简体中文

CWE-1006 类别详情

CWE-1006

Bad Coding Practices
2017-11-08 +00:00
Draft
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: Bad Coding Practices

Weaknesses in this category are related to coding practices that are deemed unsafe and increase the chances that an exploitable vulnerability will be present in the application. These weaknesses do not directly introduce a vulnerability, but indicate that the product has not been carefully developed or maintained. If a program is complex, difficult to maintain, not portable, or shows evidence of neglect, then there is a higher likelihood that weaknesses are buried in the code.

CWE 成员列表

CWE-358: Improperly Implemented Security Check for Standard 基础

CWE-360: Trust of System Event Data 基础

CWE-478: Missing Default Case in Multiple Condition Expression 基础

CWE-487: Reliance on Package-level Scope 基础

CWE-489: Active Debug Code 基础

CWE-547: Use of Hard-coded, Security-relevant Constants 基础

CWE-561: Dead Code 基础

CWE-562: Return of Stack Variable Address 基础

CWE-563: Assignment to Variable without Use 基础

CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined 基础

CWE-586: Explicit Call to Finalize() 基础

CWE-605: Multiple Binds to the Same Port 基础

CWE-628: Function Call with Incorrectly Specified Arguments 基础

CWE-654: Reliance on a Single Factor in a Security Decision 基础

CWE-656: Reliance on Security Through Obscurity 基础

CWE-694: Use of Multiple Resources with Duplicate Identifier 基础

CWE-807: Reliance on Untrusted Inputs in a Security Decision 基础

CWE-1041: Use of Redundant Code 基础

CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements 基础

CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range 基础

CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor 基础

CWE-1046: Creation of Immutable Text Using String Concatenation 基础

CWE-1048: Invokable Control Element with Large Number of Outward Calls 基础

CWE-1049: Excessive Data Query Operations in a Large Data Table 基础

CWE-1050: Excessive Platform Resource Consumption within a Loop 基础

CWE-1063: Creation of Class Instance within a Static Code Block 基础

CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers 基础

CWE-1066: Missing Serialization Control Element 基础

CWE-1067: Excessive Execution of Sequential Searches of Data Resource 基础

CWE-1070: Serializable Data Element Containing non-Serializable Item Elements 基础

CWE-1071: Empty Code Block 基础

CWE-1072: Data Resource Access without Use of Connection Pooling 基础

CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses 基础

CWE-1079: Parent Class without Virtual Destructor Method 基础

CWE-1082: Class Instance Self Destruction Control Element 基础

CWE-1084: Invokable Control Element with Excessive File or Data Access Operations 基础

CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code 基础

CWE-1087: Class with Virtual Method without a Virtual Destructor 基础

CWE-1089: Large Data Table with Excessive Number of Indices 基础

CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers 基础

CWE-1094: Excessive Index Range Scan for a Data Resource 基础

CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element 基础

CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element 基础

CWE-1099: Inconsistent Naming Conventions for Identifiers 基础

CWE-1101: Reliance on Runtime Component in Generated Code 基础

CWE-1102: Reliance on Machine-Dependent Data Representation 基础

CWE-1103: Use of Platform-Dependent Third Party Components 基础

CWE-1104: Use of Unmaintained Third Party Components 基础

CWE-1106: Insufficient Use of Symbolic Constants 基础

CWE-1107: Insufficient Isolation of Symbolic Constant Definitions 基础

CWE-1108: Excessive Reliance on Global Variables 基础

CWE-1109: Use of Same Variable for Multiple Purposes 基础

CWE-1113: Inappropriate Comment Style 基础

CWE-1114: Inappropriate Whitespace Style 基础

CWE-1115: Source Code Element without Standard Prologue 基础

CWE-1116: Inaccurate Source Code Comments 基础

CWE-1117: Callable with Insufficient Behavioral Summary 基础

CWE-1126: Declaration of Variable with Unnecessarily Wide Scope 基础

CWE-1127: Compilation with Insufficient Warnings or Errors 基础

CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations 基础

CWE 信息

漏洞映射说明

依据 : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
备注 : See member weaknesses of this category.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2017-06-29 +00:00 2017-11-08 +00:00 2.12

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2019-01-03 +00:00 updated Relationships
CWE Content Team MITRE 2020-02-24 +00:00 updated Relationships
CWE Content Team MITRE 2023-04-27 +00:00 updated Mapping_Notes, Relationships
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。