Tên: Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the online wiki that reflects that current rules and recommendations of the SEI CERT Oracle Coding Standard for Java.

Thành viên CWE

CWE-1134: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS) Danh mục

CWE-1134: Weaknesses in this category are related to the rules and recommendations in the Input Validation and Data Sanitization (IDS) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-116: Improper Encoding or Escaping of Output Cơ sở

CWE-180: Incorrect Behavior Order: Validate Before Canonicalize Cơ sở

CWE-289: Authentication Bypass by Alternate Name Cơ sở

CWE-117: Improper Output Neutralization for Logs Cơ sở

CWE-144: Improper Neutralization of Line Delimiters Cơ sở

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Cơ sở

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) Cơ sở

CWE-134: Use of Externally-Controlled Format String Cơ sở

CWE-78: Improper Neutralization of Special Elements used in an OS Command Cơ sở

CWE-182: Collapse of Data into Unsafe Value Cơ sở

CWE-1135: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL) Danh mục

CWE-1135: Weaknesses in this category are related to the rules and recommendations in the Declarations and Initialization (DCL) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-665: Improper Initialization Cơ sở

CWE-1136: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP) Danh mục

CWE-1136: Weaknesses in this category are related to the rules and recommendations in the Expressions (EXP) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-252: Unchecked Return Value Cơ sở

CWE-476: NULL Pointer Dereference Cơ sở

CWE-597: Use of Wrong Operator in String Comparison Cơ sở

CWE-595: Comparison of Object References Instead of Object Contents Cơ sở

CWE-1137: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM) Danh mục

CWE-1137: Weaknesses in this category are related to the rules and recommendations in the Numeric Types and Operations (NUM) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-190: Integer Overflow or Wraparound Cơ sở

CWE-191: Integer Underflow (Wrap or Wraparound) Cơ sở

CWE-197: Numeric Truncation Error Cơ sở

CWE-369: Divide By Zero Cơ sở

CWE-681: Incorrect Conversion between Numeric Types Cơ sở

CWE-682: Incorrect Calculation Cơ sở

CWE-1138: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR) Danh mục

CWE-1138: Weaknesses in this category are related to the rules and recommendations in the Characters and Strings (STR) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-838: Inappropriate Encoding for Output Context Cơ sở

CWE-1139: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ) Danh mục

CWE-1139: Weaknesses in this category are related to the rules and recommendations in the Object Orientation (OBJ) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-374: Passing Mutable Objects to an Untrusted Method Cơ sở

CWE-375: Returning a Mutable Object to an Untrusted Caller Cơ sở

CWE-486: Comparison of Classes by Name Cơ sở

CWE-491: Public cloneable() Method Without Final Cơ sở

CWE-492: Use of Inner Class Containing Sensitive Data Cơ sở

CWE-498: Cloneable Class Containing Sensitive Information Cơ sở

CWE-500: Public Static Field Not Marked Final Cơ sở

CWE-766: Critical Data Element Declared Public Cơ sở

CWE-1140: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET) Danh mục

CWE-1140: Weaknesses in this category are related to the rules and recommendations in the Methods (MET) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-617: Reachable Assertion Cơ sở

CWE-589: Call to Non-ubiquitous API Cơ sở

CWE-697: Incorrect Comparison Cơ sở

CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined Cơ sở

CWE-573: Improper Following of Specification by Caller Cơ sở

CWE-586: Explicit Call to Finalize() Cơ sở

CWE-583: finalize() Method Declared Public Cơ sở

CWE-568: finalize() Method Without super.finalize() Cơ sở

CWE-1141: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR) Danh mục

CWE-1141: Weaknesses in this category are related to the rules and recommendations in the Exceptional Behavior (ERR) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-460: Improper Cleanup on Thrown Exception Cơ sở

CWE-584: Return Inside Finally Block Cơ sở

CWE-459: Incomplete Cleanup Cơ sở

CWE-248: Uncaught Exception Cơ sở

CWE-705: Incorrect Control Flow Scoping Cơ sở

CWE-754: Improper Check for Unusual or Exceptional Conditions Cơ sở

CWE-703: Improper Check or Handling of Exceptional Conditions Cơ sở

CWE-397: Declaration of Throws for Generic Exception Cơ sở

CWE-382: J2EE Bad Practices: Use of System.exit() Cơ sở

CWE-1142: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA) Danh mục

CWE-1142: Weaknesses in this category are related to the rules and recommendations in the Visibility and Atomicity (VNA) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Cơ sở

CWE-366: Race Condition within a Thread Cơ sở

CWE-413: Improper Resource Locking Cơ sở

CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context Cơ sở

CWE-662: Improper Synchronization Cơ sở

CWE-667: Improper Locking Cơ sở

CWE-1143: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK) Danh mục

CWE-1143: Weaknesses in this category are related to the rules and recommendations in the Locking (LCK) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-412: Unrestricted Externally Accessible Lock Cơ sở

CWE-609: Double-Checked Locking Cơ sở

CWE-667: Improper Locking Cơ sở

CWE-820: Missing Synchronization Cơ sở

CWE-1144: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI) Danh mục

CWE-1144: Weaknesses in this category are related to the rules and recommendations in the Thread APIs (THI) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-572: Call to Thread run() instead of start() Cơ sở

CWE-1145: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS) Danh mục

CWE-1145: Weaknesses in this category are related to the rules and recommendations in the Thread Pools (TPS) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-392: Missing Report of Error Condition Cơ sở

CWE-405: Asymmetric Resource Consumption (Amplification) Cơ sở

CWE-410: Insufficient Resource Pool Cơ sở

CWE-1146: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM) Danh mục

CWE-1146: Weaknesses in this category are related to the rules and recommendations in the Thread-Safety Miscellaneous (TSM) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-1147: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO) Danh mục

CWE-1147: Weaknesses in this category are related to the rules and recommendations in the Input Output (FIO) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-67: Improper Handling of Windows Device Names Cơ sở

CWE-180: Incorrect Behavior Order: Validate Before Canonicalize Cơ sở

CWE-198: Use of Incorrect Byte Ordering Cơ sở

CWE-276: Incorrect Default Permissions Cơ sở

CWE-279: Incorrect Execution-Assigned Permissions Cơ sở

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Cơ sở

CWE-377: DEPRECATED: Insecure Temporary File Cơ sở

CWE-404: Improper Resource Shutdown or Release Cơ sở

CWE-405: Asymmetric Resource Consumption (Amplification) Cơ sở

CWE-459: Incomplete Cleanup Cơ sở

CWE-532: Insertion of Sensitive Information into Log File Cơ sở

CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions Cơ sở

CWE-705: Incorrect Control Flow Scoping Cơ sở

CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở

CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở

CWE-1148: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER) Danh mục

CWE-1148: Weaknesses in this category are related to the rules and recommendations in the Serialization (SER) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-319: Cleartext Transmission of Sensitive Information Cơ sở

CWE-400: Uncontrolled Resource Consumption Cơ sở

CWE-499: Serializable Class Containing Sensitive Data Cơ sở

CWE-502: Deserialization of Untrusted Data Cơ sở

CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở

CWE-1149: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) Danh mục

CWE-1149: Weaknesses in this category are related to the rules and recommendations in the Platform Security (SEC) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-266: Incorrect Privilege Assignment Cơ sở

CWE-272: Least Privilege Violation Cơ sở

CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở

CWE-1150: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV) Danh mục

CWE-1150: Weaknesses in this category are related to the rules and recommendations in the Runtime Environment (ENV) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data Cơ sở

CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở

CWE-1151: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI) Danh mục

CWE-1151: Weaknesses in this category are related to the rules and recommendations in the Java Native Interface (JNI) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-111: Direct Use of Unsafe JNI Cơ sở

CWE-1152: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC) Danh mục

CWE-1152: Weaknesses in this category are related to the rules and recommendations in the Miscellaneous (MSC) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-259: Use of Hard-coded Password Cơ sở

CWE-311: Missing Encryption of Sensitive Data Cơ sở

CWE-327: Use of a Broken or Risky Cryptographic Algorithm Cơ sở

CWE-330: Use of Insufficiently Random Values Cơ sở

CWE-332: Insufficient Entropy in PRNG Cơ sở

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Cơ sở

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Cơ sở

CWE-400: Uncontrolled Resource Consumption Cơ sở

CWE-401: Missing Release of Memory after Effective Lifetime Cơ sở

CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở

CWE-798: Use of Hard-coded Credentials Cơ sở

CWE-1153: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD) Danh mục

CWE-1153: Weaknesses in this category are related to the rules and recommendations in the Android (DRD) section of the SEI CERT Oracle Secure Coding Standard for Java.

CWE-1175: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON) Danh mục

CWE-1175: Weaknesses in this category are related to the rules and recommendations in the Concurrency (CON) section of the SEI CERT Oracle Secure Coding Standard for Java.

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú

The relationships in this view were determined based on specific statements within the rules from the standard. Not all rules have direct relationships to individual weaknesses, although they likely have chaining relationships in specific circumstances.

Đối tượng

Bên liên quan	Mô tả
Software Developers	By following the SEI CERT Oracle Coding Standard for Java, developers will be able to fully or partially prevent the weaknesses that are identified in this view. In addition, developers can use a CWE coverage graph to determine which weaknesses are not directly addressed by the standard, which will help identify and resolve remaining gaps in training, tool acquisition, or other approaches for reducing weaknesses.
Product Customers	If a software developer claims to be following the SEI CERT Oracle Secure Coding Standard for Java, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.
Educators	Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could link them to the relevant Secure Coding Standard.

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
CWE Content Team	MITRE	2018-12-11 +00:00	2019-01-03 +00:00	3.2

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2020-02-24 +00:00	updated View_Audience
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes

Tài liệu tham khảo

REF-970

SEI CERT Oracle Coding Standard for Java
The Software Engineering Institute.
https://wiki.sei.cmu.edu/confluence/display/java/SEI+CERT+Oracle+Coding+Standard+for+Java

Chi tiết chế độ xem CWE-1133

CWE-1133

Tên: Weaknesses Addressed by the SEI CERT Oracle Coding Standard for Java

Thành viên CWE

CWE-1134: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 00. Input Validation and Data Sanitization (IDS) Danh mục

CWE-1135: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 01. Declarations and Initialization (DCL) Danh mục

CWE-1136: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 02. Expressions (EXP) Danh mục

CWE-1137: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 03. Numeric Types and Operations (NUM) Danh mục

CWE-1138: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 04. Characters and Strings (STR) Danh mục

CWE-1139: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 05. Object Orientation (OBJ) Danh mục

CWE-1140: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 06. Methods (MET) Danh mục

CWE-1141: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 07. Exceptional Behavior (ERR) Danh mục

CWE-1142: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 08. Visibility and Atomicity (VNA) Danh mục

CWE-1143: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 09. Locking (LCK) Danh mục

CWE-1144: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 10. Thread APIs (THI) Danh mục

CWE-1145: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 11. Thread Pools (TPS) Danh mục

CWE-1146: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 12. Thread-Safety Miscellaneous (TSM) Danh mục

CWE-1147: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 13. Input Output (FIO) Danh mục

CWE-1148: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 14. Serialization (SER) Danh mục

CWE-1149: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 15. Platform Security (SEC) Danh mục

CWE-1150: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 16. Runtime Environment (ENV) Danh mục

CWE-1151: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 17. Java Native Interface (JNI) Danh mục

CWE-1152: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 49. Miscellaneous (MSC) Danh mục

CWE-1153: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 50. Android (DRD) Danh mục

CWE-1175: SEI CERT Oracle Secure Coding Standard for Java - Guidelines 18. Concurrency (CON) Danh mục

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Ghi chú

Đối tượng

Gửi

Sửa đổi

Tài liệu tham khảo

REF-970