Chi tiết chế độ xem CWE-699

CWE-699

Software Development
2008-09-09 +00:00
Draft
Graph
2023-06-29 +00:00
CWE Mitre.org
Thông báo cho một CWE
Luôn được thông báo về mọi thay đổi đối với một CWE cụ thể.
Quản lý thông báo

Tên: Software Development

This view organizes weaknesses around concepts that are frequently used or encountered in software development. This includes all aspects of the software development lifecycle including both architecture and implementation. Accordingly, this view can align closely with the perspectives of architects, developers, educators, and assessment vendors. It provides a variety of categories that are intended to simplify navigation, browsing, and mapping.

Thành viên CWE

CWE-1006: Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.
CWE-358: Improperly Implemented Security Check for Standard Cơ sở
CWE-360: Trust of System Event Data Cơ sở
CWE-478: Missing Default Case in Multiple Condition Expression Cơ sở
CWE-487: Reliance on Package-level Scope Cơ sở
CWE-489: Active Debug Code Cơ sở
CWE-547: Use of Hard-coded, Security-relevant Constants Cơ sở
CWE-561: Dead Code Cơ sở
CWE-562: Return of Stack Variable Address Cơ sở
CWE-563: Assignment to Variable without Use Cơ sở
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined Cơ sở
CWE-586: Explicit Call to Finalize() Cơ sở
CWE-605: Multiple Binds to the Same Port Cơ sở
CWE-628: Function Call with Incorrectly Specified Arguments Cơ sở
CWE-654: Reliance on a Single Factor in a Security Decision Cơ sở
CWE-656: Reliance on Security Through Obscurity Cơ sở
CWE-694: Use of Multiple Resources with Duplicate Identifier Cơ sở
CWE-807: Reliance on Untrusted Inputs in a Security Decision Cơ sở
CWE-1041: Use of Redundant Code Cơ sở
CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements Cơ sở
CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range Cơ sở
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor Cơ sở
CWE-1046: Creation of Immutable Text Using String Concatenation Cơ sở
CWE-1048: Invokable Control Element with Large Number of Outward Calls Cơ sở
CWE-1049: Excessive Data Query Operations in a Large Data Table Cơ sở
CWE-1050: Excessive Platform Resource Consumption within a Loop Cơ sở
CWE-1063: Creation of Class Instance within a Static Code Block Cơ sở
CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers Cơ sở
CWE-1066: Missing Serialization Control Element Cơ sở
CWE-1067: Excessive Execution of Sequential Searches of Data Resource Cơ sở
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements Cơ sở
CWE-1071: Empty Code Block Cơ sở
CWE-1072: Data Resource Access without Use of Connection Pooling Cơ sở
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses Cơ sở
CWE-1079: Parent Class without Virtual Destructor Method Cơ sở
CWE-1082: Class Instance Self Destruction Control Element Cơ sở
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations Cơ sở
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code Cơ sở
CWE-1087: Class with Virtual Method without a Virtual Destructor Cơ sở
CWE-1089: Large Data Table with Excessive Number of Indices Cơ sở
CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers Cơ sở
CWE-1094: Excessive Index Range Scan for a Data Resource Cơ sở
CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element Cơ sở
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element Cơ sở
CWE-1099: Inconsistent Naming Conventions for Identifiers Cơ sở
CWE-1101: Reliance on Runtime Component in Generated Code Cơ sở
CWE-1102: Reliance on Machine-Dependent Data Representation Cơ sở
CWE-1103: Use of Platform-Dependent Third Party Components Cơ sở
CWE-1104: Use of Unmaintained Third Party Components Cơ sở
CWE-1106: Insufficient Use of Symbolic Constants Cơ sở
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions Cơ sở
CWE-1108: Excessive Reliance on Global Variables Cơ sở
CWE-1109: Use of Same Variable for Multiple Purposes Cơ sở
CWE-1113: Inappropriate Comment Style Cơ sở
CWE-1114: Inappropriate Whitespace Style Cơ sở
CWE-1115: Source Code Element without Standard Prologue Cơ sở
CWE-1116: Inaccurate Source Code Comments Cơ sở
CWE-1117: Callable with Insufficient Behavioral Summary Cơ sở
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope Cơ sở
CWE-1127: Compilation with Insufficient Warnings or Errors Cơ sở
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations Cơ sở
CWE-1215: Weaknesses in this category are related to a software system's components for input validation, output validation, or other kinds of validation. Validation is a frequently-used technique for ensuring that data conforms to expectations before it is further processed as input or output. There are many varieties of validation (see CWE-20, which is just for input validation). Validation is distinct from other techniques that attempt to modify data before processing it, although developers may consider all attempts to product "safe" inputs or outputs as some kind of validation. Regardless, validation is a powerful tool that is often used to minimize malformed data from entering the system, or indirectly avoid code injection or other potentially-malicious patterns when generating output. The weaknesses in this category could lead to a degradation of the quality of data flow in a system if they are not addressed.
CWE-112: Missing XML Validation Cơ sở
CWE-179: Incorrect Behavior Order: Early Validation Cơ sở
CWE-183: Permissive List of Allowed Inputs Cơ sở
CWE-184: Incomplete List of Disallowed Inputs Cơ sở
CWE-606: Unchecked Input for Loop Condition Cơ sở
CWE-641: Improper Restriction of Names for Files and Other Resources Cơ sở
CWE-1173: Improper Use of Validation Framework Cơ sở
CWE-1284: Improper Validation of Specified Quantity in Input Cơ sở
CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input Cơ sở
CWE-1286: Improper Validation of Syntactic Correctness of Input Cơ sở
CWE-1287: Improper Validation of Specified Type of Input Cơ sở
CWE-1288: Improper Validation of Consistency within Input Cơ sở
CWE-1289: Improper Validation of Unsafe Equivalence in Input Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú

The top level categories in this view represent commonly understood areas/terms within software development, and are meant to aid the user in identifying potential related weaknesses. It is possible for the same weakness to exist within multiple different categories.
This view attempts to present weaknesses in a simple and intuitive way. As such it targets a single level of abstraction. It is important to realize that not every CWE will be represented in this view. High-level class weaknesses and low-level variant weaknesses are mostly ignored. However, by exploring the weaknesses that are included, and following the defined relationships, one can find these higher and lower level weaknesses.

Đối tượng

Bên liên quan Mô tả
Software Developers Software developers (including architects, designers, coders, and testers) use this view to better understand potential mistakes that can be made in specific areas of their software application. The use of concepts that developers are familiar with makes it easier to navigate this view, and filtering by Modes of Introduction can enable focus on a specific phase of the development lifecycle.
Educators Educators use this view to teach future developers about the types of mistakes that are commonly made within specific parts of a codebase.

Gửi

Tên Tổ chức Ngày Ngày phát hành Version
CWE Content Team MITRE 2008-09-09 +00:00 2008-09-09 +00:00 1.0

Sửa đổi

Tên Tổ chức Ngày Bình luận
CWE Content Team MITRE 2017-01-19 +00:00 updated Maintenance_Notes, Relationships
CWE Content Team MITRE 2017-05-03 +00:00 updated Relationships
CWE Content Team MITRE 2017-11-08 +00:00 updated Maintenance_Notes, Relationships
CWE Content Team MITRE 2018-03-27 +00:00 updated Description, View_Audience
CWE Content Team MITRE 2020-02-24 +00:00 updated Description, Name, Other_Notes, Relationships, View_Audience
CWE Content Team MITRE 2020-08-20 +00:00 updated Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.