Tên: CWE Cross-section

This view contains a selection of weaknesses that represent the variety of weaknesses that are captured in CWE, at a level of abstraction that is likely to be useful to most audiences. It can be used by researchers to determine how broad their theories, models, or tools are. It will also be used by the CWE content team in 2012 to focus quality improvement efforts for individual CWE entries.

Thành viên CWE

CWE-14: Compiler Removal of Code to Clear Buffers Cơ sở

CWE-22: Improper Limitation of a Pathname to a Restricted Directory Cơ sở

CWE-23: Relative Path Traversal Cơ sở

CWE-36: Absolute Path Traversal Cơ sở

CWE-41: Improper Resolution of Path Equivalence Cơ sở

CWE-59: Improper Link Resolution Before File Access Cơ sở

CWE-78: Improper Neutralization of Special Elements used in an OS Command Cơ sở

CWE-79: Improper Neutralization of Input During Web Page Generation Cơ sở

CWE-88: Improper Neutralization of Argument Delimiters in a Command Cơ sở

CWE-89: Improper Neutralization of Special Elements used in an SQL Command Cơ sở

CWE-90: Improper Neutralization of Special Elements used in an LDAP Query Cơ sở

CWE-94: Improper Control of Generation of Code Cơ sở

CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code Cơ sở

CWE-96: Improper Neutralization of Directives in Statically Saved Code Cơ sở

CWE-99: Improper Control of Resource Identifiers Cơ sở

CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers Cơ sở

CWE-117: Improper Output Neutralization for Logs Cơ sở

CWE-120: Buffer Copy without Checking Size of Input Cơ sở

CWE-129: Improper Validation of Array Index Cơ sở

CWE-131: Incorrect Calculation of Buffer Size Cơ sở

CWE-134: Use of Externally-Controlled Format String Cơ sở

CWE-135: Incorrect Calculation of Multi-Byte String Length Cơ sở

CWE-170: Improper Null Termination Cơ sở

CWE-173: Improper Handling of Alternate Encoding Cơ sở

CWE-174: Double Decoding of the Same Data Cơ sở

CWE-175: Improper Handling of Mixed Encoding Cơ sở

CWE-179: Incorrect Behavior Order: Early Validation Cơ sở

CWE-185: Incorrect Regular Expression Cơ sở

CWE-190: Integer Overflow or Wraparound Cơ sở

CWE-191: Integer Underflow (Wrap or Wraparound) Cơ sở

CWE-193: Off-by-one Error Cơ sở

CWE-203: Observable Discrepancy Cơ sở

CWE-209: Generation of Error Message Containing Sensitive Information Cơ sở

CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer Cơ sở

CWE-222: Truncation of Security-relevant Information Cơ sở

CWE-223: Omission of Security-relevant Information Cơ sở

CWE-228: Improper Handling of Syntactically Invalid Structure Cơ sở

CWE-244: Improper Clearing of Heap Memory Before Release Cơ sở

CWE-248: Uncaught Exception Cơ sở

CWE-250: Execution with Unnecessary Privileges Cơ sở

CWE-252: Unchecked Return Value Cơ sở

CWE-253: Incorrect Check of Function Return Value Cơ sở

CWE-262: Not Using Password Aging Cơ sở

CWE-263: Password Aging with Long Expiration Cơ sở

CWE-266: Incorrect Privilege Assignment Cơ sở

CWE-267: Privilege Defined With Unsafe Actions Cơ sở

CWE-268: Privilege Chaining Cơ sở

CWE-270: Privilege Context Switching Error Cơ sở

CWE-271: Privilege Dropping / Lowering Errors Cơ sở

CWE-273: Improper Check for Dropped Privileges Cơ sở

CWE-283: Unverified Ownership Cơ sở

CWE-290: Authentication Bypass by Spoofing Cơ sở

CWE-294: Authentication Bypass by Capture-replay Cơ sở

CWE-296: Improper Following of a Certificate's Chain of Trust Cơ sở

CWE-299: Improper Check for Certificate Revocation Cơ sở

CWE-300: Channel Accessible by Non-Endpoint Cơ sở

CWE-301: Reflection Attack in an Authentication Protocol Cơ sở

CWE-304: Missing Critical Step in Authentication Cơ sở

CWE-306: Missing Authentication for Critical Functionality Cơ sở

CWE-307: Improper Restriction of Excessive Authentication Attempts Cơ sở

CWE-308: Use of Single-factor Authentication Cơ sở

CWE-312: Cleartext Storage of Sensitive Information Cơ sở

CWE-319: Cleartext Transmission of Sensitive Information Cơ sở

CWE-322: Key Exchange without Entity Authentication Cơ sở

CWE-323: Reusing a Nonce, Key Pair in Encryption Cơ sở

CWE-325: Missing Cryptographic Step Cơ sở

CWE-327: Use of a Broken or Risky Cryptographic Algorithm Cơ sở

CWE-331: Insufficient Entropy Cơ sở

CWE-334: Small Space of Random Values Cơ sở

CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) Cơ sở

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) Cơ sở

CWE-341: Predictable from Observable State Cơ sở

CWE-347: Improper Verification of Cryptographic Signature Cơ sở

CWE-348: Use of Less Trusted Source Cơ sở

CWE-349: Acceptance of Extraneous Untrusted Data With Trusted Data Cơ sở

CWE-352: Cross-Site Request Forgery Cơ sở

CWE-353: Missing Support for Integrity Check Cơ sở

CWE-354: Improper Validation of Integrity Check Value Cơ sở

CWE-364: Signal Handler Race Condition Cơ sở

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition Cơ sở

CWE-369: Divide By Zero Cơ sở

CWE-390: Detection of Error Condition Without Action Cơ sở

CWE-392: Missing Report of Error Condition Cơ sở

CWE-393: Return of Wrong Status Code Cơ sở

CWE-400: Uncontrolled Resource Consumption Cơ sở

CWE-406: Insufficient Control of Network Message Volume (Network Amplification) Cơ sở

CWE-407: Inefficient Algorithmic Complexity Cơ sở

CWE-408: Incorrect Behavior Order: Early Amplification Cơ sở

CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) Cơ sở

CWE-434: Unrestricted Upload of File with Dangerous Type Cơ sở

CWE-444: Inconsistent Interpretation of HTTP Requests Cơ sở

CWE-451: User Interface (UI) Misrepresentation of Critical Information Cơ sở

CWE-453: Insecure Default Variable Initialization Cơ sở

CWE-454: External Initialization of Trusted Variables or Data Stores Cơ sở

CWE-455: Non-exit on Failed Initialization Cơ sở

CWE-456: Missing Initialization of a Variable Cơ sở

CWE-467: Use of sizeof() on a Pointer Type Cơ sở

CWE-468: Incorrect Pointer Scaling Cơ sở

CWE-469: Use of Pointer Subtraction to Determine Size Cơ sở

CWE-470: Use of Externally-Controlled Input to Select Classes or Code Cơ sở

CWE-476: NULL Pointer Dereference Cơ sở

CWE-478: Missing Default Case in Multiple Condition Expression Cơ sở

CWE-480: Use of Incorrect Operator Cơ sở

CWE-483: Incorrect Block Delimitation Cơ sở

CWE-484: Omitted Break Statement in Switch Cơ sở

CWE-486: Comparison of Classes by Name Cơ sở

CWE-494: Download of Code Without Integrity Check Cơ sở

CWE-495: Private Data Structure Returned From A Public Method Cơ sở

CWE-496: Public Data Assigned to Private Array-Typed Field Cơ sở

CWE-498: Cloneable Class Containing Sensitive Information Cơ sở

CWE-499: Serializable Class Containing Sensitive Data Cơ sở

CWE-502: Deserialization of Untrusted Data Cơ sở

CWE-521: Weak Password Requirements Cơ sở

CWE-522: Insufficiently Protected Credentials Cơ sở

CWE-546: Suspicious Comment Cơ sở

CWE-547: Use of Hard-coded, Security-relevant Constants Cơ sở

CWE-561: Dead Code Cơ sở

CWE-563: Assignment to Variable without Use Cơ sở

CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context Cơ sở

CWE-587: Assignment of a Fixed Address to a Pointer Cơ sở

CWE-595: Comparison of Object References Instead of Object Contents Cơ sở

CWE-601: URL Redirection to Untrusted Site Cơ sở

CWE-602: Client-Side Enforcement of Server-Side Security Cơ sở

CWE-605: Multiple Binds to the Same Port Cơ sở

CWE-617: Reachable Assertion Cơ sở

CWE-621: Variable Extraction Error Cơ sở

CWE-627: Dynamic Variable Evaluation Cơ sở

CWE-628: Function Call with Incorrectly Specified Arguments Cơ sở

CWE-642: External Control of Critical State Data Cơ sở

CWE-648: Incorrect Use of Privileged APIs Cơ sở

CWE-667: Improper Locking Cơ sở

CWE-672: Operation on a Resource after Expiration or Release Cơ sở

CWE-674: Uncontrolled Recursion Cơ sở

CWE-676: Use of Potentially Dangerous Function Cơ sở

CWE-681: Incorrect Conversion between Numeric Types Cơ sở

CWE-698: Execution After Redirect (EAR) Cơ sở

CWE-708: Incorrect Ownership Assignment Cơ sở

CWE-732: Incorrect Permission Assignment for Critical Resource Cơ sở

CWE-756: Missing Custom Error Page Cơ sở

CWE-763: Release of Invalid Pointer or Reference Cơ sở

CWE-770: Allocation of Resources Without Limits or Throttling Cơ sở

CWE-772: Missing Release of Resource after Effective Lifetime Cơ sở

CWE-783: Operator Precedence Logic Error Cơ sở

CWE-786: Access of Memory Location Before Start of Buffer Cơ sở

CWE-788: Access of Memory Location After End of Buffer Cơ sở

CWE-798: Use of Hard-coded Credentials Cơ sở

CWE-805: Buffer Access with Incorrect Length Value Cơ sở

CWE-807: Reliance on Untrusted Inputs in a Security Decision Cơ sở

CWE-822: Untrusted Pointer Dereference Cơ sở

CWE-825: Expired Pointer Dereference Cơ sở

CWE-829: Inclusion of Functionality from Untrusted Control Sphere Cơ sở

CWE-835: Loop with Unreachable Exit Condition Cơ sở

CWE-838: Inappropriate Encoding for Output Context Cơ sở

CWE-839: Numeric Range Comparison Without Minimum Check Cơ sở

CWE-841: Improper Enforcement of Behavioral Workflow Cơ sở

CWE-862: Missing Authorization Cơ sở

CWE-863: Incorrect Authorization Cơ sở

Thông tin chế độ xem CWE

Ghi chú ánh xạ lỗ hổng

Lý do : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
Bình luận : Use this View or other Views to search and navigate for the appropriate weakness.

Gửi

Tên	Tổ chức	Ngày	Ngày phát hành	Version
CWE Content Team	MITRE	2011-12-15 +00:00	2012-05-14 +00:00	2.2

Sửa đổi

Tên	Tổ chức	Ngày	Bình luận
CWE Content Team	MITRE	2017-05-03 +00:00	updated Relationships
CWE Content Team	MITRE	2023-06-29 +00:00	updated Mapping_Notes

Chi tiết chế độ xem CWE-884

CWE-884