization Dasar
CWE-352: Cross-Site Request Forgery Dasar
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Dasar
CWE-377: DEPRECATED: Insecure Temporary File Dasar
CWE-402: Transmission of Private Resources into a New Sphere Dasar
CWE-425: Direct Request Dasar
CWE-441: Unintended Proxy or Intermediary Dasar
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Dasar
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Dasar
CWE-540: Inclusion of Sensitive Information in Source Code Dasar
CWE-548: Exposure of Information Through Directory Listing Dasar
CWE-552: Files or Directories Accessible to External Parties Dasar
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Dasar
CWE-601: URL Redirection to Untrusted Site Dasar
CWE-639: Authorization Bypass Through User-Controlled Key Dasar
CWE-651: Exposure of WSDL File Containing Sensitive Information Dasar
CWE-668: Exposure of Resource to Wrong Sphere Dasar
CWE-706: Use of Incorrectly-Resolved Name or Reference Dasar
CWE-862: Missing Authorization Dasar
CWE-863: Incorrect Authorization Dasar
CWE-913: Improper Control of Dynamically-Managed Code Resources Dasar
CWE-922: Insecure Storage of Sensitive Information Dasar
CWE-1275: Sensitive Cookie with Improper SameSite Attribute Dasar
CWE-1346: Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021.
CWE-261: Weak Encoding for Password Dasar
CWE-296: Improper Following of a Certificate's Chain of Trust Dasar
CWE-310: Cryptographic Issues Kategori
CWE-319: Cleartext Transmission of Sensitive Information Dasar
CWE-321: Use of Hard-coded Cryptographic Key Dasar
CWE-322: Key Exchange without Entity Authentication Dasar
CWE-323: Reusing a Nonce, Key Pair in Encryption Dasar
CWE-324: Use of a Key Past its Expiration Date Dasar
CWE-325: Missing Cryptographic Step Dasar
CWE-326: Inadequate Encryption Strength Dasar
CWE-327: Use of a Broken or Risky Cryptographic Algorithm Dasar
CWE-328: Use of Weak Hash Dasar
CWE-329: Generation of Predictable IV with CBC Mode Dasar
CWE-330: Use of Insufficiently Random Values Dasar
CWE-331: Insufficient Entropy Dasar
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Dasar
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Dasar
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Dasar
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Dasar
CWE-340: Generation of Predictable Numbers or Identifiers Dasar
CWE-347: Improper Verification of Cryptographic Signature Dasar
CWE-523: Unprotected Transport of Credentials Dasar
CWE-720: OWASP Top Ten 2007 Category A9 - Insecure Communications Kategori
CWE-757: Selection of Less-Secure Algorithm During Negotiation Dasar
CWE-759: Use of a One-Way Hash without a Salt Dasar
CWE-760: Use of a One-Way Hash with a Predictable Salt Dasar
CWE-780: Use of RSA Algorithm without OAEP Dasar
CWE-818: OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection Kategori
CWE-916: Use of Password Hash With Insufficient Computational Effort Dasar
CWE-1347: Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top Ten 2021.
CWE-20: Improper Input Validation Dasar
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Dasar
CWE-75: Failure to Sanitize Special Elements into a Different Plane Dasar
CWE-77: Improper Neutralization of Special Elements used in a Command Dasar
CWE-78: Improper Neutralization of Special Elements used in an OS Command Dasar
CWE-79: Improper Neutralization of Input During Web Page Generation Dasar
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Dasar
CWE-83: Improper Neutralization of Script in Attributes in a Web Page Dasar
CWE-87: Improper Neutralization of Alternate XSS Syntax Dasar
CWE-88: Improper Neutralization of Argument Delimiters in a Command Dasar
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Dasar
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Dasar
CWE-91: XML Injection Dasar
CWE-93: Improper Neutralization of CRLF Sequences Dasar
CWE-94: Improper Control of Generation of Code Dasar
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Dasar
CWE-96: Improper Neutralization of Directives in Statically Saved Code Dasar
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Dasar
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Dasar
CWE-99: Improper Control of Resource Identifiers Dasar
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Dasar
CWE-116: Improper Encoding or Escaping of Output Dasar
CWE-138: Improper Neutralization of Special Elements Dasar
CWE-184: Incomplete List of Disallowed Inputs Dasar
CWE-470: Use of Externally-Controlled Input to Select Classes or Code Dasar
CWE-471: Modification of Assumed-Immutable Data (MAID) Dasar
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input Dasar
CWE-610: Externally Controlled Reference to a Resource in Another Sphere Dasar
CWE-643: Improper Neutralization of Data within XPath Expressions Dasar
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax Dasar
CWE-652: Improper Neutralization of Data within XQuery Expressions Dasar
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement Dasar
CWE-1348: Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top Ten 2021.
CWE-73: External Control of File Name or Path Dasar
CWE-183: Permissive List of Allowed Inputs Dasar
CWE-209: Generation of Error Message Containing Sensitive Information Dasar
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies Dasar
CWE-235: Improper Handling of Extra Parameters Dasar
CWE-256: Plaintext Storage of a Password Dasar
CWE-257: Storing Passwords in a Recoverable Format Dasar
CWE-266: Incorrect Privilege Assignment Dasar
CWE-269: Improper Privilege Management Dasar
CWE-280: Improper Handling of Insufficient Permissions or Privileges Dasar
CWE-311: Missing Encryption of Sensitive Data Dasar
CWE-312: Cleartext Storage of Sensitive Information Dasar
CWE-313: Cleartext Storage in a File or on Disk Dasar
CWE-316: Cleartext Storage of Sensitive Information in Memory Dasar
CWE-419: Unprotected Primary Channel Dasar
CWE-430: Deployment of Wrong Handler Dasar
CWE-434: Unrestricted Upload of File with Dangerous Type Dasar
CWE-444: Inconsistent Interpretation of HTTP Requests Dasar
CWE-451: User Interface (UI) Misrepresentation of Critical Information Dasar
CWE-472: External Control of Assumed-Immutable Web Parameter Dasar
CWE-501: Trust Boundary Violation Dasar
CWE-522: Insufficiently Protected Credentials Dasar
CWE-525: Use of Web Browser Cache Containing Sensitive Information Dasar
CWE-539: Use of Persistent Cookies Containing Sensitive Information Dasar
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session Dasar
CWE-598: Use of HTTP Request With Sensitive Query String Dasar
CWE-602: Client-Side Enforcement of Server-Side Security Dasar
CWE-642: External Control of Critical State Data Dasar
CWE-646: Reliance on File Name or Extension of Externally-Supplied File Dasar
CWE-650: Trusting HTTP Permission Methods on the Server Side Dasar
CWE-653: Improper Isolation or Compartmentalization Dasar
CWE-656: Reliance on Security Through Obscurity Dasar
CWE-657: Violation of Secure Design Principles Dasar
CWE-799: Improper Control of Interaction Frequency Dasar
CWE-807: Reliance on Untrusted Inputs in a Security Decision Dasar
CWE-840: Business Logic Errors Kategori
CWE-841: Improper Enforcement of Behavioral Workflow Dasar
CWE-927: Use of Implicit Intent for Sensitive Communication Dasar
CWE-1021: Improper Restriction of Rendered UI Layers or Frames Dasar
CWE-1173: Improper Use of Validation Framework Dasar

Informasi Tampilan CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Komentar : Use this View or other Views to search and navigate for the appropriate weakness.

Catatan

As of CWE 4.6, the relationships in this view were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Audiens

Pemangku kepentingan Deskripsi
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing a good starting point for web application developers who want to code more securely.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2021-10-05 +00:00 2021-10-28 +00:00 4.6

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

Referensi

REF-1206

OWASP Top 10:2021
https://owasp.org/Top10/

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.