Chi tiết chế độ xem CWE-1344

CWE-1344

Weaknesses in OWASP Top Ten (2021)
2021-10-05 +00:00
Incomplete
Graph
2023-06-29 +00:00
CWE Mitre.org
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Quản lý thông báo

Tên: Weaknesses in OWASP Top Ten (2021)

CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021.

Thành viên CWE

CWE-1345: Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Cơ sở
CWE-23: Relative Path Traversal Cơ sở
CWE-35: Path Traversal: '.../...//' Cơ sở
CWE-59: Improper Link Resolution Before File Access Cơ sở
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Cơ sở
CWE-201: Insertion of Sensitive Information Into Sent Data Cơ sở
CWE-219: Storage of File with Sensitive Data Under Web Root Cơ sở
CWE-264: Permissions, Privileges, and Access Controls Danh mục
CWE-275: Permission Issues Danh mục
CWE-276: Incorrect Default Permissions Cơ sở
CWE-284: Improper Access Control Cơ sở
CWE-285: Improper Authorization Cơ sở
CWE-352: Cross-Site Request Forgery Cơ sở
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Cơ sở
CWE-377: DEPRECATED: Insecure Temporary File Cơ sở
CWE-402: Transmission of Private Resources into a New Sphere Cơ sở
CWE-425: Direct Request Cơ sở
CWE-441: Unintended Proxy or Intermediary Cơ sở
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Cơ sở
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Cơ sở
CWE-540: Inclusion of Sensitive Information in Source Code Cơ sở
CWE-548: Exposure of Information Through Directory Listing Cơ sở
CWE-552: Files or Directories Accessible to External Parties Cơ sở
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Cơ sở
CWE-601: URL Redirection to Untrusted Site Cơ sở
CWE-639: Authorization Bypass Through User-Controlled Key Cơ sở
CWE-651: Exposure of WSDL File Containing Sensitive Information Cơ sở
CWE-668: Exposure of Resource to Wrong Sphere Cơ sở
CWE-706: Use of Incorrectly-Resolved Name or Reference Cơ sở
CWE-862: Missing Authorization Cơ sở
CWE-863: Incorrect Authorization Cơ sở
CWE-913: Improper Control of Dynamically-Managed Code Resources Cơ sở
CWE-922: Insecure Storage of Sensitive Information Cơ sở
CWE-1275: Sensitive Cookie with Improper SameSite Attribute Cơ sở
CWE-1346: Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021.
CWE-261: Weak Encoding for Password Cơ sở
CWE-296: Improper Following of a Certificate's Chain of Trust Cơ sở
CWE-310: Cryptographic Issues Danh mục
CWE-319: Cleartext Transmission of Sensitive Information Cơ sở
CWE-321: Use of Hard-coded Cryptographic Key Cơ sở
CWE-322: Key Exchange without Entity Authentication Cơ sở
CWE-323: Reusing a Nonce, Key Pair in Encryption Cơ sở
CWE-324: Use of a Key Past its Expiration Date Cơ sở
CWE-325: Missing Cryptographic Step Cơ sở
CWE-326: Inadequate Encryption Strength Cơ sở
CWE-327: Use of a Broken or Risky Cryptographic Algorithm Cơ sở
CWE-328: Use of Weak Hash Cơ sở
CWE-329: Generation of Predictable IV with CBC Mode Cơ sở
CWE-330: Use of Insufficiently Random Values Cơ sở
CWE-331: Insufficient Entropy Cơ sở
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-340: Generation of Predictable Numbers or Identifiers Cơ sở
CWE-347: Improper Verification of Cryptographic Signature Cơ sở
CWE-523: Unprotected Transport of Credentials Cơ sở
CWE-720: OWASP Top Ten 2007 Category A9 - Insecure Communications Danh mục
CWE-757: Selection of Less-Secure Algorithm During Negotiation Cơ sở
CWE-759: Use of a One-Way Hash without a Salt Cơ sở
CWE-760: Use of a One-Way Hash with a Predictable Salt Cơ sở
CWE-780: Use of RSA Algorithm without OAEP Cơ sở
CWE-818: OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection Danh mục
CWE-916: Use of Password Hash With Insufficient Computational Effort Cơ sở
CWE-1347: Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top Ten 2021.
CWE-20: Improper Input Validation Cơ sở
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Cơ sở
CWE-75: Failure to Sanitize Special Elements into a Different Plane Cơ sở
CWE-77: Improper Neutralization of Special Elements used in a Command Cơ sở
CWE-78: Improper Neutralization of Special Elements used in an OS Command Cơ sở
CWE-79: Improper Neutralization of Input During Web Page Generation Cơ sở
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Cơ sở
CWE-83: Improper Neutralization of Script in Attributes in a Web Page Cơ sở
CWE-87: Improper Neutralization of Alternate XSS Syntax Cơ sở
CWE-88: Improper Neutralization of Argument Delimiters in a Command Cơ sở
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Cơ sở
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Cơ sở
CWE-91: XML Injection Cơ sở
CWE-93: Improper Neutralization of CRLF Sequences Cơ sở
CWE-94: Improper Control of Generation of Code Cơ sở
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Cơ sở
CWE-96: Improper Neutralization of Directives in Statically Saved Code Cơ sở
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Cơ sở
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Cơ sở
CWE-99: Improper Control of Resource Identifiers Cơ sở
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Cơ sở
CWE-116: Improper Encoding or Escaping of Output Cơ sở
CWE-138: Improper Neutralization of Special Elements Cơ sở
CWE-184: Incomplete List of Disallowed Inputs Cơ sở
CWE-470: Use of Externally-Controlled Input to Select Classes or Code Cơ sở
CWE-471: Modification of Assumed-Immutable Data (MAID) Cơ sở
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input Cơ sở
CWE-610: Externally Controlled Reference to a Resource in Another Sphere Cơ sở
CWE-643: Improper Neutralization of Data within XPath Expressions Cơ sở
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax Cơ sở
CWE-652: Improper Neutralization of Data within XQuery Expressions Cơ sở
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement Cơ sở
CWE-1348: Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top Ten 2021.
CWE-73: External Control of File Name or Path Cơ sở
CWE-183: Permissive List of Allowed Inputs Cơ sở
CWE-209: Generation of Error Message Containing Sensitive Information Cơ sở
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies Cơ sở
CWE-235: Improper Handling of Extra Parameters Cơ sở
CWE-256: Plaintext Storage of a Password Cơ sở
CWE-257: Storing Passwords in a Recoverable Format Cơ sở
CWE-266: Incorrect Privilege Assignment Cơ sở
CWE-269: Improper Privilege Management Cơ sở
CWE-280: Improper Handling of Insufficient Permissions or Privileges Cơ sở
CWE-311: Missing Encryption of Sensitive Data Cơ sở
CWE-312: Cleartext Storage of Sensitive Information Cơ sở
CWE-313: Cleartext Storage in a File or on Disk Cơ sở
CWE-316: Cleartext Storage of Sensitive Information in Memory Cơ sở
CWE-419: Unprotected Primary Channel Cơ sở
CWE-430: Deployment of Wrong Handler Cơ sở
CWE-434: Unrestricted Upload of File with Dangerous Type Cơ sở
CWE-444: Inconsistent Interpretation of HTTP Requests Cơ sở
CWE-451: User Interface (UI) Misrepresentation of Critical Information Cơ sở
CWE-472: External Control of Assumed-Immutable Web Parameter Cơ sở
CWE-501: Trust Boundary Violation Cơ sở
CWE-522: Insufficiently Protected Credentials Cơ sở
CWE-525: Use of Web Browser Cache Containing Sensitive Information Cơ sở
CWE-539: Use of Persistent Cookies Containing Sensitive Information Cơ sở
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session Cơ sở
CWE-598: Use of HTTP Request With Sensitive Query String Cơ sở
CWE-602: Client-Side Enforcement of Server-Side Security Cơ sở
CWE-642: External Control of Critical State Data Cơ sở
CWE-646: Reliance on File Name or Extension of Externally-Supplied File Cơ sở
CWE-650: Trusting HTTP Permission Methods on the Server Side Cơ sở
CWE-653: Improper Isolation or Compartmentalization Cơ sở
CWE-656: Reliance on Security Through Obscurity Cơ sở
CWE-657: Violation of Secure Design Principles Cơ sở
CWE-799: Improper Control of Interaction Frequency Cơ sở
CWE-807: Reliance on Untrusted Inputs in a Security Decision Cơ sở
CWE-840: Business Logic Errors Danh mục
CWE-841: Improper Enforcement of Behavioral Workflow Cơ sở
CWE-927: Use of Implicit Intent for Sensitive Communication Cơ sở
CWE-1021: Improper Restriction of Rendered UI Layers or Frames Cơ sở
CWE-1173: Improper Use of Validation Framework Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú

As of CWE 4.6, the relationships in this view were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Đối tượng

Bên liên quan Mô tả
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing a good starting point for web application developers who want to code more securely.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

Gửi

Tên Tổ chức Ngày Ngày phát hành Version
CWE Content Team MITRE 2021-10-05 +00:00 2021-10-28 +00:00 4.6

Sửa đổi

Tên Tổ chức Ngày Bình luận
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

Tài liệu tham khảo

REF-1206

OWASP Top 10:2021
https://owasp.org/Top10/

Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.