Chi tiết chế độ xem CWE-1400

CWE-1400

Comprehensive Categorization for Software Assurance Trends
2023-04-25 +00:00
Draft
Graph
2023-06-29 +00:00
CWE Mitre.org
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Quản lý thông báo

Tên: Comprehensive Categorization for Software Assurance Trends

Thành viên CWE

CWE-1396: Weaknesses in this category are related to access control.
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods Cơ sở
CWE-13: ASP.NET Misconfiguration: Password in Configuration File Cơ sở
CWE-202: Exposure of Sensitive Information Through Data Queries Cơ sở
CWE-256: Plaintext Storage of a Password Cơ sở
CWE-257: Storing Passwords in a Recoverable Format Cơ sở
CWE-258: Empty Password in Configuration File Cơ sở
CWE-259: Use of Hard-coded Password Cơ sở
CWE-260: Password in Configuration File Cơ sở
CWE-261: Weak Encoding for Password Cơ sở
CWE-262: Not Using Password Aging Cơ sở
CWE-263: Password Aging with Long Expiration Cơ sở
CWE-266: Incorrect Privilege Assignment Cơ sở
CWE-267: Privilege Defined With Unsafe Actions Cơ sở
CWE-268: Privilege Chaining Cơ sở
CWE-269: Improper Privilege Management Cơ sở
CWE-270: Privilege Context Switching Error Cơ sở
CWE-271: Privilege Dropping / Lowering Errors Cơ sở
CWE-272: Least Privilege Violation Cơ sở
CWE-273: Improper Check for Dropped Privileges Cơ sở
CWE-274: Improper Handling of Insufficient Privileges Cơ sở
CWE-276: Incorrect Default Permissions Cơ sở
CWE-277: Insecure Inherited Permissions Cơ sở
CWE-278: Insecure Preserved Inherited Permissions Cơ sở
CWE-279: Incorrect Execution-Assigned Permissions Cơ sở
CWE-280: Improper Handling of Insufficient Permissions or Privileges Cơ sở
CWE-281: Improper Preservation of Permissions Cơ sở
CWE-282: Improper Ownership Management Cơ sở
CWE-283: Unverified Ownership Cơ sở
CWE-284: Improper Access Control Cơ sở
CWE-285: Improper Authorization Cơ sở
CWE-286: Incorrect User Management Cơ sở
CWE-287: Improper Authentication Cơ sở
CWE-288: Authentication Bypass Using an Alternate Path or Channel Cơ sở
CWE-289: Authentication Bypass by Alternate Name Cơ sở
CWE-290: Authentication Bypass by Spoofing Cơ sở
CWE-291: Reliance on IP Address for Authentication Cơ sở
CWE-293: Using Referer Field for Authentication Cơ sở
CWE-294: Authentication Bypass by Capture-replay Cơ sở
CWE-295: Improper Certificate Validation Cơ sở
CWE-296: Improper Following of a Certificate's Chain of Trust Cơ sở
CWE-297: Improper Validation of Certificate with Host Mismatch Cơ sở
CWE-298: Improper Validation of Certificate Expiration Cơ sở
CWE-299: Improper Check for Certificate Revocation Cơ sở
CWE-300: Channel Accessible by Non-Endpoint Cơ sở
CWE-301: Reflection Attack in an Authentication Protocol Cơ sở
CWE-302: Authentication Bypass by Assumed-Immutable Data Cơ sở
CWE-303: Incorrect Implementation of Authentication Algorithm Cơ sở
CWE-304: Missing Critical Step in Authentication Cơ sở
CWE-305: Authentication Bypass by Primary Weakness Cơ sở
CWE-306: Missing Authentication for Critical Functionality Cơ sở
CWE-307: Improper Restriction of Excessive Authentication Attempts Cơ sở
CWE-308: Use of Single-factor Authentication Cơ sở
CWE-309: Use of Password System for Primary Authentication Cơ sở
CWE-321: Use of Hard-coded Cryptographic Key Cơ sở
CWE-322: Key Exchange without Entity Authentication Cơ sở
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action Cơ sở
CWE-370: Missing Check for Certificate Revocation after Initial Check Cơ sở
CWE-384: Session Fixation Cơ sở
CWE-419: Unprotected Primary Channel Cơ sở
CWE-420: Unprotected Alternate Channel Cơ sở
CWE-421: Race Condition During Access to Alternate Channel Cơ sở
CWE-422: Unprotected Windows Messaging Channel Cơ sở
CWE-425: Direct Request Cơ sở
CWE-441: Unintended Proxy or Intermediary Cơ sở
CWE-520: .NET Misconfiguration: Use of Impersonation Cơ sở
CWE-521: Weak Password Requirements Cơ sở
CWE-522: Insufficiently Protected Credentials Cơ sở
CWE-523: Unprotected Transport of Credentials Cơ sở
CWE-549: Missing Password Field Masking Cơ sở
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization Cơ sở
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File Cơ sở
CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation Cơ sở
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Cơ sở
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created Cơ sở
CWE-599: Missing Validation of OpenSSL Certificate Cơ sở
CWE-601: URL Redirection to Untrusted Site Cơ sở
CWE-603: Use of Client-Side Authentication Cơ sở
CWE-611: Improper Restriction of XML External Entity Reference Cơ sở
CWE-612: Improper Authorization of Index Containing Sensitive Information Cơ sở
CWE-613: DEPRECATED: Insufficient Session Expiration Cơ sở
CWE-620: Unverified Password Change Cơ sở
CWE-623: Unsafe ActiveX Control Marked Safe For Scripting Cơ sở
CWE-639: Authorization Bypass Through User-Controlled Key Cơ sở
CWE-640: Weak Password Recovery Mechanism for Forgotten Password Cơ sở
CWE-645: Overly Restrictive Account Lockout Mechanism Cơ sở
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions Cơ sở
CWE-648: Incorrect Use of Privileged APIs Cơ sở
CWE-708: Incorrect Ownership Assignment Cơ sở
CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở
CWE-798: Use of Hard-coded Credentials Cơ sở
CWE-804: Guessable CAPTCHA Cơ sở
CWE-836: Use of Password Hash Instead of Password for Authentication Cơ sở
CWE-842: Placement of User into Incorrect Group Cơ sở
CWE-862: Missing Authorization Cơ sở
CWE-863: Incorrect Authorization Cơ sở
CWE-918: Server-Side Request Forgery Cơ sở
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control Cơ sở
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints Cơ sở
CWE-925: Improper Verification of Intent by Broadcast Receiver Cơ sở
CWE-926: Improper Export of Android Application Components Cơ sở
CWE-927: Use of Implicit Intent for Sensitive Communication Cơ sở
CWE-939: Improper Authorization in Handler for Custom URL Scheme Cơ sở
CWE-940: Improper Verification of Source of a Communication Channel Cơ sở
CWE-941: Incorrectly Specified Destination in a Communication Channel Cơ sở
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains Cơ sở
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag Cơ sở
CWE-1021: Improper Restriction of Rendered UI Layers or Frames Cơ sở
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access Cơ sở
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control Cơ sở
CWE-1220: Insufficient Granularity of Access Control Cơ sở
CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks Cơ sở
CWE-1224: Improper Restriction of Write-Once Bit Fields Cơ sở
CWE-1230: Exposure of Sensitive Information Through Metadata Cơ sở
CWE-1231: Improper Prevention of Lock Bit Modification Cơ sở
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection Cơ sở
CWE-1242: Inclusion of Undocumented Features or Chicken Bits Cơ sở
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug Cơ sở
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State Cơ sở
CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations Cơ sở
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features Cơ sở
CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions Cơ sở
CWE-1259: Improper Restriction of Security Token Assignment Cơ sở
CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges Cơ sở
CWE-1262: Improper Access Control for Register Interface Cơ sở
CWE-1263: Improper Physical Access Control Cơ sở
CWE-1267: Policy Uses Obsolete Encoding Cơ sở
CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents Cơ sở
CWE-1270: Generation of Incorrect Security Tokens Cơ sở
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code Cơ sở
CWE-1275: Sensitive Cookie with Improper SameSite Attribute Cơ sở
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System Cơ sở
CWE-1283: Mutable Attestation or Measurement Reporting Data Cơ sở
CWE-1290: Incorrect Decoding of Security Identifiers Cơ sở
CWE-1292: Incorrect Conversion of Security Identifiers Cơ sở
CWE-1294: Insecure Security Identifier Mechanism Cơ sở
CWE-1296: Incorrect Chaining or Granularity of Debug Components Cơ sở
CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors Cơ sở
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface Cơ sở
CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) Cơ sở
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation Cơ sở
CWE-1311: Improper Translation of Security Attributes by Fabric Bridge Cơ sở
CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall Cơ sở
CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime Cơ sở
CWE-1314: Missing Write Protection for Parametric Data Values Cơ sở
CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point Cơ sở
CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges Cơ sở
CWE-1317: Improper Access Control in Fabric Bridge Cơ sở
CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals Cơ sở
CWE-1323: Improper Management of Sensitive Trace Data Cơ sở
CWE-1328: Security Version Number Mutable to Older Versions Cơ sở
CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy Cơ sở
CWE-1390: Weak Authentication Cơ sở
CWE-1391: Use of Weak Credentials Cơ sở
CWE-1392: Use of Default Credentials Cơ sở
CWE-1393: Use of Default Password Cơ sở
CWE-1394: Use of Default Cryptographic Key Cơ sở
CWE-1401: Weaknesses in this category are related to concurrency.
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Cơ sở
CWE-363: Race Condition Enabling Link Following Cơ sở
CWE-364: Signal Handler Race Condition Cơ sở
CWE-366: Race Condition within a Thread Cơ sở
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition Cơ sở
CWE-368: Context Switching Race Condition Cơ sở
CWE-412: Unrestricted Externally Accessible Lock Cơ sở
CWE-413: Improper Resource Locking Cơ sở
CWE-414: Missing Lock Check Cơ sở
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations Cơ sở
CWE-479: Signal Handler Use of a Non-reentrant Function Cơ sở
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context Cơ sở
CWE-558: Use of getlogin() in Multithreaded Application Cơ sở
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context Cơ sở
CWE-572: Call to Thread run() instead of start() Cơ sở
CWE-574: EJB Bad Practices: Use of Synchronization Primitives Cơ sở
CWE-591: Sensitive Data Storage in Improperly Locked Memory Cơ sở
CWE-609: Double-Checked Locking Cơ sở
CWE-663: Use of a Non-reentrant Function in a Concurrent Context Cơ sở
CWE-667: Improper Locking Cơ sở
CWE-689: Permission Race Condition During Resource Copy Cơ sở
CWE-764: Multiple Locks of a Critical Resource Cơ sở
CWE-765: Multiple Unlocks of a Critical Resource Cơ sở
CWE-820: Missing Synchronization Cơ sở
CWE-821: Incorrect Synchronization Cơ sở
CWE-828: Signal Handler with Functionality that is not Asynchronous-Safe Cơ sở
CWE-831: Signal Handler Function Associated with Multiple Signals Cơ sở
CWE-832: Unlock of a Resource that is not Locked Cơ sở
CWE-833: Deadlock Cơ sở
CWE-1058: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element Cơ sở
CWE-1088: Synchronous Access of Remote Resource without Timeout Cơ sở
CWE-1096: Singleton Class Instance Creation without Proper Locking or Synchronization Cơ sở
CWE-1223: Race Condition for Write-Once Attributes Cơ sở
CWE-1232: Improper Lock Behavior After Power State Transition Cơ sở
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks Cơ sở
CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels Cơ sở
CWE-1298: Hardware Logic Contains Race Conditions Cơ sở
CWE-1403: Weaknesses in this category are related to exposed resource.
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote Cơ sở
CWE-15: External Control of System or Configuration Setting Cơ sở
CWE-73: External Control of File Name or Path Cơ sở
CWE-114: Process Control Cơ sở
CWE-219: Storage of File with Sensitive Data Under Web Root Cơ sở
CWE-220: Storage of File With Sensitive Data Under FTP Root Cơ sở
CWE-374: Passing Mutable Objects to an Untrusted Method Cơ sở
CWE-375: Returning a Mutable Object to an Untrusted Caller Cơ sở
CWE-377: DEPRECATED: Insecure Temporary File Cơ sở
CWE-378: Creation of Temporary File With Insecure Permissions Cơ sở
CWE-379: Creation of Temporary File in Directory with Insecure Permissions Cơ sở
CWE-402: Transmission of Private Resources into a New Sphere Cơ sở
CWE-403: Exposure of File Descriptor to Unintended Control Sphere Cơ sở
CWE-426: Untrusted Search Path Cơ sở
CWE-427: Uncontrolled Search Path Element Cơ sở
CWE-428: Unquoted Search Path or Element Cơ sở
CWE-433: Unparsed Raw Web Content Delivery Cơ sở
CWE-472: External Control of Assumed-Immutable Web Parameter Cơ sở
CWE-488: Exposure of Data Element to Wrong Session Cơ sở
CWE-491: Public cloneable() Method Without Final Cơ sở
CWE-492: Use of Inner Class Containing Sensitive Data Cơ sở
CWE-493: Critical Public Variable Without Final Modifier Cơ sở
CWE-498: Cloneable Class Containing Sensitive Information Cơ sở
CWE-499: Serializable Class Containing Sensitive Data Cơ sở
CWE-500: Public Static Field Not Marked Final Cơ sở
CWE-524: Use of Cache Containing Sensitive Information Cơ sở
CWE-525: Use of Web Browser Cache Containing Sensitive Information Cơ sở
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere Cơ sở
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere Cơ sở
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere Cơ sở
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere Cơ sở
CWE-539: Use of Persistent Cookies Containing Sensitive Information Cơ sở
CWE-552: Files or Directories Accessible to External Parties Cơ sở
CWE-553: Command Shell in Externally Accessible Directory Cơ sở
CWE-565: Reliance on Cookies without Validation and Integrity Checking Cơ sở
CWE-582: Array Declared Public, Final, and Static Cơ sở
CWE-583: finalize() Method Declared Public Cơ sở
CWE-608: Struts: Non-private Field in ActionForm Class Cơ sở
CWE-619: Dangling Database Cursor Cơ sở
CWE-642: External Control of Critical State Data Cơ sở
CWE-668: Exposure of Resource to Wrong Sphere Cơ sở
CWE-767: Access to Critical Private Variable via Public Method Cơ sở
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision Cơ sở
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory Cơ sở
CWE-1327: Binding to an Unrestricted IP Address Cơ sở
CWE-1404: Weaknesses in this category are related to file handling.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Cơ sở
CWE-23: Relative Path Traversal Cơ sở
CWE-24: Path Traversal: '../filedir' Cơ sở
CWE-25: Path Traversal: '/../filedir' Cơ sở
CWE-26: Path Traversal: '/dir/../filename' Cơ sở
CWE-27: Path Traversal: 'dir/../../filename' Cơ sở
CWE-28: Path Traversal: '..\filedir' Cơ sở
CWE-29: Path Traversal: '\..\filename' Cơ sở
CWE-30: Path Traversal: '\dir\..\filename' Cơ sở
CWE-31: Path Traversal: 'dir\..\..\filename' Cơ sở
CWE-32: Path Traversal: '...' (Triple Dot) Cơ sở
CWE-33: Path Traversal: '....' (Multiple Dot) Cơ sở
CWE-34: Path Traversal: '....//' Cơ sở
CWE-35: Path Traversal: '.../...//' Cơ sở
CWE-36: Absolute Path Traversal Cơ sở
CWE-37: Path Traversal: '/absolute/pathname/here' Cơ sở
CWE-38: Path Traversal: '\absolute\pathname\here' Cơ sở
CWE-39: Path Traversal: 'C:dirname' Cơ sở
CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share) Cơ sở
CWE-41: Improper Resolution of Path Equivalence Cơ sở
CWE-42: Path Equivalence: 'filename.' (Trailing Dot) Cơ sở
CWE-43: Path Equivalence: 'filename....' (Multiple Trailing Dot) Cơ sở
CWE-44: Path Equivalence: 'file.name' (Internal Dot) Cơ sở
CWE-45: Path Equivalence: 'file...name' (Multiple Internal Dot) Cơ sở
CWE-46: Path Equivalence: 'filename ' (Trailing Space) Cơ sở
CWE-47: Path Equivalence: ' filename' (Leading Space) Cơ sở
CWE-48: Path Equivalence: 'file name' (Internal Whitespace) Cơ sở
CWE-49: Path Equivalence: 'filename/' (Trailing Slash) Cơ sở
CWE-50: Path Equivalence: '//multiple/leading/slash' Cơ sở
CWE-51: Path Equivalence: '/multiple//internal/slash' Cơ sở
CWE-52: Path Equivalence: '/multiple/trailing/slash//' Cơ sở
CWE-53: Path Equivalence: '\multiple\\internal\backslash' Cơ sở
CWE-54: Path Equivalence: 'filedir\' (Trailing Backslash) Cơ sở
CWE-55: Path Equivalence: '/./' (Single Dot Directory) Cơ sở
CWE-56: Path Equivalence: 'filedir*' (Wildcard) Cơ sở
CWE-57: Path Equivalence: 'fakedir/../realdir/filename' Cơ sở
CWE-58: Path Equivalence: Windows 8.3 Filename Cơ sở
CWE-59: Improper Link Resolution Before File Access Cơ sở
CWE-61: UNIX Symbolic Link (Symlink) Following Cơ sở
CWE-62: UNIX Hard Link Cơ sở
CWE-64: Windows Shortcut Following (.LNK) Cơ sở
CWE-65: Windows Hard Link Cơ sở
CWE-66: Improper Handling of File Names that Identify Virtual Resources Cơ sở
CWE-67: Improper Handling of Windows Device Names Cơ sở
CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream Cơ sở
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path Cơ sở
CWE-1407: Weaknesses in this category are related to improper neutralization.
CWE-116: Improper Encoding or Escaping of Output Cơ sở
CWE-117: Improper Output Neutralization for Logs Cơ sở
CWE-130: Improper Handling of Length Parameter Inconsistency Cơ sở
CWE-138: Improper Neutralization of Special Elements Cơ sở
CWE-140: Improper Neutralization of Delimiters Cơ sở
CWE-141: Improper Neutralization of Parameter/Argument Delimiters Cơ sở
CWE-142: Improper Neutralization of Value Delimiters Cơ sở
CWE-143: Improper Neutralization of Record Delimiters Cơ sở
CWE-144: Improper Neutralization of Line Delimiters Cơ sở
CWE-145: Improper Neutralization of Section Delimiters Cơ sở
CWE-146: Improper Neutralization of Expression/Command Delimiters Cơ sở
CWE-147: Improper Neutralization of Input Terminators Cơ sở
CWE-148: Improper Neutralization of Input Leaders Cơ sở
CWE-149: Improper Neutralization of Quoting Syntax Cơ sở
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Cơ sở
CWE-151: Improper Neutralization of Comment Delimiters Cơ sở
CWE-152: Improper Neutralization of Macro Symbols Cơ sở
CWE-153: Improper Neutralization of Substitution Characters Cơ sở
CWE-154: Improper Neutralization of Variable Name Delimiters Cơ sở
CWE-155: Improper Neutralization of Wildcards or Matching Symbols Cơ sở
CWE-156: Improper Neutralization of Whitespace Cơ sở
CWE-157: Failure to Sanitize Paired Delimiters Cơ sở
CWE-158: Improper Neutralization of Null Byte or NUL Character Cơ sở
CWE-159: Improper Handling of Invalid Use of Special Elements Cơ sở
CWE-160: Improper Neutralization of Leading Special Elements Cơ sở
CWE-161: Improper Neutralization of Multiple Leading Special Elements Cơ sở
CWE-162: Improper Neutralization of Trailing Special Elements Cơ sở
CWE-163: Improper Neutralization of Multiple Trailing Special Elements Cơ sở
CWE-164: Improper Neutralization of Internal Special Elements Cơ sở
CWE-165: Improper Neutralization of Multiple Internal Special Elements Cơ sở
CWE-166: Improper Handling of Missing Special Element Cơ sở
CWE-167: Improper Handling of Additional Special Element Cơ sở
CWE-168: Improper Handling of Inconsistent Special Elements Cơ sở
CWE-170: Improper Null Termination Cơ sở
CWE-172: Improper Encoding or Decoding of Data Cơ sở
CWE-173: Improper Handling of Alternate Encoding Cơ sở
CWE-174: Double Decoding of the Same Data Cơ sở
CWE-175: Improper Handling of Mixed Encoding Cơ sở
CWE-176: Improper Handling of Unicode Encoding Cơ sở
CWE-177: Improper Handling of URL Encoding (Hex Encoding) Cơ sở
CWE-228: Improper Handling of Syntactically Invalid Structure Cơ sở
CWE-229: Improper Handling of Values Cơ sở
CWE-230: Improper Handling of Missing Values Cơ sở
CWE-231: Improper Handling of Extra Values Cơ sở
CWE-232: Improper Handling of Undefined Values Cơ sở
CWE-233: Improper Handling of Parameters Cơ sở
CWE-234: Failure to Handle Missing Parameter Cơ sở
CWE-235: Improper Handling of Extra Parameters Cơ sở
CWE-236: Improper Handling of Undefined Parameters Cơ sở
CWE-237: Improper Handling of Structural Elements Cơ sở
CWE-238: Improper Handling of Incomplete Structural Elements Cơ sở
CWE-239: Failure to Handle Incomplete Element Cơ sở
CWE-240: Improper Handling of Inconsistent Structural Elements Cơ sở
CWE-241: Improper Handling of Unexpected Data Type Cơ sở
CWE-463: Deletion of Data Structure Sentinel Cơ sở
CWE-464: Addition of Data Structure Sentinel Cơ sở
CWE-626: Null Byte Interaction Error (Poison Null Byte) Cơ sở
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax Cơ sở
CWE-707: Improper Neutralization Cơ sở
CWE-790: Improper Filtering of Special Elements Cơ sở
CWE-791: Incomplete Filtering of Special Elements Cơ sở
CWE-792: Incomplete Filtering of One or More Instances of Special Elements Cơ sở
CWE-793: Only Filtering One Instance of a Special Element Cơ sở
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements Cơ sở
CWE-795: Only Filtering Special Elements at a Specified Location Cơ sở
CWE-796: Only Filtering Special Elements Relative to a Marker Cơ sở
CWE-797: Only Filtering Special Elements at an Absolute Position Cơ sở
CWE-838: Inappropriate Encoding for Output Context Cơ sở
CWE-1409: Weaknesses in this category are related to injection.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Cơ sở
CWE-75: Failure to Sanitize Special Elements into a Different Plane Cơ sở
CWE-76: Improper Neutralization of Equivalent Special Elements Cơ sở
CWE-77: Improper Neutralization of Special Elements used in a Command Cơ sở
CWE-78: Improper Neutralization of Special Elements used in an OS Command Cơ sở
CWE-79: Improper Neutralization of Input During Web Page Generation Cơ sở
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Cơ sở
CWE-81: Improper Neutralization of Script in an Error Message Web Page Cơ sở
CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page Cơ sở
CWE-83: Improper Neutralization of Script in Attributes in a Web Page Cơ sở
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page Cơ sở
CWE-85: Doubled Character XSS Manipulations Cơ sở
CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages Cơ sở
CWE-87: Improper Neutralization of Alternate XSS Syntax Cơ sở
CWE-88: Improper Neutralization of Argument Delimiters in a Command Cơ sở
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Cơ sở
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Cơ sở
CWE-91: XML Injection Cơ sở
CWE-93: Improper Neutralization of CRLF Sequences Cơ sở
CWE-94: Improper Control of Generation of Code Cơ sở
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Cơ sở
CWE-96: Improper Neutralization of Directives in Statically Saved Code Cơ sở
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Cơ sở
CWE-99: Improper Control of Resource Identifiers Cơ sở
CWE-102: Struts: Duplicate Validation Forms Cơ sở
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Cơ sở
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input Cơ sở
CWE-621: Variable Extraction Error Cơ sở
CWE-624: Executable Regular Expression Error Cơ sở
CWE-627: Dynamic Variable Evaluation Cơ sở
CWE-641: Improper Restriction of Names for Files and Other Resources Cơ sở
CWE-643: Improper Neutralization of Data within XPath Expressions Cơ sở
CWE-652: Improper Neutralization of Data within XQuery Expressions Cơ sở
CWE-692: Incomplete Denylist to Cross-Site Scripting Cơ sở
CWE-694: Use of Multiple Resources with Duplicate Identifier Cơ sở
CWE-914: Improper Control of Dynamically-Identified Variables Cơ sở
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement Cơ sở
CWE-943: Improper Neutralization of Special Elements in Data Query Logic Cơ sở
CWE-1236: Improper Neutralization of Formula Elements in a CSV File Cơ sở
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine Cơ sở
CWE-1426: Improper Validation of Generative AI Output Cơ sở
CWE-1427: Improper Neutralization of Input Used for LLM Prompting Cơ sở
CWE-1410: Weaknesses in this category are related to insufficient control flow management.
CWE-179: Incorrect Behavior Order: Early Validation Cơ sở
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize Cơ sở
CWE-181: Incorrect Behavior Order: Validate Before Filter Cơ sở
CWE-248: Uncaught Exception Cơ sở
CWE-382: J2EE Bad Practices: Use of System.exit() Cơ sở
CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference Cơ sở
CWE-396: Declaration of Catch for Generic Exception Cơ sở
CWE-397: Declaration of Throws for Generic Exception Cơ sở
CWE-408: Incorrect Behavior Order: Early Amplification Cơ sở
CWE-430: Deployment of Wrong Handler Cơ sở
CWE-431: Missing Handler Cơ sở
CWE-455: Non-exit on Failed Initialization Cơ sở
CWE-480: Use of Incorrect Operator Cơ sở
CWE-481: Assigning instead of Comparing Cơ sở
CWE-482: Comparing instead of Assigning Cơ sở
CWE-483: Incorrect Block Delimitation Cơ sở
CWE-584: Return Inside Finally Block Cơ sở
CWE-600: Uncaught Exception in Servlet Cơ sở
CWE-617: Reachable Assertion Cơ sở
CWE-670: Always-Incorrect Control Flow Implementation Cơ sở
CWE-674: Uncontrolled Recursion Cơ sở
CWE-691: Insufficient Control Flow Management Cơ sở
CWE-696: Incorrect Behavior Order Cơ sở
CWE-698: Execution After Redirect (EAR) Cơ sở
CWE-705: Incorrect Control Flow Scoping Cơ sở
CWE-768: Incorrect Short Circuit Evaluation Cơ sở
CWE-783: Operator Precedence Logic Error Cơ sở
CWE-799: Improper Control of Interaction Frequency Cơ sở
CWE-834: Excessive Iteration Cơ sở
CWE-835: Loop with Unreachable Exit Condition Cơ sở
CWE-837: Improper Enforcement of a Single, Unique Action Cơ sở
CWE-841: Improper Enforcement of Behavioral Workflow Cơ sở
CWE-1190: DMA Device Enabled Too Early in Boot Phase Cơ sở
CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control Cơ sở
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls Cơ sở
CWE-1280: Access Control Check Implemented After Asset is Accessed Cơ sở
CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior Cơ sở
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context Cơ sở
CWE-1399: Weaknesses in this category are related to memory safety.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer Cơ sở
CWE-120: Buffer Copy without Checking Size of Input Cơ sở
CWE-121: Stack-based Buffer Overflow Cơ sở
CWE-122: Heap-based Buffer Overflow Cơ sở
CWE-123: Write-what-where Condition Cơ sở
CWE-124: Buffer Underwrite Cơ sở
CWE-125: Out-of-bounds Read Cơ sở
CWE-126: Buffer Over-read Cơ sở
CWE-127: Buffer Under-read Cơ sở
CWE-129: Improper Validation of Array Index Cơ sở
CWE-131: Incorrect Calculation of Buffer Size Cơ sở
CWE-134: Use of Externally-Controlled Format String Cơ sở
CWE-188: Reliance on Data/Memory Layout Cơ sở
CWE-198: Use of Incorrect Byte Ordering Cơ sở
CWE-244: Improper Clearing of Heap Memory Before Release Cơ sở
CWE-401: Missing Release of Memory after Effective Lifetime Cơ sở
CWE-415: Double Free Cơ sở
CWE-416: Use After Free Cơ sở
CWE-466: Return of Pointer Value Outside of Expected Range Cơ sở
CWE-562: Return of Stack Variable Address Cơ sở
CWE-587: Assignment of a Fixed Address to a Pointer Cơ sở
CWE-590: Free of Memory not on the Heap Cơ sở
CWE-680: Integer Overflow to Buffer Overflow Cơ sở
CWE-690: Unchecked Return Value to NULL Pointer Dereference Cơ sở
CWE-761: Free of Pointer not at Start of Buffer Cơ sở
CWE-762: Mismatched Memory Management Routines Cơ sở
CWE-763: Release of Invalid Pointer or Reference Cơ sở
CWE-786: Access of Memory Location Before Start of Buffer Cơ sở
CWE-787: Out-of-bounds Write Cơ sở
CWE-788: Access of Memory Location After End of Buffer Cơ sở
CWE-789: Memory Allocation with Excessive Size Value Cơ sở
CWE-805: Buffer Access with Incorrect Length Value Cơ sở
CWE-806: Buffer Access Using Size of Source Buffer Cơ sở
CWE-822: Untrusted Pointer Dereference Cơ sở
CWE-823: Use of Out-of-range Pointer Offset Cơ sở
CWE-824: Access of Uninitialized Pointer Cơ sở
CWE-825: Expired Pointer Dereference Cơ sở
CWE-1412: Weaknesses in this category are related to poor coding practices.
CWE-11: ASP.NET Misconfiguration: Creating Debug Binary Cơ sở
CWE-103: Struts: Incomplete validate() Method Definition Cơ sở
CWE-104: Struts: Form Bean Does Not Extend Validation Class Cơ sở
CWE-107: Struts: Unused Validation Form Cơ sở
CWE-110: Struts: Validator Without Form Field Cơ sở
CWE-111: Direct Use of Unsafe JNI Cơ sở
CWE-242: Use of Inherently Dangerous Function Cơ sở
CWE-245: J2EE Bad Practices: Direct Management of Connections Cơ sở
CWE-246: J2EE Bad Practices: Direct Use of Sockets Cơ sở
CWE-253: Incorrect Check of Function Return Value Cơ sở
CWE-358: Improperly Implemented Security Check for Standard Cơ sở
CWE-383: J2EE Bad Practices: Direct Use of Threads Cơ sở
CWE-392: Missing Report of Error Condition Cơ sở
CWE-393: Return of Wrong Status Code Cơ sở
CWE-440: Expected Behavior Violation Cơ sở
CWE-446: UI Discrepancy for Security Feature Cơ sở
CWE-448: Obsolete Feature in UI Cơ sở
CWE-449: The UI Performs the Wrong Action Cơ sở
CWE-451: User Interface (UI) Misrepresentation of Critical Information Cơ sở
CWE-462: Duplicate Key in Associative List (Alist) Cơ sở
CWE-474: Use of Function with Inconsistent Implementations Cơ sở
CWE-475: Undefined Behavior for Input to API Cơ sở
CWE-476: NULL Pointer Dereference Cơ sở
CWE-477: Use of Obsolete Function Cơ sở
CWE-484: Omitted Break Statement in Switch Cơ sở
CWE-489: Active Debug Code Cơ sở
CWE-506: Embedded Malicious Code Cơ sở
CWE-507: Trojan Horse Cơ sở
CWE-508: Non-Replicating Malicious Code Cơ sở
CWE-509: Replicating Malicious Code (Virus or Worm) Cơ sở
CWE-510: Trapdoor Cơ sở
CWE-511: Logic/Time Bomb Cơ sở
CWE-512: Spyware Cơ sở
CWE-546: Suspicious Comment Cơ sở
CWE-547: Use of Hard-coded, Security-relevant Constants Cơ sở
CWE-560: Use of umask() with chmod-style Argument Cơ sở
CWE-561: Dead Code Cơ sở
CWE-563: Assignment to Variable without Use Cơ sở
CWE-570: Expression is Always False Cơ sở
CWE-571: Expression is Always True Cơ sở
CWE-573: Improper Following of Specification by Caller Cơ sở
CWE-575: EJB Bad Practices: Use of AWT Swing Cơ sở
CWE-576: EJB Bad Practices: Use of Java I/O Cơ sở
CWE-577: EJB Bad Practices: Use of Sockets Cơ sở
CWE-578: EJB Bad Practices: Use of Class Loader Cơ sở
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session Cơ sở
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined Cơ sở
CWE-585: Empty Synchronized Block Cơ sở
CWE-586: Explicit Call to Finalize() Cơ sở
CWE-589: Call to Non-ubiquitous API Cơ sở
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk Cơ sở
CWE-605: Multiple Binds to the Same Port Cơ sở
CWE-628: Function Call with Incorrectly Specified Arguments Cơ sở
CWE-675: Multiple Operations on Resource in Single-Operation Context Cơ sở
CWE-676: Use of Potentially Dangerous Function Cơ sở
CWE-683: Function Call With Incorrect Order of Arguments Cơ sở
CWE-684: Incorrect Provision of Specified Functionality Cơ sở
CWE-685: Function Call With Incorrect Number of Arguments Cơ sở
CWE-686: Function Call With Incorrect Argument Type Cơ sở
CWE-687: Function Call With Incorrectly Specified Argument Value Cơ sở
CWE-688: Function Call With Incorrect Variable or Reference as Argument Cơ sở
CWE-695: Use of Low-Level Functionality Cơ sở
CWE-710: Improper Adherence to Coding Standards Cơ sở
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior Cơ sở
CWE-766: Critical Data Element Declared Public Cơ sở
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer Cơ sở
CWE-912: Hidden Functionality Cơ sở
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User Cơ sở
CWE-1041: Use of Redundant Code Cơ sở
CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements Cơ sở
CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range Cơ sở
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor Cơ sở
CWE-1047: Modules with Circular Dependencies Cơ sở
CWE-1048: Invokable Control Element with Large Number of Outward Calls Cơ sở
CWE-1053: Missing Documentation for Design Cơ sở
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer Cơ sở
CWE-1055: Multiple Inheritance from Concrete Classes Cơ sở
CWE-1056: Invokable Control Element with Variadic Parameters Cơ sở
CWE-1057: Data Access Operations Outside of Expected Data Manager Component Cơ sở
CWE-1059: Insufficient Technical Documentation Cơ sở
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses Cơ sở
CWE-1061: Insufficient Encapsulation Cơ sở
CWE-1062: Parent Class with References to Child Class Cơ sở
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters Cơ sở
CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers Cơ sở
CWE-1066: Missing Serialization Control Element Cơ sở
CWE-1068: Inconsistency Between Implementation and Documented Design Cơ sở
CWE-1069: Empty Exception Block Cơ sở
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements Cơ sở
CWE-1071: Empty Code Block Cơ sở
CWE-1074: Class with Excessively Deep Inheritance Cơ sở
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block Cơ sở
CWE-1076: Insufficient Adherence to Expected Conventions Cơ sở
CWE-1078: Inappropriate Source Code Style or Formatting Cơ sở
CWE-1079: Parent Class without Virtual Destructor Method Cơ sở
CWE-1080: Source Code File with Excessive Number of Lines of Code Cơ sở
CWE-1082: Class Instance Self Destruction Control Element Cơ sở
CWE-1083: Data Access from Outside Expected Data Manager Component Cơ sở
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code Cơ sở
CWE-1086: Class with Excessive Number of Child Classes Cơ sở
CWE-1087: Class with Virtual Method without a Virtual Destructor Cơ sở
CWE-1090: Method Containing Access of a Member Element from Another Class Cơ sở
CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers Cơ sở
CWE-1093: Excessively Complex Data Representation Cơ sở
CWE-1095: Loop Condition Value Update within the Loop Cơ sở
CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element Cơ sở
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element Cơ sở
CWE-1099: Inconsistent Naming Conventions for Identifiers Cơ sở
CWE-1100: Insufficient Isolation of System-Dependent Functions Cơ sở
CWE-1101: Reliance on Runtime Component in Generated Code Cơ sở
CWE-1102: Reliance on Machine-Dependent Data Representation Cơ sở
CWE-1103: Use of Platform-Dependent Third Party Components Cơ sở
CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality Cơ sở
CWE-1106: Insufficient Use of Symbolic Constants Cơ sở
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions Cơ sở
CWE-1108: Excessive Reliance on Global Variables Cơ sở
CWE-1109: Use of Same Variable for Multiple Purposes Cơ sở
CWE-1110: Incomplete Design Documentation Cơ sở
CWE-1111: Incomplete I/O Documentation Cơ sở
CWE-1112: Incomplete Documentation of Program Execution Cơ sở
CWE-1113: Inappropriate Comment Style Cơ sở
CWE-1114: Inappropriate Whitespace Style Cơ sở
CWE-1115: Source Code Element without Standard Prologue Cơ sở
CWE-1116: Inaccurate Source Code Comments Cơ sở
CWE-1117: Callable with Insufficient Behavioral Summary Cơ sở
CWE-1118: Insufficient Documentation of Error Handling Techniques Cơ sở
CWE-1119: Excessive Use of Unconditional Branching Cơ sở
CWE-1120: Excessive Code Complexity Cơ sở
CWE-1121: Excessive McCabe Cyclomatic Complexity Cơ sở
CWE-1122: Excessive Halstead Complexity Cơ sở
CWE-1123: Excessive Use of Self-Modifying Code Cơ sở
CWE-1124: Excessively Deep Nesting Cơ sở
CWE-1125: Excessive Attack Surface Cơ sở
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope Cơ sở
CWE-1127: Compilation with Insufficient Warnings or Errors Cơ sở
CWE-1164: Irrelevant Code Cơ sở
CWE-1177: Use of Prohibited Code Cơ sở
CWE-1209: Failure to Disable Reserved Bits Cơ sở
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic Cơ sở
CWE-1341: Multiple Releases of Same Resource or Handle Cơ sở
CWE-1357: Reliance on Insufficiently Trustworthy Component Cơ sở
CWE-1434: Insecure Setting of Generative AI/ML Model Inference Parameters Cơ sở
CWE-1413: Weaknesses in this category are related to protection mechanism failure.
CWE-182: Collapse of Data into Unsafe Value Cơ sở
CWE-184: Incomplete List of Disallowed Inputs Cơ sở
CWE-222: Truncation of Security-relevant Information Cơ sở
CWE-223: Omission of Security-relevant Information Cơ sở
CWE-224: Obscured Security-relevant Information by Alternate Name Cơ sở
CWE-356: Missing User Interaction for Potentially Unsafe Action Cơ sở
CWE-357: Insufficient UI Warning of Dangerous Operations Cơ sở
CWE-450: Multiple Interpretations of UI Input Cơ sở
CWE-602: Client-Side Enforcement of Server-Side Security Cơ sở
CWE-693: Protection Mechanism Failure Cơ sở
CWE-757: Selection of Less-Secure Algorithm During Negotiation Cơ sở
CWE-778: Insufficient Logging Cơ sở
CWE-807: Reliance on Untrusted Inputs in a Security Decision Cơ sở
CWE-1039: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism Cơ sở
CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications Cơ sở
CWE-1253: Incorrect Selection of Fuse Values Cơ sở
CWE-1269: Product Released in Non-Release Configuration Cơ sở
CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques Cơ sở
CWE-1291: Public Key Re-Use for Signing both Debug and Production Code Cơ sở
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses Cơ sở
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI) Cơ sở
CWE-1326: Missing Immutable Root of Trust in Hardware Cơ sở
CWE-1338: Improper Protections Against Hardware Overheating Cơ sở
CWE-1429: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface Cơ sở
CWE-1416: Weaknesses in this category are related to resource lifecycle management.
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Cơ sở
CWE-118: Incorrect Access of Indexable Resource Cơ sở
CWE-178: Improper Handling of Case Sensitivity Cơ sở
CWE-192: Integer Coercion Error Cơ sở
CWE-194: Unexpected Sign Extension Cơ sở
CWE-195: Signed to Unsigned Conversion Error Cơ sở
CWE-196: Unsigned to Signed Conversion Error Cơ sở
CWE-197: Numeric Truncation Error Cơ sở
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer Cơ sở
CWE-221: Information Loss or Omission Cơ sở
CWE-226: Sensitive Information in Resource Not Removed Before Reuse Cơ sở
CWE-243: Creation of chroot Jail Without Changing Working Directory Cơ sở
CWE-372: Incomplete Internal State Distinction Cơ sở
CWE-386: Symbolic Name not Mapping to Correct Object Cơ sở
CWE-400: Uncontrolled Resource Consumption Cơ sở
CWE-404: Improper Resource Shutdown or Release Cơ sở
CWE-405: Asymmetric Resource Consumption (Amplification) Cơ sở
CWE-406: Insufficient Control of Network Message Volume (Network Amplification) Cơ sở
CWE-407: Inefficient Algorithmic Complexity Cơ sở
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) Cơ sở
CWE-410: Insufficient Resource Pool Cơ sở
CWE-434: Unrestricted Upload of File with Dangerous Type Cơ sở
CWE-453: Insecure Default Variable Initialization Cơ sở
CWE-454: External Initialization of Trusted Variables or Data Stores Cơ sở
CWE-456: Missing Initialization of a Variable Cơ sở
CWE-457: Use of Uninitialized Variable Cơ sở
CWE-459: Incomplete Cleanup Cơ sở
CWE-460: Improper Cleanup on Thrown Exception Cơ sở
CWE-471: Modification of Assumed-Immutable Data (MAID) Cơ sở
CWE-487: Reliance on Package-level Scope Cơ sở
CWE-495: Private Data Structure Returned From A Public Method Cơ sở
CWE-496: Public Data Assigned to Private Array-Typed Field Cơ sở
CWE-501: Trust Boundary Violation Cơ sở
CWE-568: finalize() Method Without super.finalize() Cơ sở
CWE-580: clone() Method Without super.clone() Cơ sở
CWE-588: Attempt to Access Child of a Non-structure Pointer Cơ sở
CWE-607: Public Static Final Field References Mutable Object Cơ sở
CWE-610: Externally Controlled Reference to a Resource in Another Sphere Cơ sở
CWE-618: Exposed Unsafe ActiveX Method Cơ sở
CWE-662: Improper Synchronization Cơ sở
CWE-664: Improper Control of a Resource Through its Lifetime Cơ sở
CWE-665: Improper Initialization Cơ sở
CWE-666: Operation on Resource in Wrong Phase of Lifetime Cơ sở
CWE-669: Incorrect Resource Transfer Between Spheres Cơ sở
CWE-673: External Influence of Sphere Definition Cơ sở
CWE-681: Incorrect Conversion between Numeric Types Cơ sở
CWE-704: Incorrect Type Conversion or Cast Cơ sở
CWE-706: Use of Incorrectly-Resolved Name or Reference Cơ sở
CWE-749: Exposed Dangerous Method or Function Cơ sở
CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở
CWE-771: Missing Reference to Active Allocated Resource Cơ sở
CWE-772: Missing Release of Resource after Effective Lifetime Cơ sở
CWE-773: Missing Reference to Active File Descriptor or Handle Cơ sở
CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling Cơ sở
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime Cơ sở
CWE-776: Improper Restriction of Recursive Entity References in DTDs Cơ sở
CWE-779: Logging of Excessive Data Cơ sở
CWE-782: Exposed IOCTL with Insufficient Access Control Cơ sở
CWE-827: Improper Control of Document Type Definition Cơ sở
CWE-829: Inclusion of Functionality from Untrusted Control Sphere Cơ sở
CWE-830: Inclusion of Web Functionality from an Untrusted Source Cơ sở
CWE-843: Access of Resource Using Incompatible Type Cơ sở
CWE-908: Use of Uninitialized Resource Cơ sở
CWE-909: Missing Initialization of Resource Cơ sở
CWE-911: Improper Update of Reference Count Cơ sở
CWE-913: Improper Control of Dynamically-Managed Code Resources Cơ sở
CWE-920: Improper Restriction of Power Consumption Cơ sở
CWE-922: Insecure Storage of Sensitive Information Cơ sở
CWE-1042: Static Member Data Element outside of a Singleton Class Element Cơ sở
CWE-1046: Creation of Immutable Text Using String Concatenation Cơ sở
CWE-1049: Excessive Data Query Operations in a Large Data Table Cơ sở
CWE-1050: Excessive Platform Resource Consumption within a Loop Cơ sở
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data Cơ sở
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization Cơ sở
CWE-1063: Creation of Class Instance within a Static Code Block Cơ sở
CWE-1067: Excessive Execution of Sequential Searches of Data Resource Cơ sở
CWE-1072: Data Resource Access without Use of Connection Pooling Cơ sở
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses Cơ sở
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations Cơ sở
CWE-1089: Large Data Table with Excessive Number of Indices Cơ sở
CWE-1091: Use of Object without Invoking Destructor Method Cơ sở
CWE-1094: Excessive Index Range Scan for a Data Resource Cơ sở
CWE-1176: Inefficient CPU Computation Cơ sở
CWE-1188: Initialization of a Resource with an Insecure Default Cơ sở
CWE-1221: Incorrect Register Defaults or Module Parameters Cơ sở
CWE-1229: Creation of Emergent Resource Cơ sở
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations Cơ sở
CWE-1239: Improper Zeroization of Hardware Register Cơ sở
CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories Cơ sở
CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State Cơ sở
CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information Cơ sở
CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device Cơ sở
CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings Cơ sở
CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition Cơ sở
CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready Cơ sở
CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component Cơ sở
CWE-1325: Improperly Controlled Sequential Memory Allocation Cơ sở
CWE-1330: Remanent Data Readable after Memory Erase Cơ sở
CWE-1333: Inefficient Regular Expression Complexity Cơ sở
CWE-1342: Information Exposure through Microarchitectural State after Transient Execution Cơ sở
CWE-1386: Insecure Operation on Windows Junction / Mount Point Cơ sở
CWE-1389: Incorrect Parsing of Numbers with Different Radices Cơ sở
CWE-1419: Incorrect Initialization of Resource Cơ sở
CWE-1420: Exposure of Sensitive Information during Transient Execution Cơ sở
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution Cơ sở
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution Cơ sở
CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution Cơ sở
CWE-1417: Weaknesses in this category are related to sensitive information exposure.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Cơ sở
CWE-201: Insertion of Sensitive Information Into Sent Data Cơ sở
CWE-203: Observable Discrepancy Cơ sở
CWE-204: Observable Response Discrepancy Cơ sở
CWE-205: Observable Behavioral Discrepancy Cơ sở
CWE-206: Observable Internal Behavioral Discrepancy Cơ sở
CWE-207: Observable Behavioral Discrepancy With Equivalent Products Cơ sở
CWE-208: Observable Timing Discrepancy Cơ sở
CWE-209: Generation of Error Message Containing Sensitive Information Cơ sở
CWE-210: Self-generated Error Message Containing Sensitive Information Cơ sở
CWE-211: Externally-Generated Error Message Containing Sensitive Information Cơ sở
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies Cơ sở
CWE-214: Invocation of Process Using Visible Sensitive Information Cơ sở
CWE-215: Insertion of Sensitive Information Into Debugging Code Cơ sở
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Cơ sở
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Cơ sở
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable Cơ sở
CWE-531: Inclusion of Sensitive Information in Test Code Cơ sở
CWE-532: Insertion of Sensitive Information into Log File Cơ sở
CWE-535: Exposure of Information Through Shell Error Message Cơ sở
CWE-536: Servlet Runtime Error Message Containing Sensitive Information Cơ sở
CWE-537: Java Runtime Error Message Containing Sensitive Information Cơ sở
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Cơ sở
CWE-540: Inclusion of Sensitive Information in Source Code Cơ sở
CWE-541: Inclusion of Sensitive Information in an Include File Cơ sở
CWE-548: Exposure of Information Through Directory Listing Cơ sở
CWE-550: Server-generated Error Message Containing Sensitive Information Cơ sở
CWE-598: Use of HTTP Request With Sensitive Query String Cơ sở
CWE-615: Inclusion of Sensitive Information in Source Code Comments Cơ sở
CWE-651: Exposure of WSDL File Containing Sensitive Information Cơ sở
CWE-1254: Incorrect Comparison Logic Granularity Cơ sở
CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks Cơ sở
CWE-1273: Device Unlock Credential Sharing Cơ sở
CWE-1295: Debug Messages Revealing Unnecessary Information Cơ sở
CWE-1300: Improper Protection of Physical Side Channels Cơ sở
CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú

This view is different than the software development view (CWE-699) because this view is expected to include all weaknesses regardless of abstraction, while view 699 uses a largely-fixed Base level of abstraction related only to software weaknesses. It is different from the Research view (CWE-1000) because while comprehensive for all weaknesses, the view uses a deep hierarchical structure and excludes categories.

Đối tượng

Bên liên quan Mô tả
Academic Researchers Researchers can use this view to evaluate the breadth and depth of software assurance with respect to mitigating and managing weaknesses before they become vulnerabilities.

Gửi

Tên Tổ chức Ngày Ngày phát hành Version
CWE Content Team MITRE 2023-04-25 +00:00 2023-04-23 +00:00 4.11

Sửa đổi

Tên Tổ chức Ngày Bình luận
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.