Tên: Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011)

CWE entries in this view (graph) are fully or partially eliminated by following the guidance presented in the book "The CERT Oracle Secure Coding Standard for Java" published in 2011. This view is considered obsolete as a newer version of the coding standard is available.

Thành viên CWE

CWE-845: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS) Danh mục

CWE-845: Weaknesses in this category are related to rules in the Input Validation and Data Sanitization (IDS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-116: Improper Encoding or Escaping of Output Cơ sở

CWE-134: Use of Externally-Controlled Format String Cơ sở

CWE-144: Improper Neutralization of Line Delimiters Cơ sở

CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences Cơ sở

CWE-180: Incorrect Behavior Order: Validate Before Canonicalize Cơ sở

CWE-182: Collapse of Data into Unsafe Value Cơ sở

CWE-289: Authentication Bypass by Alternate Name Cơ sở

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) Cơ sở

CWE-625: Permissive Regular Expression Cơ sở

CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions Cơ sở

CWE-78: Improper Neutralization of Special Elements used in an OS Command Cơ sở

CWE-838: Inappropriate Encoding for Output Context Cơ sở

CWE-846: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL) Danh mục

CWE-846: Weaknesses in this category are related to rules in the Declarations and Initialization (DCL) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-665: Improper Initialization Cơ sở

CWE-847: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP) Danh mục

CWE-847: Weaknesses in this category are related to rules in the Expressions (EXP) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-252: Unchecked Return Value Cơ sở

CWE-479: Signal Handler Use of a Non-reentrant Function Cơ sở

CWE-595: Comparison of Object References Instead of Object Contents Cơ sở

CWE-597: Use of Wrong Operator in String Comparison Cơ sở

CWE-848: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM) Danh mục

CWE-848: Weaknesses in this category are related to rules in the Numeric Types and Operations (NUM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-197: Numeric Truncation Error Cơ sở

CWE-369: Divide By Zero Cơ sở

CWE-681: Incorrect Conversion between Numeric Types Cơ sở

CWE-849: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ) Danh mục

CWE-849: Weaknesses in this category are related to rules in the Object Orientation (OBJ) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-374: Passing Mutable Objects to an Untrusted Method Cơ sở

CWE-375: Returning a Mutable Object to an Untrusted Caller Cơ sở

CWE-486: Comparison of Classes by Name Cơ sở

CWE-491: Public cloneable() Method Without Final Cơ sở

CWE-492: Use of Inner Class Containing Sensitive Data Cơ sở

CWE-493: Critical Public Variable Without Final Modifier Cơ sở

CWE-498: Cloneable Class Containing Sensitive Information Cơ sở

CWE-500: Public Static Field Not Marked Final Cơ sở

CWE-582: Array Declared Public, Final, and Static Cơ sở

CWE-766: Critical Data Element Declared Public Cơ sở

CWE-850: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET) Danh mục

CWE-850: Weaknesses in this category are related to rules in the Methods (MET) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-487: Reliance on Package-level Scope Cơ sở

CWE-568: finalize() Method Without super.finalize() Cơ sở

CWE-573: Improper Following of Specification by Caller Cơ sở

CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined Cơ sở

CWE-583: finalize() Method Declared Public Cơ sở

CWE-586: Explicit Call to Finalize() Cơ sở

CWE-589: Call to Non-ubiquitous API Cơ sở

CWE-617: Reachable Assertion Cơ sở

CWE-851: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR) Danh mục

CWE-851: Weaknesses in this category are related to rules in the Exceptional Behavior (ERR) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-209: Generation of Error Message Containing Sensitive Information Cơ sở

CWE-230: Improper Handling of Missing Values Cơ sở

CWE-232: Improper Handling of Undefined Values Cơ sở

CWE-248: Uncaught Exception Cơ sở

CWE-382: J2EE Bad Practices: Use of System.exit() Cơ sở

CWE-390: Detection of Error Condition Without Action Cơ sở

CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference Cơ sở

CWE-397: Declaration of Throws for Generic Exception Cơ sở

CWE-460: Improper Cleanup on Thrown Exception Cơ sở

CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere Cơ sở

CWE-584: Return Inside Finally Block Cơ sở

CWE-600: Uncaught Exception in Servlet Cơ sở

CWE-690: Unchecked Return Value to NULL Pointer Dereference Cơ sở

CWE-703: Improper Check or Handling of Exceptional Conditions Cơ sở

CWE-705: Incorrect Control Flow Scoping Cơ sở

CWE-852: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA) Danh mục

CWE-852: Weaknesses in this category are related to rules in the Visibility and Atomicity (VNA) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization Cơ sở

CWE-366: Race Condition within a Thread Cơ sở

CWE-413: Improper Resource Locking Cơ sở

CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context Cơ sở

CWE-662: Improper Synchronization Cơ sở

CWE-667: Improper Locking Cơ sở

CWE-853: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK) Danh mục

CWE-853: Weaknesses in this category are related to rules in the Locking (LCK) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-412: Unrestricted Externally Accessible Lock Cơ sở

CWE-413: Improper Resource Locking Cơ sở

CWE-609: Double-Checked Locking Cơ sở

CWE-667: Improper Locking Cơ sở

CWE-820: Missing Synchronization Cơ sở

CWE-833: Deadlock Cơ sở

CWE-854: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI) Danh mục

CWE-854: Weaknesses in this category are related to rules in the Thread APIs (THI) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-572: Call to Thread run() instead of start() Cơ sở

CWE-705: Incorrect Control Flow Scoping Cơ sở

CWE-855: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS) Danh mục

CWE-855: Weaknesses in this category are related to rules in the Thread Pools (TPS) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-392: Missing Report of Error Condition Cơ sở

CWE-405: Asymmetric Resource Consumption (Amplification) Cơ sở

CWE-410: Insufficient Resource Pool Cơ sở

CWE-856: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 13 - Thread-Safety Miscellaneous (TSM) Danh mục

CWE-856: Weaknesses in this category are related to rules in the Thread-Safety Miscellaneous (TSM) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-857: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO) Danh mục

CWE-857: Weaknesses in this category are related to rules in the Input Output (FIO) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-135: Incorrect Calculation of Multi-Byte String Length Cơ sở

CWE-198: Use of Incorrect Byte Ordering Cơ sở

CWE-276: Incorrect Default Permissions Cơ sở

CWE-279: Incorrect Execution-Assigned Permissions Cơ sở

CWE-359: Exposure of Private Personal Information to an Unauthorized Actor Cơ sở

CWE-377: DEPRECATED: Insecure Temporary File Cơ sở

CWE-404: Improper Resource Shutdown or Release Cơ sở

CWE-405: Asymmetric Resource Consumption (Amplification) Cơ sở

CWE-459: Incomplete Cleanup Cơ sở

CWE-532: Insertion of Sensitive Information into Log File Cơ sở

CWE-67: Improper Handling of Windows Device Names Cơ sở

CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở

CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở

CWE-858: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER) Danh mục

CWE-858: Weaknesses in this category are related to rules in the Serialization (SER) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-250: Execution with Unnecessary Privileges Cơ sở

CWE-319: Cleartext Transmission of Sensitive Information Cơ sở

CWE-400: Uncontrolled Resource Consumption Cơ sở

CWE-499: Serializable Class Containing Sensitive Data Cơ sở

CWE-502: Deserialization of Untrusted Data Cơ sở

CWE-589: Call to Non-ubiquitous API Cơ sở

CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở

CWE-859: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC) Danh mục

CWE-859: Weaknesses in this category are related to rules in the Platform Security (SEC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-111: Direct Use of Unsafe JNI Cơ sở

CWE-266: Incorrect Privilege Assignment Cơ sở

CWE-272: Least Privilege Violation Cơ sở

CWE-300: Channel Accessible by Non-Endpoint Cơ sở

CWE-302: Authentication Bypass by Assumed-Immutable Data Cơ sở

CWE-319: Cleartext Transmission of Sensitive Information Cơ sở

CWE-347: Improper Verification of Cryptographic Signature Cơ sở

CWE-470: Use of Externally-Controlled Input to Select Classes or Code Cơ sở

CWE-494: Download of Code Without Integrity Check Cơ sở

CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở

CWE-807: Reliance on Untrusted Inputs in a Security Decision Cơ sở

CWE-860: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV) Danh mục

CWE-860: Weaknesses in this category are related to rules in the Runtime Environment (ENV) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data Cơ sở

CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở

CWE-861: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC) Danh mục

CWE-861: Weaknesses in this category are related to rules in the Miscellaneous (MSC) chapter of The CERT Oracle Secure Coding Standard for Java (2011).

CWE-259: Use of Hard-coded Password Cơ sở

CWE-311: Missing Encryption of Sensitive Data Cơ sở

CWE-330: Use of Insufficiently Random Values Cơ sở

CWE-332: Insufficient Entropy in PRNG Cơ sở

CWE-333: Improper Handling of Insufficient Entropy in TRNG Cơ sở

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) Cơ sở

CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) Cơ sở

CWE-400: Uncontrolled Resource Consumption Cơ sở

CWE-401: Missing Release of Memory after Effective Lifetime Cơ sở

CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context Cơ sở

CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở

CWE-798: Use of Hard-coded Credentials Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Ghi chú

The relationships in this view were determined based on specific statements within the rules from the standard. Not all rules have direct relationships to individual weaknesses, although they likely have chaining relationships in specific circumstances.

Đối tượng

Bên liên quan	Mô tả
Software Developers	By following The CERT Oracle Secure Coding Standard for Java, developers will be able to fully or partially prevent the weaknesses that are identified in this view. In addition, developers can use a CWE coverage graph to determine which weaknesses are not directly addressed by the standard, which will help identify and resolve remaining gaps in training, tool acquisition, or other approaches for reducing weaknesses.
Product Customers	If a software developer claims to be following The CERT Oracle Secure Coding Standard for Java, then customers can search for the weaknesses in this view in order to formulate independent evidence of that claim.
Educators	Educators can use this view in multiple ways. For example, if there is a focus on teaching weaknesses, the educator could link them to the relevant Secure Coding Standard.

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
CWE Content Team	MITRE	2011-05-24 +00:00	2011-06-01 +00:00	1.13

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2019-01-03 +00:00	updated Description, Name, References, View_Audience
CWE Content Team	MITRE	2020-02-24 +00:00	updated View_Audience
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes

Tài liệu tham khảo

REF-813

The CERT Oracle Coding Standard for Java
Fred Long, Dhruv Mohindra, Robert C. Seacord, Dean F. Sutherland, David Svoboda.

Chi tiết chế độ xem CWE-844

CWE-844

Tên: Weaknesses Addressed by The CERT Oracle Secure Coding Standard for Java (2011)

Thành viên CWE

CWE-845: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 2 - Input Validation and Data Sanitization (IDS) Danh mục

CWE-846: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 3 - Declarations and Initialization (DCL) Danh mục

CWE-847: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 4 - Expressions (EXP) Danh mục

CWE-848: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 5 - Numeric Types and Operations (NUM) Danh mục

CWE-849: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 6 - Object Orientation (OBJ) Danh mục

CWE-850: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 7 - Methods (MET) Danh mục

CWE-851: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 8 - Exceptional Behavior (ERR) Danh mục

CWE-852: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 9 - Visibility and Atomicity (VNA) Danh mục

CWE-853: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 10 - Locking (LCK) Danh mục

CWE-854: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 11 - Thread APIs (THI) Danh mục

CWE-855: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 12 - Thread Pools (TPS) Danh mục

CWE-856: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 13 - Thread-Safety Miscellaneous (TSM) Danh mục

CWE-857: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 14 - Input Output (FIO) Danh mục

CWE-858: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 15 - Serialization (SER) Danh mục

CWE-859: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 16 - Platform Security (SEC) Danh mục

CWE-860: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 17 - Runtime Environment (ENV) Danh mục

CWE-861: The CERT Oracle Secure Coding Standard for Java (2011) Chapter 18 - Miscellaneous (MSC) Danh mục

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Ghi chú

Đối tượng

Gửi

Sửa đổi

Tài liệu tham khảo

REF-813