Chi tiết chế độ xem CWE-1450

CWE-1450

Weaknesses in OWASP Top Ten RC1 (2025)
2024-12-01 +00:00
Incomplete
Graph
CWE Mitre.org
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Quản lý thông báo

Tên: Weaknesses in OWASP Top Ten RC1 (2025)

CWE entries in this view (graph) are associated with the first release candidate (RC1) of the OWASP Top Ten, as released in 2025.

Thành viên CWE

CWE-1436: Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2025.
CWE-1275: Sensitive Cookie with Improper SameSite Attribute Cơ sở
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor Cơ sở
CWE-201: Insertion of Sensitive Information Into Sent Data Cơ sở
CWE-219: Storage of File with Sensitive Data Under Web Root Cơ sở
CWE-22: Improper Limitation of a Pathname to a Restricted Directory Cơ sở
CWE-23: Relative Path Traversal Cơ sở
CWE-276: Incorrect Default Permissions Cơ sở
CWE-281: Improper Preservation of Permissions Cơ sở
CWE-282: Improper Ownership Management Cơ sở
CWE-283: Unverified Ownership Cơ sở
CWE-284: Improper Access Control Cơ sở
CWE-285: Improper Authorization Cơ sở
CWE-352: Cross-Site Request Forgery Cơ sở
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Cơ sở
CWE-36: Absolute Path Traversal Cơ sở
CWE-377: DEPRECATED: Insecure Temporary File Cơ sở
CWE-379: Creation of Temporary File in Directory with Insecure Permissions Cơ sở
CWE-402: Transmission of Private Resources into a New Sphere Cơ sở
CWE-424: Improper Protection of Alternate Path Cơ sở
CWE-425: Direct Request Cơ sở
CWE-441: Unintended Proxy or Intermediary Cơ sở
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Cơ sở
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory Cơ sở
CWE-540: Inclusion of Sensitive Information in Source Code Cơ sở
CWE-548: Exposure of Information Through Directory Listing Cơ sở
CWE-552: Files or Directories Accessible to External Parties Cơ sở
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key Cơ sở
CWE-59: Improper Link Resolution Before File Access Cơ sở
CWE-601: URL Redirection to Untrusted Site Cơ sở
CWE-61: UNIX Symbolic Link (Symlink) Following Cơ sở
CWE-615: Inclusion of Sensitive Information in Source Code Comments Cơ sở
CWE-639: Authorization Bypass Through User-Controlled Key Cơ sở
CWE-65: Windows Hard Link Cơ sở
CWE-668: Exposure of Resource to Wrong Sphere Cơ sở
CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở
CWE-749: Exposed Dangerous Method or Function Cơ sở
CWE-862: Missing Authorization Cơ sở
CWE-863: Incorrect Authorization Cơ sở
CWE-918: Server-Side Request Forgery Cơ sở
CWE-922: Insecure Storage of Sensitive Information Cơ sở
CWE-1439: Weaknesses in this category are related to the A04 category "Cryptographic Failures" in the OWASP Top Ten 2025.
CWE-1240: Use of a Cryptographic Primitive with a Risky Implementation Cơ sở
CWE-1241: Use of Predictable Algorithm in Random Number Generator Cơ sở
CWE-261: Weak Encoding for Password Cơ sở
CWE-296: Improper Following of a Certificate's Chain of Trust Cơ sở
CWE-319: Cleartext Transmission of Sensitive Information Cơ sở
CWE-320: Key Management Errors Danh mục
CWE-321: Use of Hard-coded Cryptographic Key Cơ sở
CWE-322: Key Exchange without Entity Authentication Cơ sở
CWE-323: Reusing a Nonce, Key Pair in Encryption Cơ sở
CWE-324: Use of a Key Past its Expiration Date Cơ sở
CWE-325: Missing Cryptographic Step Cơ sở
CWE-326: Inadequate Encryption Strength Cơ sở
CWE-327: Use of a Broken or Risky Cryptographic Algorithm Cơ sở
CWE-328: Use of Weak Hash Cơ sở
CWE-329: Generation of Predictable IV with CBC Mode Cơ sở
CWE-330: Use of Insufficiently Random Values Cơ sở
CWE-331: Insufficient Entropy Cơ sở
CWE-332: Insufficient Entropy in PRNG Cơ sở
CWE-334: Small Space of Random Values Cơ sở
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Cơ sở
CWE-340: Generation of Predictable Numbers or Identifiers Cơ sở
CWE-342: Predictable Exact Value from Previous Values Cơ sở
CWE-347: Improper Verification of Cryptographic Signature Cơ sở
CWE-523: Unprotected Transport of Credentials Cơ sở
CWE-757: Selection of Less-Secure Algorithm During Negotiation Cơ sở
CWE-759: Use of a One-Way Hash without a Salt Cơ sở
CWE-760: Use of a One-Way Hash with a Predictable Salt Cơ sở
CWE-780: Use of RSA Algorithm without OAEP Cơ sở
CWE-916: Use of Password Hash With Insufficient Computational Effort Cơ sở
CWE-1440: Weaknesses in this category are related to the A05 category "Injection" in the OWASP Top Ten 2025.
CWE-103: Struts: Incomplete validate() Method Definition Cơ sở
CWE-104: Struts: Form Bean Does Not Extend Validation Class Cơ sở
CWE-112: Missing XML Validation Cơ sở
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Cơ sở
CWE-114: Process Control Cơ sở
CWE-115: Misinterpretation of Input Cơ sở
CWE-116: Improper Encoding or Escaping of Output Cơ sở
CWE-129: Improper Validation of Array Index Cơ sở
CWE-159: Improper Handling of Invalid Use of Special Elements Cơ sở
CWE-20: Improper Input Validation Cơ sở
CWE-470: Use of Externally-Controlled Input to Select Classes or Code Cơ sở
CWE-493: Critical Public Variable Without Final Modifier Cơ sở
CWE-500: Public Static Field Not Marked Final Cơ sở
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input Cơ sở
CWE-610: Externally Controlled Reference to a Resource in Another Sphere Cơ sở
CWE-643: Improper Neutralization of Data within XPath Expressions Cơ sở
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax Cơ sở
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component Cơ sở
CWE-76: Improper Neutralization of Equivalent Special Elements Cơ sở
CWE-77: Improper Neutralization of Special Elements used in a Command Cơ sở
CWE-78: Improper Neutralization of Special Elements used in an OS Command Cơ sở
CWE-79: Improper Neutralization of Input During Web Page Generation Cơ sở
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Cơ sở
CWE-83: Improper Neutralization of Script in Attributes in a Web Page Cơ sở
CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages Cơ sở
CWE-88: Improper Neutralization of Argument Delimiters in a Command Cơ sở
CWE-89: Improper Neutralization of Special Elements used in an SQL Command Cơ sở
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Cơ sở
CWE-91: XML Injection Cơ sở
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement Cơ sở
CWE-93: Improper Neutralization of CRLF Sequences Cơ sở
CWE-94: Improper Control of Generation of Code Cơ sở
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Cơ sở
CWE-96: Improper Neutralization of Directives in Statically Saved Code Cơ sở
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page Cơ sở
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program Cơ sở
CWE-99: Improper Control of Resource Identifiers Cơ sở
CWE-1441: Weaknesses in this category are related to the A06 category "Insecure Design" in the OWASP Top Ten 2025.
CWE-1021: Improper Restriction of Rendered UI Layers or Frames Cơ sở
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access Cơ sở
CWE-1125: Excessive Attack Surface Cơ sở
CWE-183: Permissive List of Allowed Inputs Cơ sở
CWE-256: Plaintext Storage of a Password Cơ sở
CWE-266: Incorrect Privilege Assignment Cơ sở
CWE-269: Improper Privilege Management Cơ sở
CWE-286: Incorrect User Management Cơ sở
CWE-311: Missing Encryption of Sensitive Data Cơ sở
CWE-312: Cleartext Storage of Sensitive Information Cơ sở
CWE-313: Cleartext Storage in a File or on Disk Cơ sở
CWE-316: Cleartext Storage of Sensitive Information in Memory Cơ sở
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Cơ sở
CWE-382: J2EE Bad Practices: Use of System.exit() Cơ sở
CWE-419: Unprotected Primary Channel Cơ sở
CWE-434: Unrestricted Upload of File with Dangerous Type Cơ sở
CWE-436: Interpretation Conflict Cơ sở
CWE-444: Inconsistent Interpretation of HTTP Requests Cơ sở
CWE-451: User Interface (UI) Misrepresentation of Critical Information Cơ sở
CWE-454: External Initialization of Trusted Variables or Data Stores Cơ sở
CWE-472: External Control of Assumed-Immutable Web Parameter Cơ sở
CWE-501: Trust Boundary Violation Cơ sở
CWE-522: Insufficiently Protected Credentials Cơ sở
CWE-525: Use of Web Browser Cache Containing Sensitive Information Cơ sở
CWE-539: Use of Persistent Cookies Containing Sensitive Information Cơ sở
CWE-598: Use of HTTP Request With Sensitive Query String Cơ sở
CWE-602: Client-Side Enforcement of Server-Side Security Cơ sở
CWE-628: Function Call with Incorrectly Specified Arguments Cơ sở
CWE-642: External Control of Critical State Data Cơ sở
CWE-646: Reliance on File Name or Extension of Externally-Supplied File Cơ sở
CWE-653: Improper Isolation or Compartmentalization Cơ sở
CWE-656: Reliance on Security Through Obscurity Cơ sở
CWE-657: Violation of Secure Design Principles Cơ sở
CWE-676: Use of Potentially Dangerous Function Cơ sở
CWE-693: Protection Mechanism Failure Cơ sở
CWE-73: External Control of File Name or Path Cơ sở
CWE-799: Improper Control of Interaction Frequency Cơ sở
CWE-807: Reliance on Untrusted Inputs in a Security Decision Cơ sở
CWE-841: Improper Enforcement of Behavioral Workflow Cơ sở
CWE-1442: Weaknesses in this category are related to the A07 category "Authentication Failures" in the OWASP Top Ten 2025.
CWE-1390: Weak Authentication Cơ sở
CWE-1391: Use of Weak Credentials Cơ sở
CWE-1392: Use of Default Credentials Cơ sở
CWE-1393: Use of Default Password Cơ sở
CWE-258: Empty Password in Configuration File Cơ sở
CWE-259: Use of Hard-coded Password Cơ sở
CWE-287: Improper Authentication Cơ sở
CWE-288: Authentication Bypass Using an Alternate Path or Channel Cơ sở
CWE-289: Authentication Bypass by Alternate Name Cơ sở
CWE-290: Authentication Bypass by Spoofing Cơ sở
CWE-291: Reliance on IP Address for Authentication Cơ sở
CWE-293: Using Referer Field for Authentication Cơ sở
CWE-294: Authentication Bypass by Capture-replay Cơ sở
CWE-295: Improper Certificate Validation Cơ sở
CWE-297: Improper Validation of Certificate with Host Mismatch Cơ sở
CWE-298: Improper Validation of Certificate Expiration Cơ sở
CWE-299: Improper Check for Certificate Revocation Cơ sở
CWE-300: Channel Accessible by Non-Endpoint Cơ sở
CWE-302: Authentication Bypass by Assumed-Immutable Data Cơ sở
CWE-303: Incorrect Implementation of Authentication Algorithm Cơ sở
CWE-304: Missing Critical Step in Authentication Cơ sở
CWE-305: Authentication Bypass by Primary Weakness Cơ sở
CWE-306: Missing Authentication for Critical Functionality Cơ sở
CWE-307: Improper Restriction of Excessive Authentication Attempts Cơ sở
CWE-308: Use of Single-factor Authentication Cơ sở
CWE-309: Use of Password System for Primary Authentication Cơ sở
CWE-346: Origin Validation Error Cơ sở
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action Cơ sở
CWE-384: Session Fixation Cơ sở
CWE-521: Weak Password Requirements Cơ sở
CWE-613: DEPRECATED: Insufficient Session Expiration Cơ sở
CWE-620: Unverified Password Change Cơ sở
CWE-640: Weak Password Recovery Mechanism for Forgotten Password Cơ sở
CWE-798: Use of Hard-coded Credentials Cơ sở
CWE-940: Improper Verification of Source of a Communication Channel Cơ sở
CWE-941: Incorrectly Specified Destination in a Communication Channel Cơ sở
CWE-1445: Weaknesses in this category are related to the A10 category "Mishandling of Exceptional Conditions" in the OWASP Top Ten 2025.
CWE-209: Generation of Error Message Containing Sensitive Information Cơ sở
CWE-215: Insertion of Sensitive Information Into Debugging Code Cơ sở
CWE-234: Failure to Handle Missing Parameter Cơ sở
CWE-235: Improper Handling of Extra Parameters Cơ sở
CWE-248: Uncaught Exception Cơ sở
CWE-252: Unchecked Return Value Cơ sở
CWE-274: Improper Handling of Insufficient Privileges Cơ sở
CWE-280: Improper Handling of Insufficient Permissions or Privileges Cơ sở
CWE-369: Divide By Zero Cơ sở
CWE-390: Detection of Error Condition Without Action Cơ sở
CWE-391: DEPRECATED: Unchecked Error Condition Cơ sở
CWE-394: Unexpected Status Code or Return Value Cơ sở
CWE-396: Declaration of Catch for Generic Exception Cơ sở
CWE-397: Declaration of Throws for Generic Exception Cơ sở
CWE-460: Improper Cleanup on Thrown Exception Cơ sở
CWE-476: NULL Pointer Dereference Cơ sở
CWE-478: Missing Default Case in Multiple Condition Expression Cơ sở
CWE-484: Omitted Break Statement in Switch Cơ sở
CWE-550: Server-generated Error Message Containing Sensitive Information Cơ sở
CWE-636: Not Failing Securely Cơ sở
CWE-703: Improper Check or Handling of Exceptional Conditions Cơ sở
CWE-754: Improper Check for Unusual or Exceptional Conditions Cơ sở
CWE-755: Improper Handling of Exceptional Conditions Cơ sở
CWE-756: Missing Custom Error Page Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú

As of CWE 4.19, the relationships in this view were pulled directly from the CWE mappings cited in the 2025 OWASP Top Ten RC1. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

Đối tượng

Bên liên quan Mô tả
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2025 RC1), providing a good starting point for web application developers who want to code more securely.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten (2025 RC1), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

Gửi

Tên Tổ chức Ngày Ngày phát hành Version
CWE Content Team MITRE 2024-12-01 +00:00 2025-12-11 +00:00 4.19

Tài liệu tham khảo

REF-1500

OWASP Top 10:2025 RC1
https://owasp.org/Top10/2025/0x00_2025-Introduction/

Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.