简体中文

CWE-1305 视图详情

CWE-1305

CISQ Quality Measures (2020)
2020-08-18 +00:00
Incomplete
Graph
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: CISQ Quality Measures (2020)

This view outlines the most important software quality issues as identified by the Consortium for Information & Software Quality (CISQ) Automated Quality Characteristic Measures, released in 2020. These measures are derived from Object Management Group (OMG) standards.

CWE 成员

CWE-1306: Weaknesses in this category are related to the CISQ Quality Measures for Reliability. Presence of these weaknesses could reduce the reliability of the software.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基础
CWE-170: Improper Null Termination 基础
CWE-252: Unchecked Return Value 基础
CWE-390: Detection of Error Condition Without Action 基础
CWE-394: Unexpected Status Code or Return Value 基础
CWE-404: Improper Resource Shutdown or Release 基础
CWE-424: Improper Protection of Alternate Path 基础
CWE-459: Incomplete Cleanup 基础
CWE-476: NULL Pointer Dereference 基础
CWE-480: Use of Incorrect Operator 基础
CWE-484: Omitted Break Statement in Switch 基础
CWE-562: Return of Stack Variable Address 基础
CWE-595: Comparison of Object References Instead of Object Contents 基础
CWE-662: Improper Synchronization 基础
CWE-665: Improper Initialization 基础
CWE-672: Operation on a Resource after Expiration or Release 基础
CWE-681: Incorrect Conversion between Numeric Types 基础
CWE-682: Incorrect Calculation 基础
CWE-703: Improper Check or Handling of Exceptional Conditions 基础
CWE-704: Incorrect Type Conversion or Cast 基础
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior 基础
CWE-835: Loop with Unreachable Exit Condition 基础
CWE-908: Use of Uninitialized Resource 基础
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor 基础
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data 基础
CWE-1066: Missing Serialization Control Element 基础
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements 基础
CWE-1077: Floating Point Comparison with Incorrect Operator 基础
CWE-1079: Parent Class without Virtual Destructor Method 基础
CWE-1082: Class Instance Self Destruction Control Element 基础
CWE-1083: Data Access from Outside Expected Data Manager Component 基础
CWE-1087: Class with Virtual Method without a Virtual Destructor 基础
CWE-1088: Synchronous Access of Remote Resource without Timeout 基础
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element 基础
CWE-1307: Weaknesses in this category are related to the CISQ Quality Measures for Maintainability. Presence of these weaknesses could reduce the maintainability of the software.
CWE-407: Inefficient Algorithmic Complexity 基础
CWE-478: Missing Default Case in Multiple Condition Expression 基础
CWE-480: Use of Incorrect Operator 基础
CWE-484: Omitted Break Statement in Switch 基础
CWE-561: Dead Code 基础
CWE-570: Expression is Always False 基础
CWE-571: Expression is Always True 基础
CWE-783: Operator Precedence Logic Error 基础
CWE-1041: Use of Redundant Code 基础
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor 基础
CWE-1047: Modules with Circular Dependencies 基础
CWE-1048: Invokable Control Element with Large Number of Outward Calls 基础
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data 基础
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization 基础
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer 基础
CWE-1055: Multiple Inheritance from Concrete Classes 基础
CWE-1062: Parent Class with References to Child Class 基础
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters 基础
CWE-1074: Class with Excessively Deep Inheritance 基础
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block 基础
CWE-1079: Parent Class without Virtual Destructor Method 基础
CWE-1080: Source Code File with Excessive Number of Lines of Code 基础
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations 基础
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code 基础
CWE-1086: Class with Excessive Number of Child Classes 基础
CWE-1087: Class with Virtual Method without a Virtual Destructor 基础
CWE-1090: Method Containing Access of a Member Element from Another Class 基础
CWE-1095: Loop Condition Value Update within the Loop 基础
CWE-1308: Weaknesses in this category are related to the CISQ Quality Measures for Security. Presence of these weaknesses could reduce the security of the software.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基础
CWE-77: Improper Neutralization of Special Elements used in a Command 基础
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基础
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基础
CWE-91: XML Injection 基础
CWE-99: Improper Control of Resource Identifiers 基础
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基础
CWE-129: Improper Validation of Array Index 基础
CWE-134: Use of Externally-Controlled Format String 基础
CWE-252: Unchecked Return Value 基础
CWE-404: Improper Resource Shutdown or Release 基础
CWE-424: Improper Protection of Alternate Path 基础
CWE-434: Unrestricted Upload of File with Dangerous Type 基础
CWE-477: Use of Obsolete Function 基础
CWE-480: Use of Incorrect Operator 基础
CWE-502: Deserialization of Untrusted Data 基础
CWE-570: Expression is Always False 基础
CWE-571: Expression is Always True 基础
CWE-606: Unchecked Input for Loop Condition 基础
CWE-611: Improper Restriction of XML External Entity Reference 基础
CWE-643: Improper Neutralization of Data within XPath Expressions 基础
CWE-652: Improper Neutralization of Data within XQuery Expressions 基础
CWE-662: Improper Synchronization 基础
CWE-665: Improper Initialization 基础
CWE-672: Operation on a Resource after Expiration or Release 基础
CWE-681: Incorrect Conversion between Numeric Types 基础
CWE-682: Incorrect Calculation 基础
CWE-732: Incorrect Permission Assignment for Critical Resource 基础
CWE-778: Insufficient Logging 基础
CWE-783: Operator Precedence Logic Error 基础
CWE-789: Memory Allocation with Excessive Size Value 基础
CWE-79: Improper Neutralization of Input During Web Page Generation 基础
CWE-798: Use of Hard-coded Credentials 基础
CWE-835: Loop with Unreachable Exit Condition 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

目标受众

利益相关方 描述
Software Developers This view provides a good starting point for anyone involved in software development (including architects, designers, coders, and testers) to ensure that code quality issues are considered during the development process.
Product Vendors This view can help product vendors understand code quality issues and convey an overall status of their software.
Assessment Tool Vendors This view provides a good starting point for assessment tool vendors (e.g., vendors selling static analysis tools) who wish to understand what constitutes software with good code quality, and which quality issues may be of concern.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2020-08-18 +00:00 2020-08-20 +00:00 4.2

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

参考资料

REF-1133

Automated Source Code Quality Measures
Consortium for Information & Software Quality (CISQ).
https://www.omg.org/spec/ASCQM/

cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。