Chi tiết điểm yếu phần mềm CWE-700 | CVE Find

Nhà cung cấp và sản phẩm

CPE, viết tắt của Liệt kê nền tảng phổ biến, là một lược đồ đặt tên chuẩn hóa cho phần cứng, phần mềm và hệ điều hành. CPE cung cấp lược đồ đặt tên có cấu trúc để xác định và phân loại duy nhất các hệ thống công nghệ thông tin, nền tảng và gói phần mềm dựa trên các thuộc tính nhất định như nhà cung cấp, tên sản phẩm, phiên bản, cập nhật, phiên bản và ngôn ngữ.

Tên: Seven Pernicious Kingdoms

This view (graph) organizes weaknesses using a hierarchical structure that is similar to that used by Seven Pernicious Kingdoms.

Thành viên CWE

CWE-254: 7PK - Security Features Danh mục

CWE-254: Software security is not security software. Here we're concerned with topics like authentication, access control, confidentiality, cryptography, and privilege management.

CWE-256: Plaintext Storage of a Password Cơ sở

CWE-258: Empty Password in Configuration File Cơ sở

CWE-259: Use of Hard-coded Password Cơ sở

CWE-260: Password in Configuration File Cơ sở

CWE-261: Weak Encoding for Password Cơ sở

CWE-272: Least Privilege Violation Cơ sở

CWE-284: Improper Access Control Cơ sở

CWE-285: Improper Authorization Cơ sở

CWE-330: Use of Insufficiently Random Values Cơ sở

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Cơ sở

CWE-798: Use of Hard-coded Credentials Cơ sở

CWE-361: 7PK - Time and State Danh mục

CWE-361: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses related to the improper management of time and state in an environment that supports simultaneous or near-simultaneous computation by multiple systems, processes, or threads. According to the authors of the Seven Pernicious Kingdoms, "Distributed computation is about time and state. That is, in order for more than one component to communicate, state must be shared, and all that takes time. Most programmers anthropomorphize their work. They think about one thread of control carrying out the entire program in the same way they would if they had to do the job themselves. Modern computers, however, switch between tasks very quickly, and in multi-core, multi-CPU, or distributed systems, two events may take place at exactly the same time. Defects rush to fill the gap between the programmer's model of how a program executes and what happens in reality. These defects are related to unexpected interactions between threads, processes, time, and information. These interactions happen through shared state: semaphores, variables, the file system, and, basically, anything that can store information."

CWE-364: Signal Handler Race Condition Cơ sở

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition Cơ sở

CWE-377: DEPRECATED: Insecure Temporary File Cơ sở

CWE-382: J2EE Bad Practices: Use of System.exit() Cơ sở

CWE-383: J2EE Bad Practices: Direct Use of Threads Cơ sở

CWE-384: Session Fixation Cơ sở

CWE-412: Unrestricted Externally Accessible Lock Cơ sở

CWE-388: 7PK - Errors Danh mục

CWE-388: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when an application does not properly handle errors that occur during processing. According to the authors of the Seven Pernicious Kingdoms, "Errors and error handling represent a class of API. Errors related to error handling are so common that they deserve a special kingdom of their own. As with 'API Abuse,' there are two ways to introduce an error-related security vulnerability: the most common one is handling errors poorly (or not at all). The second is producing errors that either give out too much information (to possible attackers) or are difficult to handle."

CWE-391: DEPRECATED: Unchecked Error Condition Cơ sở

CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference Cơ sở

CWE-396: Declaration of Catch for Generic Exception Cơ sở

CWE-397: Declaration of Throws for Generic Exception Cơ sở

CWE-1005: 7PK - Input Validation and Representation Danh mục

CWE-1005: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that exist when an application does not properly validate or represent input. According to the authors of the Seven Pernicious Kingdoms, "Input validation and representation problems are caused by metacharacters, alternate encodings and numeric representations. Security problems result from trusting input."

CWE-20: Improper Input Validation Cơ sở

CWE-77: Improper Neutralization of Special Elements used in a Command Cơ sở

CWE-79: Improper Neutralization of Input During Web Page Generation Cơ sở

CWE-89: Improper Neutralization of Special Elements used in an SQL Command Cơ sở

CWE-99: Improper Control of Resource Identifiers Cơ sở

CWE-227: 7PK - API Abuse Danh mục

CWE-227: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that involve the software using an API in a manner contrary to its intended use. According to the authors of the Seven Pernicious Kingdoms, "An API is a contract between a caller and a callee. The most common forms of API misuse occurs when the caller does not honor its end of this contract. For example, if a program does not call chdir() after calling chroot(), it violates the contract that specifies how to change the active root directory in a secure fashion. Another good example of library abuse is expecting the callee to return trustworthy DNS information to the caller. In this case, the caller misuses the callee API by making certain assumptions about its behavior (that the return value can be used for authentication purposes). One can also violate the caller-callee contract from the other side. For example, if a coder subclasses SecureRandom and returns a non-random value, the contract is violated."

CWE-242: Use of Inherently Dangerous Function Cơ sở

CWE-243: Creation of chroot Jail Without Changing Working Directory Cơ sở

CWE-244: Improper Clearing of Heap Memory Before Release Cơ sở

CWE-245: J2EE Bad Practices: Direct Management of Connections Cơ sở

CWE-246: J2EE Bad Practices: Direct Use of Sockets Cơ sở

CWE-248: Uncaught Exception Cơ sở

CWE-250: Execution with Unnecessary Privileges Cơ sở

CWE-251: Often Misused: String Management Danh mục

CWE-252: Unchecked Return Value Cơ sở

CWE-558: Use of getlogin() in Multithreaded Application Cơ sở

CWE-398: 7PK - Code Quality Danh mục

CWE-398: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that do not directly introduce a weakness or vulnerability, but indicate that the product has not been carefully developed or maintained. According to the authors of the Seven Pernicious Kingdoms, "Poor code quality leads to unpredictable behavior. From a user's perspective that often manifests itself as poor usability. For an adversary it provides an opportunity to stress the system in unexpected ways."

CWE-401: Missing Release of Memory after Effective Lifetime Cơ sở

CWE-404: Improper Resource Shutdown or Release Cơ sở

CWE-415: Double Free Cơ sở

CWE-416: Use After Free Cơ sở

CWE-457: Use of Uninitialized Variable Cơ sở

CWE-474: Use of Function with Inconsistent Implementations Cơ sở

CWE-475: Undefined Behavior for Input to API Cơ sở

CWE-476: NULL Pointer Dereference Cơ sở

CWE-477: Use of Obsolete Function Cơ sở

CWE-485: 7PK - Encapsulation Danh mục

CWE-485: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that occur when the product does not sufficiently encapsulate critical data or functionality. According to the authors of the Seven Pernicious Kingdoms, "Encapsulation is about drawing strong boundaries. In a web browser that might mean ensuring that your mobile code cannot be abused by other mobile code. On the server it might mean differentiation between validated data and unvalidated data, between one user's data and another's, or between data users are allowed to see and data that they are not."

CWE-486: Comparison of Classes by Name Cơ sở

CWE-488: Exposure of Data Element to Wrong Session Cơ sở

CWE-489: Active Debug Code Cơ sở

CWE-491: Public cloneable() Method Without Final Cơ sở

CWE-492: Use of Inner Class Containing Sensitive Data Cơ sở

CWE-493: Critical Public Variable Without Final Modifier Cơ sở

CWE-495: Private Data Structure Returned From A Public Method Cơ sở

CWE-496: Public Data Assigned to Private Array-Typed Field Cơ sở

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Cơ sở

CWE-501: Trust Boundary Violation Cơ sở

CWE-2: 7PK - Environment Danh mục

CWE-2: This category represents one of the phyla in the Seven Pernicious Kingdoms vulnerability classification. It includes weaknesses that are typically introduced during unexpected environmental conditions. According to the authors of the Seven Pernicious Kingdoms, "This section includes everything that is outside of the source code but is still critical to the security of the product that is being created. Because the issues covered by this kingdom are not directly related to source code, we separated it from the rest of the kingdoms."

CWE-11: ASP.NET Misconfiguration: Creating Debug Binary Cơ sở

CWE-12: ASP.NET Misconfiguration: Missing Custom Error Page Cơ sở

CWE-13: ASP.NET Misconfiguration: Password in Configuration File Cơ sở

CWE-14: Compiler Removal of Code to Clear Buffers Cơ sở

CWE-5: J2EE Misconfiguration: Data Transmission Without Encryption Cơ sở

CWE-6: J2EE Misconfiguration: Insufficient Session-ID Length Cơ sở

CWE-7: J2EE Misconfiguration: Missing Custom Error Page Cơ sở

CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote Cơ sở

CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú

The MITRE CWE team frequently uses "7PK" as an abbreviation for Seven Pernicious Kingdoms.

Đối tượng

Bên liên quan	Mô tả
Software Developers	This view is useful for developers because it is organized around concepts with which developers are familiar, and it focuses on weaknesses that can be detected using source code analysis tools.

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
CWE Content Team	MITRE	2008-09-09 +00:00	2008-09-09 +00:00	1.0

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2017-05-03 +00:00	updated Relationships
CWE Content Team	MITRE	2017-11-08 +00:00	updated Alternate_Terms, Other_Notes
CWE Content Team	MITRE	2020-02-24 +00:00	updated References
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes
CWE Content Team	MITRE	2026-10-28 +00:00	updated References

Tài liệu tham khảo

REF-6

Seven Pernicious Kingdoms: A Taxonomy of Software Security Errors
Katrina Tsipenyuk, Brian Chess, Gary McGraw.
https://cwe.mitre.org/documents/sources/SevenPerniciousKingdoms.pdf

Thông tin trình bày trên CVE Find đến từ nhiều nguồn tham chiếu được chọn lọc cẩn thận. Dữ liệu CVE được cung cấp bởi MITRE Corporation và Cơ sở dữ liệu lỗ hổng quốc gia (NVD). Danh mục lỗ hổng đã bị khai thác đã biết (KEV) có nguồn từ Cơ quan An ninh mạng và Cơ sở hạ tầng (CISA), trong khi điểm EPSS đến từ FIRST.org. Ngoài ra, dữ liệu về điểm yếu phần mềm (CWE) và mẫu tấn công phổ biến (CAPEC) được duy trì bởi MITRE Corporation, và thông tin về cấu hình phần cứng và phần mềm (CPE) được cung cấp bởi NVD.