Detail Tampilan CWE-868

CWE-868

Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)
2011-08-04 +00:00
Obsolete
Graph
2023-06-29 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: Weaknesses Addressed by the SEI CERT C++ Coding Standard (2016 Version)

CWE entries in this view (graph) are fully or partially eliminated by following the SEI CERT C++ Coding Standard, as published in 2016. This view is no longer being actively maintained, since it statically represents the coding rules as they were in 2016.

Anggota CWE

CWE-876: Weaknesses in this category are related to rules in the Memory Management (MEM) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Dasar
CWE-128: Wrap-around Error Dasar
CWE-131: Incorrect Calculation of Buffer Size Dasar
CWE-190: Integer Overflow or Wraparound Dasar
CWE-20: Improper Input Validation Dasar
CWE-226: Sensitive Information in Resource Not Removed Before Reuse Dasar
CWE-244: Improper Clearing of Heap Memory Before Release Dasar
CWE-252: Unchecked Return Value Dasar
CWE-391: DEPRECATED: Unchecked Error Condition Dasar
CWE-404: Improper Resource Shutdown or Release Dasar
CWE-415: Double Free Dasar
CWE-416: Use After Free Dasar
CWE-476: NULL Pointer Dereference Dasar
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere Dasar
CWE-590: Free of Memory not on the Heap Dasar
CWE-591: Sensitive Data Storage in Improperly Locked Memory Dasar
CWE-665: Improper Initialization Dasar
CWE-687: Function Call With Incorrectly Specified Argument Value Dasar
CWE-690: Unchecked Return Value to NULL Pointer Dereference Dasar
CWE-703: Improper Check or Handling of Exceptional Conditions Dasar
CWE-754: Improper Check for Unusual or Exceptional Conditions Dasar
CWE-762: Mismatched Memory Management Routines Dasar
CWE-770: Allocation of Resources Without Limits or Throttling Dasar
CWE-822: Untrusted Pointer Dereference Dasar
CWE-877: Weaknesses in this category are related to rules in the Input Output (FIO) section of the CERT C++ Secure Coding Standard. Since not all rules map to specific weaknesses, this category may be incomplete.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Dasar
CWE-134: Use of Externally-Controlled Format String Dasar
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Dasar
CWE-241: Improper Handling of Unexpected Data Type Dasar
CWE-276: Incorrect Default Permissions Dasar
CWE-279: Incorrect Execution-Assigned Permissions Dasar
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Dasar
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition Dasar
CWE-37: Path Traversal: '/absolute/pathname/here' Dasar
CWE-379: Creation of Temporary File in Directory with Insecure Permissions Dasar
CWE-38: Path Traversal: '\absolute\pathname\here' Dasar
CWE-39: Path Traversal: 'C:dirname' Dasar
CWE-391: DEPRECATED: Unchecked Error Condition Dasar
CWE-403: Exposure of File Descriptor to Unintended Control Sphere Dasar
CWE-404: Improper Resource Shutdown or Release Dasar
CWE-41: Improper Resolution of Path Equivalence Dasar
CWE-552: Files or Directories Accessible to External Parties Dasar
CWE-59: Improper Link Resolution Before File Access Dasar
CWE-62: UNIX Hard Link Dasar
CWE-64: Windows Shortcut Following (.LNK) Dasar
CWE-65: Windows Hard Link Dasar
CWE-67: Improper Handling of Windows Device Names Dasar
CWE-675: Multiple Operations on Resource in Single-Operation Context Dasar
CWE-676: Use of Potentially Dangerous Function Dasar
CWE-73: External Control of File Name or Path Dasar
CWE-732: Incorrect Permission Assignment for Critical Resource Dasar
CWE-770: Allocation of Resources Without Limits or Throttling Dasar

Informasi Tampilan CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Komentar : Use this View or other Views to search and navigate for the appropriate weakness.

Catatan

The relationships in this view were determined based on specific statements within the rules from the standard. Not all rules have direct relationships to individual weaknesses, although they likely have chaining relationships in specific circumstances.

Audiens

Pemangku kepentingan Deskripsi
Software Developers By following the CERT C++ Secure Coding Standard, developers will be able to fully or partially prevent the weaknesses that are identified in this view. In addition, developers can use a CWE coverage graph to determine which weaknesses are not directly addressed by the standard, which will help identify and resolve remaining gaps in training, tool acquisition, or other approaches for reducing weaknesses.
Product Customers If a software developer claims to be following the CERT C++ Secure Coding Standard, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.
Educators Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could link them to the relevant Secure Coding Standard.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2011-08-04 +00:00 2011-09-13 +00:00 2.1

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2019-01-03 +00:00 updated Description, Maintenance_Notes, Name, References
CWE Content Team MITRE 2020-02-24 +00:00 updated View_Audience
CWE Content Team MITRE 2021-03-15 +00:00 updated Description, Maintenance_Notes
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

Referensi

REF-847

SEI CERT C++ Coding Standard
The Software Engineering Institute.
https://wiki.sei.cmu.edu/confluence/pages/viewpage.action?pageId=88046682

Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.