日本語

CWE-700 ビュー詳細

CWE-700

Seven Pernicious Kingdoms
2008-09-09 +00:00
Incomplete
Graph
2026-10-28 +00:00
CWE Mitre.org
特定のCWEの通知
特定のCWEの変更情報をいち早くお届けします。
通知を管理する

名前: Seven Pernicious Kingdoms

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

CWE メンバー

CWE-361: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."
CWE-364: Signal Handler Race Condition ベース
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition ベース
CWE-377: DEPRECATED: Insecure Temporary File ベース
CWE-382: J2EE Bad Practices: Use of System.exit() ベース
CWE-383: J2EE Bad Practices: Direct Use of Threads ベース
CWE-384: Session Fixation ベース
CWE-412: Unrestricted Externally Accessible Lock ベース
CWE-227: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."
CWE-242: Use of Inherently Dangerous Function ベース
CWE-243: Creation of chroot Jail Without Changing Working Directory ベース
CWE-244: Improper Clearing of Heap Memory Before Release ベース
CWE-245: J2EE Bad Practices: Direct Management of Connections ベース
CWE-246: J2EE Bad Practices: Direct Use of Sockets ベース
CWE-248: Uncaught Exception ベース
CWE-250: Execution with Unnecessary Privileges ベース
CWE-251: Often Misused: String Management カテゴリ
CWE-252: Unchecked Return Value ベース
CWE-558: Use of getlogin() in Multithreaded Application ベース

CWE ビュー情報

脆弱性マッピングノート

理由 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
コメント : Use this View or other Views to search and navigate for the appropriate weakness.

ノート

The MITRE CWE team frequently uses "7PK" as an abbreviation for Seven Pernicious Kingdoms.

対象者

ステークホルダー 説明
Software Developers This view is useful for developers because it is organized around concepts with which developers are familiar, and it focuses on weaknesses that can be detected using source code analysis tools.

登録情報

名前 組織 日付 リリース日 Version
CWE Content Team MITRE 2008-09-09 +00:00 2008-09-09 +00:00 1.0

変更履歴

名前 組織 日付 コメント
CWE Content Team MITRE 2017-05-03 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Alternate_Terms, Other_Notes
CWE Content Team MITRE 2020-02-24 +00:00 updated References
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
CWE Content Team MITRE 2026-10-28 +00:00 updated References

参考文献

REF-6

Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
Katrina Tsipenyuk, Brian Chess, Gary McGraw.
https://cwe.mitre.org/documents/sources/SevenPerniciousKingdoms.pdf

CVE Findに掲載されている情報は、慎重に選定された複数の参照ソースから取得されています。CVEデータはMITRE Corporationおよび国家脆弱性データベース（NVD）が提供しています。既知の悪用された脆弱性（KEV）カタログはサイバーセキュリティ・インフラセキュリティ庁（CISA）から、EPSSスコアはFIRST.orgから取得しています。また、ソフトウェアの弱点（CWE）および共通攻撃パターン（CAPEC）に関するデータはMITRE Corporationが管理し、ハードウェアおよびソフトウェア構成（CPE）に関する情報はNVDが提供しています。