Detail Tampilan CWE-1450

CWE-1450

Weaknesses in OWASP Top Ten RC1 (2025)
2024-12-01 +00:00
Incomplete
Graph
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Weaknesses in OWASP Top Ten RC1 (2025)

CWE entries in this view (graph) are associated with the first release candidate (RC1) of the OWASP Top Ten, as released in 2025.

Anggota CWE

CWE-1436: Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2025.
CWE-1275: Sensitive Cookie with Improper SameSite Attribute Dasar
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Dasar
CWE-201: Insertion of Sensitive Information Into Sent Data Dasar
CWE-219: Storage of File with Sensitive Data Under Web Root Dasar
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Dasar
CWE-23: Relative Path Traversal Dasar
CWE-276: Incorrect Default Permissions Dasar
CWE-281: Improper Preservation of Permissions Dasar
CWE-282: Improper Ownership Management Dasar
CWE-283: Unverified Ownership Dasar
CWE-284: Improper Access Control Dasar
CWE-285: Improper Authorization Dasar
CWE-352: Cross-Site Request Forgery Dasar
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Dasar
CWE-36: Absolute Path Traversal Dasar
CWE-377: DEPRECATED: Insecure Temporary File Dasar
CWE-379: Creation of Temporary File in Directory with Insecure Permissions Dasar
CWE-402: Transmission of Private Resources into a New Sphere Dasar
CWE-424: Improper Protection of Alternate Path Dasar
CWE-425: Direct Request Dasar
CWE-441: Unintended Proxy or Intermediary Dasar
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Dasar
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Dasar
CWE-540: Inclusion of Sensitive Information in Source Code Dasar
CWE-548: Exposure of Information Through Directory Listing Dasar
CWE-552: Files or Directories Accessible to External Parties Dasar
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Dasar
CWE-59: Improper Link Resolution Before File Access Dasar
CWE-601: URL Redirection to Untrusted Site Dasar
CWE-61: UNIX Symbolic Link (Symlink) Following Dasar
CWE-615: Inclusion of Sensitive Information in Source Code Comments Dasar
CWE-639: Authorization Bypass Through User-Controlled Key Dasar
CWE-65: Windows Hard Link Dasar
CWE-668: Exposure of Resource to Wrong Sphere Dasar
CWE-732: Incorrect Permission Assignment for Critical Resource Dasar
CWE-749: Exposed Dangerous Method or Function Dasar
CWE-862: Missing Authorization Dasar
CWE-863: Incorrect Authorization Dasar
CWE-918: Server-Side Request Forgery Dasar
CWE-922: Insecure Storage of Sensitive Information Dasar
CWE-1439: Weaknesses in this category are related to the A04 category "Cryptographic Failures" in the OWASP Top Ten 2025.
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation Dasar
CWE-1241: Use of Predictable Algorithm in Random Number Generator Dasar
CWE-261: Weak Encoding for Password Dasar
CWE-296: Improper Following of a Certificate's Chain of Trust Dasar
CWE-319: Cleartext Transmission of Sensitive Information Dasar
CWE-320: Key Management Errors Kategori
CWE-321: Use of Hard-coded Cryptographic Key Dasar
CWE-322: Key Exchange without Entity Authentication Dasar
CWE-323: Reusing a Nonce, Key Pair in Encryption Dasar
CWE-324: Use of a Key Past its Expiration Date Dasar
CWE-325: Missing Cryptographic Step Dasar
CWE-326: Inadequate Encryption Strength Dasar
CWE-327: Use of a Broken or Risky Cryptographic Algorithm Dasar
CWE-328: Use of Weak Hash Dasar
CWE-329: Generation of Predictable IV with CBC Mode Dasar
CWE-330: Use of Insufficiently Random Values Dasar
CWE-331: Insufficient Entropy Dasar
CWE-332: Insufficient Entropy in PRNG Dasar
CWE-334: Small Space of Random Values Dasar
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Dasar
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Dasar
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Dasar
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Dasar
CWE-340: Generation of Predictable Numbers or Identifiers Dasar
CWE-342: Predictable Exact Value from Previous Values Dasar
CWE-347: Improper Verification of Cryptographic Signature Dasar
CWE-523: Unprotected Transport of Credentials Dasar
CWE-757: Selection of Less-Secure Algorithm During Negotiation Dasar
CWE-759: Use of a One-Way Hash without a Salt Dasar
CWE-760: Use of a One-Way Hash with a Predictable Salt Dasar
CWE-780: Use of RSA Algorithm without OAEP Dasar
CWE-916: Use of Password Hash With Insufficient Computational Effort Dasar
CWE-1440: Weaknesses in this category are related to the A05 category "Injection" in the OWASP Top Ten 2025.
CWE-103: Struts: Incomplete validate() Method Definition Dasar
CWE-104: Struts: Form Bean Does Not Extend Validation Class Dasar
CWE-112: Missing XML Validation Dasar
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Dasar
CWE-114: Process Control Dasar
CWE-115: Misinterpretation of Input Dasar
CWE-116: Improper Encoding or Escaping of Output Dasar
CWE-129: Improper Validation of Array Index Dasar
CWE-159: Improper Handling of Invalid Use of Special Elements Dasar
CWE-20: Improper Input Validation Dasar
CWE-470: Use of Externally-Controlled Input to Select Classes or Code Dasar
CWE-493: Critical Public Variable Without Final Modifier Dasar
CWE-500: Public Static Field Not Marked Final Dasar
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input Dasar
CWE-610: Externally Controlled Reference to a Resource in Another Sphere Dasar
CWE-643: Improper Neutralization of Data within XPath Expressions Dasar
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax Dasar
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Dasar
CWE-76: Improper Neutralization of Equivalent Special Elements Dasar
CWE-77: Improper Neutralization of Special Elements used in a Command Dasar
CWE-78: Improper Neutralization of Special Elements used in an OS Command Dasar
CWE-79: Improper Neutralization of Input During Web Page Generation Dasar
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Dasar
CWE-83: Improper Neutralization of Script in Attributes in a Web Page Dasar
CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages Dasar
CWE-88: Improper Neutralization of Argument Delimiters in a Command Dasar
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Dasar
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Dasar
CWE-91: XML Injection Dasar
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement Dasar
CWE-93: Improper Neutralization of CRLF Sequences Dasar
CWE-94: Improper Control of Generation of Code Dasar
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Dasar
CWE-96: Improper Neutralization of Directives in Statically Saved Code Dasar
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Dasar
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Dasar
CWE-99: Improper Control of Resource Identifiers Dasar
CWE-1441: Weaknesses in this category are related to the A06 category "Insecure Design" in the OWASP Top Ten 2025.
CWE-1021: Improper Restriction of Rendered UI Layers or Frames Dasar
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access Dasar
CWE-1125: Excessive Attack Surface Dasar
CWE-183: Permissive List of Allowed Inputs Dasar
CWE-256: Plaintext Storage of a Password Dasar
CWE-266: Incorrect Privilege Assignment Dasar
CWE-269: Improper Privilege Management Dasar
CWE-286: Incorrect User Management Dasar
CWE-311: Missing Encryption of Sensitive Data Dasar
CWE-312: Cleartext Storage of Sensitive Information Dasar
CWE-313: Cleartext Storage in a File or on Disk Dasar
CWE-316: Cleartext Storage of Sensitive Information in Memory Dasar
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Dasar
CWE-382: J2EE Bad Practices: Use of System.exit() Dasar
CWE-419: Unprotected Primary Channel Dasar
CWE-434: Unrestricted Upload of File with Dangerous Type Dasar
CWE-436: Interpretation Conflict Dasar
CWE-444: Inconsistent Interpretation of HTTP Requests Dasar
CWE-451: User Interface (UI) Misrepresentation of Critical Information Dasar
CWE-454: External Initialization of Trusted Variables or Data Stores Dasar
CWE-472: External Control of Assumed-Immutable Web Parameter Dasar
CWE-501: Trust Boundary Violation Dasar
CWE-522: Insufficiently Protected Credentials Dasar
CWE-525: Use of Web Browser Cache Containing Sensitive Information Dasar
CWE-539: Use of Persistent Cookies Containing Sensitive Information Dasar
CWE-598: Use of HTTP Request With Sensitive Query String Dasar
CWE-602: Client-Side Enforcement of Server-Side Security Dasar
CWE-628: Function Call with Incorrectly Specified Arguments Dasar
CWE-642: External Control of Critical State Data Dasar
CWE-646: Reliance on File Name or Extension of Externally-Supplied File Dasar
CWE-653: Improper Isolation or Compartmentalization Dasar
CWE-656: Reliance on Security Through Obscurity Dasar
CWE-657: Violation of Secure Design Principles Dasar
CWE-676: Use of Potentially Dangerous Function Dasar
CWE-693: Protection Mechanism Failure Dasar
CWE-73: External Control of File Name or Path Dasar
CWE-799: Improper Control of Interaction Frequency Dasar
CWE-807: Reliance on Untrusted Inputs in a Security Decision Dasar
CWE-841: Improper Enforcement of Behavioral Workflow Dasar
CWE-1442: Weaknesses in this category are related to the A07 category "Authentication Failures" in the OWASP Top Ten 2025.
CWE-1390: Weak Authentication Dasar
CWE-1391: Use of Weak Credentials Dasar
CWE-1392: Use of Default Credentials Dasar
CWE-1393: Use of Default Password Dasar
CWE-258: Empty Password in Configuration File Dasar
CWE-259: Use of Hard-coded Password Dasar
CWE-287: Improper Authentication Dasar
CWE-288: Authentication Bypass Using an Alternate Path or Channel Dasar
CWE-289: Authentication Bypass by Alternate Name Dasar
CWE-290: Authentication Bypass by Spoofing Dasar
CWE-291: Reliance on IP Address for Authentication Dasar
CWE-293: Using Referer Field for Authentication Dasar
CWE-294: Authentication Bypass by Capture-replay Dasar
CWE-295: Improper Certificate Validation Dasar
CWE-297: Improper Validation of Certificate with Host Mismatch Dasar
CWE-298: Improper Validation of Certificate Expiration Dasar
CWE-299: Improper Check for Certificate Revocation Dasar
CWE-300: Channel Accessible by Non-Endpoint Dasar
CWE-302: Authentication Bypass by Assumed-Immutable Data Dasar
CWE-303: Incorrect Implementation of Authentication Algorithm Dasar
CWE-304: Missing Critical Step in Authentication Dasar
CWE-305: Authentication Bypass by Primary Weakness Dasar
CWE-306: Missing Authentication for Critical Functionality Dasar
CWE-307: Improper Restriction of Excessive Authentication Attempts Dasar
CWE-308: Use of Single-factor Authentication Dasar
CWE-309: Use of Password System for Primary Authentication Dasar
CWE-346: Origin Validation Error Dasar
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action Dasar
CWE-384: Session Fixation Dasar
CWE-521: Weak Password Requirements Dasar
CWE-613: DEPRECATED: Insufficient Session Expiration Dasar
CWE-620: Unverified Password Change Dasar
CWE-640: Weak Password Recovery Mechanism for Forgotten Password Dasar
CWE-798: Use of Hard-coded Credentials Dasar
CWE-940: Improper Verification of Source of a Communication Channel Dasar
CWE-941: Incorrectly Specified Destination in a Communication Channel Dasar

Informasi Tampilan CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Komentar : Use this View or other Views to search and navigate for the appropriate weakness.

Catatan

As of CWE 4.19, the relationships in this view were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten RC1. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Audiens

Pemangku kepentingan Deskripsi
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2025 RC1), providing a good starting point for web application developers who want to code more securely.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten (2025 RC1), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2024-12-01 +00:00 2025-12-11 +00:00 4.19

Referensi

REF-1500

OWASP Top 10:2025 RC1
https://owasp.org/Top10/2025/0x00_2025-Introduction/

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.