Chi tiết chế độ xem CWE-1305

CWE-1305

CISQ Quality Measures (2020)
2020-08-18 +00:00
Incomplete
Graph
2023-06-29 +00:00
CWE Mitre.org
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Quản lý thông báo

Tên: CISQ Quality Measures (2020)

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

Thành viên CWE

CWE-1306: Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Cơ sở
CWE-170: Improper Null Termination Cơ sở
CWE-252: Unchecked Return Value Cơ sở
CWE-390: Detection of Error Condition Without Action Cơ sở
CWE-394: Unexpected Status Code or Return Value Cơ sở
CWE-404: Improper Resource Shutdown or Release Cơ sở
CWE-424: Improper Protection of Alternate Path Cơ sở
CWE-459: Incomplete Cleanup Cơ sở
CWE-476: NULL Pointer Dereference Cơ sở
CWE-480: Use of Incorrect Operator Cơ sở
CWE-484: Omitted Break Statement in Switch Cơ sở
CWE-562: Return of Stack Variable Address Cơ sở
CWE-595: Comparison of Object References Instead of Object Contents Cơ sở
CWE-662: Improper Synchronization Cơ sở
CWE-665: Improper Initialization Cơ sở
CWE-672: Operation on a Resource after Expiration or Release Cơ sở
CWE-681: Incorrect Conversion between Numeric Types Cơ sở
CWE-682: Incorrect Calculation Cơ sở
CWE-703: Improper Check or Handling of Exceptional Conditions Cơ sở
CWE-704: Incorrect Type Conversion or Cast Cơ sở
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior Cơ sở
CWE-835: Loop with Unreachable Exit Condition Cơ sở
CWE-908: Use of Uninitialized Resource Cơ sở
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor Cơ sở
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data Cơ sở
CWE-1066: Missing Serialization Control Element Cơ sở
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements Cơ sở
CWE-1077: Floating Point Comparison with Incorrect Operator Cơ sở
CWE-1079: Parent Class without Virtual Destructor Method Cơ sở
CWE-1082: Class Instance Self Destruction Control Element Cơ sở
CWE-1083: Data Access from Outside Expected Data Manager Component Cơ sở
CWE-1087: Class with Virtual Method without a Virtual Destructor Cơ sở
CWE-1088: Synchronous Access of Remote Resource without Timeout Cơ sở
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element Cơ sở
CWE-1307: Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.
CWE-407: Inefficient Algorithmic Complexity Cơ sở
CWE-478: Missing Default Case in Multiple Condition Expression Cơ sở
CWE-480: Use of Incorrect Operator Cơ sở
CWE-484: Omitted Break Statement in Switch Cơ sở
CWE-561: Dead Code Cơ sở
CWE-570: Expression is Always False Cơ sở
CWE-571: Expression is Always True Cơ sở
CWE-783: Operator Precedence Logic Error Cơ sở
CWE-1041: Use of Redundant Code Cơ sở
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor Cơ sở
CWE-1047: Modules with Circular Dependencies Cơ sở
CWE-1048: Invokable Control Element with Large Number of Outward Calls Cơ sở
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data Cơ sở
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization Cơ sở
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer Cơ sở
CWE-1055: Multiple Inheritance from Concrete Classes Cơ sở
CWE-1062: Parent Class with References to Child Class Cơ sở
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters Cơ sở
CWE-1074: Class with Excessively Deep Inheritance Cơ sở
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block Cơ sở
CWE-1079: Parent Class without Virtual Destructor Method Cơ sở
CWE-1080: Source Code File with Excessive Number of Lines of Code Cơ sở
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations Cơ sở
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code Cơ sở
CWE-1086: Class with Excessive Number of Child Classes Cơ sở
CWE-1087: Class with Virtual Method without a Virtual Destructor Cơ sở
CWE-1090: Method Containing Access of a Member Element from Another Class Cơ sở
CWE-1095: Loop Condition Value Update within the Loop Cơ sở
CWE-1308: Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Cơ sở
CWE-77: Improper Neutralization of Special Elements used in a Command Cơ sở
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Cơ sở
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Cơ sở
CWE-91: XML Injection Cơ sở
CWE-99: Improper Control of Resource Identifiers Cơ sở
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Cơ sở
CWE-129: Improper Validation of Array Index Cơ sở
CWE-134: Use of Externally-Controlled Format String Cơ sở
CWE-252: Unchecked Return Value Cơ sở
CWE-404: Improper Resource Shutdown or Release Cơ sở
CWE-424: Improper Protection of Alternate Path Cơ sở
CWE-434: Unrestricted Upload of File with Dangerous Type Cơ sở
CWE-477: Use of Obsolete Function Cơ sở
CWE-480: Use of Incorrect Operator Cơ sở
CWE-502: Deserialization of Untrusted Data Cơ sở
CWE-570: Expression is Always False Cơ sở
CWE-571: Expression is Always True Cơ sở
CWE-606: Unchecked Input for Loop Condition Cơ sở
CWE-611: Improper Restriction of XML External Entity Reference Cơ sở
CWE-643: Improper Neutralization of Data within XPath Expressions Cơ sở
CWE-652: Improper Neutralization of Data within XQuery Expressions Cơ sở
CWE-662: Improper Synchronization Cơ sở
CWE-665: Improper Initialization Cơ sở
CWE-672: Operation on a Resource after Expiration or Release Cơ sở
CWE-681: Incorrect Conversion between Numeric Types Cơ sở
CWE-682: Incorrect Calculation Cơ sở
CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở
CWE-778: Insufficient Logging Cơ sở
CWE-783: Operator Precedence Logic Error Cơ sở
CWE-789: Memory Allocation with Excessive Size Value Cơ sở
CWE-79: Improper Neutralization of Input During Web Page Generation Cơ sở
CWE-798: Use of Hard-coded Credentials Cơ sở
CWE-835: Loop with Unreachable Exit Condition Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Đối tượng

Bên liên quan Mô tả
Software Developers This view provides a good starting point for anyone involved in software development (including architects, designers, coders, and testers) to ensure that code quality issues are considered during the development process.
Product Vendors This view can help product vendors understand code quality issues and convey an overall status of their software.
Assessment Tool Vendors This view provides a good starting point for assessment tool vendors (e.g., vendors selling static analysis tools) who wish to understand what constitutes software with good code quality, and which quality issues may be of concern.

Gửi

Tên Tổ chức Ngày Ngày phát hành Version
CWE Content Team MITRE 2020-08-18 +00:00 2020-08-20 +00:00 4.2

Sửa đổi

Tên Tổ chức Ngày Bình luận
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

Tài liệu tham khảo

REF-1133

Automated Source Code Quality Measures
Consortium for Information & Software Quality (CISQ).
https://www.omg.org/spec/ASCQM/

Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.