Detail Tampilan CWE-884

CWE-884

CWE Cross-section
2011-12-15 +00:00
Incomplete
Explicit
2023-06-29 +00:00
CWE Mitre.org
Notifikasi untuk CWE tertentu
Tetap terinformasi tentang perubahan untuk CWE tertentu.
Kelola notifikasi

Nama: CWE Cross-section

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Anggota CWE

CWE-14: Compiler Removal of Code to Clear Buffers Dasar

CWE-22: Improper Limitation of a Pathname to a Restricted Directory Dasar

CWE-23: Relative Path Traversal Dasar

CWE-36: Absolute Path Traversal Dasar

CWE-41: Improper Resolution of Path Equivalence Dasar

CWE-59: Improper Link Resolution Before File Access Dasar

CWE-78: Improper Neutralization of Special Elements used in an OS Command Dasar

CWE-79: Improper Neutralization of Input During Web Page Generation Dasar

CWE-88: Improper Neutralization of Argument Delimiters in a Command Dasar

CWE-89: Improper Neutralization of Special Elements used in an SQL Command Dasar

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Dasar

CWE-94: Improper Control of Generation of Code Dasar

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Dasar

CWE-96: Improper Neutralization of Directives in Statically Saved Code Dasar

CWE-99: Improper Control of Resource Identifiers Dasar

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Dasar

CWE-117: Improper Output Neutralization for Logs Dasar

CWE-120: Buffer Copy without Checking Size of Input Dasar

CWE-129: Improper Validation of Array Index Dasar

CWE-131: Incorrect Calculation of Buffer Size Dasar

CWE-134: Use of Externally-Controlled Format String Dasar

CWE-135: Incorrect Calculation of Multi-Byte String Length Dasar

CWE-170: Improper Null Termination Dasar

CWE-173: Improper Handling of Alternate Encoding Dasar

CWE-174: Double Decoding of the Same Data Dasar

CWE-175: Improper Handling of Mixed Encoding Dasar

CWE-179: Incorrect Behavior Order: Early Validation Dasar

CWE-185: Incorrect Regular Expression Dasar

CWE-190: Integer Overflow or Wraparound Dasar

CWE-191: Integer Underflow (Wrap or Wraparound) Dasar

CWE-193: Off-by-one Error Dasar

CWE-203: Observable Discrepancy Dasar

CWE-209: Generation of Error Message Containing Sensitive Information Dasar

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer Dasar

CWE-222: Truncation of Security-relevant Information Dasar

CWE-223: Omission of Security-relevant Information Dasar

CWE-228: Improper Handling of Syntactically Invalid Structure Dasar

CWE-244: Improper Clearing of Heap Memory Before Release Dasar

CWE-248: Uncaught Exception Dasar

CWE-250: Execution with Unnecessary Privileges Dasar

CWE-252: Unchecked Return Value Dasar

CWE-253: Incorrect Check of Function Return Value Dasar

CWE-262: Not Using Password Aging Dasar

CWE-263: Password Aging with Long Expiration Dasar

CWE-266: Incorrect Privilege Assignment Dasar

CWE-267: Privilege Defined With Unsafe Actions Dasar

CWE-268: Privilege Chaining Dasar

CWE-270: Privilege Context Switching Error Dasar

CWE-271: Privilege Dropping / Lowering Errors Dasar

CWE-273: Improper Check for Dropped Privileges Dasar

CWE-283: Unverified Ownership Dasar

CWE-290: Authentication Bypass by Spoofing Dasar

CWE-294: Authentication Bypass by Capture-replay Dasar

CWE-296: Improper Following of a Certificate's Chain of Trust Dasar

CWE-299: Improper Check for Certificate Revocation Dasar

CWE-300: Channel Accessible by Non-Endpoint Dasar

CWE-301: Reflection Attack in an Authentication Protocol Dasar

CWE-304: Missing Critical Step in Authentication Dasar

CWE-306: Missing Authentication for Critical Functionality Dasar

CWE-307: Improper Restriction of Excessive Authentication Attempts Dasar

CWE-308: Use of Single-factor Authentication Dasar

CWE-312: Cleartext Storage of Sensitive Information Dasar

CWE-319: Cleartext Transmission of Sensitive Information Dasar

CWE-322: Key Exchange without Entity Authentication Dasar

CWE-323: Reusing a Nonce, Key Pair in Encryption Dasar

CWE-325: Missing Cryptographic Step Dasar

CWE-327: Use of a Broken or Risky Cryptographic Algorithm Dasar

CWE-331: Insufficient Entropy Dasar

CWE-334: Small Space of Random Values Dasar

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Dasar

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Dasar

CWE-341: Predictable from Observable State Dasar

CWE-347: Improper Verification of Cryptographic Signature Dasar

CWE-348: Use of Less Trusted Source Dasar

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data Dasar

CWE-352: Cross-Site Request Forgery Dasar

CWE-353: Missing Support for Integrity Check Dasar

CWE-354: Improper Validation of Integrity Check Value Dasar

CWE-364: Signal Handler Race Condition Dasar

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition Dasar

CWE-369: Divide By Zero Dasar

CWE-390: Detection of Error Condition Without Action Dasar

CWE-392: Missing Report of Error Condition Dasar

CWE-393: Return of Wrong Status Code Dasar

CWE-400: Uncontrolled Resource Consumption Dasar

CWE-406: Insufficient Control of Network Message Volume (Network Amplification) Dasar

CWE-407: Inefficient Algorithmic Complexity Dasar

CWE-408: Incorrect Behavior Order: Early Amplification Dasar

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) Dasar

CWE-434: Unrestricted Upload of File with Dangerous Type Dasar

CWE-444: Inconsistent Interpretation of HTTP Requests Dasar

CWE-451: User Interface (UI) Misrepresentation of Critical Information Dasar

CWE-453: Insecure Default Variable Initialization Dasar

CWE-454: External Initialization of Trusted Variables or Data Stores Dasar

CWE-455: Non-exit on Failed Initialization Dasar

CWE-456: Missing Initialization of a Variable Dasar

CWE-467: Use of sizeof() on a Pointer Type Dasar

CWE-468: Incorrect Pointer Scaling Dasar

CWE-469: Use of Pointer Subtraction to Determine Size Dasar

CWE-470: Use of Externally-Controlled Input to Select Classes or Code Dasar

CWE-476: NULL Pointer Dereference Dasar

CWE-478: Missing Default Case in Multiple Condition Expression Dasar

CWE-480: Use of Incorrect Operator Dasar

CWE-483: Incorrect Block Delimitation Dasar

CWE-484: Omitted Break Statement in Switch Dasar

CWE-486: Comparison of Classes by Name Dasar

CWE-494: Download of Code Without Integrity Check Dasar

CWE-495: Private Data Structure Returned From A Public Method Dasar

CWE-496: Public Data Assigned to Private Array-Typed Field Dasar

CWE-498: Cloneable Class Containing Sensitive Information Dasar

CWE-499: Serializable Class Containing Sensitive Data Dasar

CWE-502: Deserialization of Untrusted Data Dasar

CWE-521: Weak Password Requirements Dasar

CWE-522: Insufficiently Protected Credentials Dasar

CWE-546: Suspicious Comment Dasar

CWE-547: Use of Hard-coded, Security-relevant Constants Dasar

CWE-561: Dead Code Dasar

CWE-563: Assignment to Variable without Use Dasar

CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context Dasar

CWE-587: Assignment of a Fixed Address to a Pointer Dasar

CWE-595: Comparison of Object References Instead of Object Contents Dasar

CWE-601: URL Redirection to Untrusted Site Dasar

CWE-602: Client-Side Enforcement of Server-Side Security Dasar

CWE-605: Multiple Binds to the Same Port Dasar

CWE-617: Reachable Assertion Dasar

CWE-621: Variable Extraction Error Dasar

CWE-627: Dynamic Variable Evaluation Dasar

CWE-628: Function Call with Incorrectly Specified Arguments Dasar

CWE-642: External Control of Critical State Data Dasar

CWE-648: Incorrect Use of Privileged APIs Dasar

CWE-667: Improper Locking Dasar

CWE-672: Operation on a Resource after Expiration or Release Dasar

CWE-674: Uncontrolled Recursion Dasar

CWE-676: Use of Potentially Dangerous Function Dasar

CWE-681: Incorrect Conversion between Numeric Types Dasar

CWE-698: Execution After Redirect (EAR) Dasar

CWE-708: Incorrect Ownership Assignment Dasar

CWE-732: Incorrect Permission Assignment for Critical Resource Dasar

CWE-756: Missing Custom Error Page Dasar

CWE-763: Release of Invalid Pointer or Reference Dasar

CWE-770: Allocation of Resources Without Limits or Throttling Dasar

CWE-772: Missing Release of Resource after Effective Lifetime Dasar

CWE-783: Operator Precedence Logic Error Dasar

CWE-786: Access of Memory Location Before Start of Buffer Dasar

CWE-788: Access of Memory Location After End of Buffer Dasar

CWE-798: Use of Hard-coded Credentials Dasar

CWE-805: Buffer Access with Incorrect Length Value Dasar

CWE-807: Reliance on Untrusted Inputs in a Security Decision Dasar

CWE-822: Untrusted Pointer Dereference Dasar

CWE-825: Expired Pointer Dereference Dasar

CWE-829: Inclusion of Functionality from Untrusted Control Sphere Dasar

CWE-835: Loop with Unreachable Exit Condition Dasar

CWE-838: Inappropriate Encoding for Output Context Dasar

CWE-839: Numeric Range Comparison Without Minimum Check Dasar

CWE-841: Improper Enforcement of Behavioral Workflow Dasar

CWE-862: Missing Authorization Dasar

CWE-863: Incorrect Authorization Dasar

Informasi Tampilan CWE

Catatan Pemetaan Kerentanan

Justifikasi : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Komentar : Use this View or other Views to search and navigate for the appropriate weakness.

Pengajuan

Nama Organisasi Tanggal Tanggal rilis Version
CWE Content Team MITRE 2011-12-15 +00:00 2012-05-14 +00:00 2.2

Modifikasi

Nama Organisasi Tanggal Komentar
CWE Content Team MITRE 2017-05-03 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
Informasi yang disajikan di CVE Find berasal dari beberapa sumber referensi yang dipilih dengan cermat. Data CVE disediakan oleh MITRE Corporation dan National Vulnerability Database (NVD). Katalog Known Exploited Vulnerabilities (KEV) bersumber dari Cybersecurity and Infrastructure Security Agency (CISA), sementara skor EPSS berasal dari FIRST.org. Selain itu, data mengenai kelemahan perangkat lunak (CWE) dan pola serangan umum (CAPEC) dikelola oleh MITRE Corporation, dan informasi tentang konfigurasi perangkat keras dan perangkat lunak (CPE) disediakan oleh NVD.