简体中文

CWE-1344 视图详情

CWE-1344

Weaknesses in OWASP Top Ten (2021)
2021-10-05 +00:00
Incomplete
Graph
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: Weaknesses in OWASP Top Ten (2021)

CWE entries in this view (graph) are associated with the OWASP Top Ten, as released in 2021.

CWE 成员

CWE-1345: Weaknesses in this category are related to the A01 category "Broken Access Control" in the OWASP Top Ten 2021.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基础
CWE-23: Relative Path Traversal 基础
CWE-35: Path Traversal: '.../...//' 基础
CWE-59: Improper Link Resolution Before File Access 基础
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor 基础
CWE-201: Insertion of Sensitive Information Into Sent Data 基础
CWE-219: Storage of File with Sensitive Data Under Web Root 基础
CWE-264: Permissions, Privileges, and Access Controls 类别
CWE-275: Permission Issues 类别
CWE-276: Incorrect Default Permissions 基础
CWE-284: Improper Access Control 基础
CWE-285: Improper Authorization 基础
CWE-352: Cross-Site Request Forgery 基础
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 基础
CWE-377: DEPRECATED: Insecure Temporary File 基础
CWE-402: Transmission of Private Resources into a New Sphere 基础
CWE-425: Direct Request 基础
CWE-441: Unintended Proxy or Intermediary 基础
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere 基础
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 基础
CWE-540: Inclusion of Sensitive Information in Source Code 基础
CWE-548: Exposure of Information Through Directory Listing 基础
CWE-552: Files or Directories Accessible to External Parties 基础
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 基础
CWE-601: URL Redirection to Untrusted Site 基础
CWE-639: Authorization Bypass Through User-Controlled Key 基础
CWE-651: Exposure of WSDL File Containing Sensitive Information 基础
CWE-668: Exposure of Resource to Wrong Sphere 基础
CWE-706: Use of Incorrectly-Resolved Name or Reference 基础
CWE-862: Missing Authorization 基础
CWE-863: Incorrect Authorization 基础
CWE-913: Improper Control of Dynamically-Managed Code Resources 基础
CWE-922: Insecure Storage of Sensitive Information 基础
CWE-1275: Sensitive Cookie with Improper SameSite Attribute 基础
CWE-1346: Weaknesses in this category are related to the A02 category "Cryptographic Failures" in the OWASP Top Ten 2021.
CWE-261: Weak Encoding for Password 基础
CWE-296: Improper Following of a Certificate's Chain of Trust 基础
CWE-310: Cryptographic Issues 类别
CWE-319: Cleartext Transmission of Sensitive Information 基础
CWE-321: Use of Hard-coded Cryptographic Key 基础
CWE-322: Key Exchange without Entity Authentication 基础
CWE-323: Reusing a Nonce, Key Pair in Encryption 基础
CWE-324: Use of a Key Past its Expiration Date 基础
CWE-325: Missing Cryptographic Step 基础
CWE-326: Inadequate Encryption Strength 基础
CWE-327: Use of a Broken or Risky Cryptographic Algorithm 基础
CWE-328: Use of Weak Hash 基础
CWE-329: Generation of Predictable IV with CBC Mode 基础
CWE-330: Use of Insufficiently Random Values 基础
CWE-331: Insufficient Entropy 基础
CWE-335: Incorrect Usage of Seeds in Pseudo-Random Number Generator (PRNG) 基础
CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG) 基础
CWE-337: Predictable Seed in Pseudo-Random Number Generator (PRNG) 基础
CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) 基础
CWE-340: Generation of Predictable Numbers or Identifiers 基础
CWE-347: Improper Verification of Cryptographic Signature 基础
CWE-523: Unprotected Transport of Credentials 基础
CWE-720: OWASP Top Ten 2007 Category A9 - Insecure Communications 类别
CWE-757: Selection of Less-Secure Algorithm During Negotiation 基础
CWE-759: Use of a One-Way Hash without a Salt 基础
CWE-760: Use of a One-Way Hash with a Predictable Salt 基础
CWE-780: Use of RSA Algorithm without OAEP 基础
CWE-818: OWASP Top Ten 2010 Category A9 - Insufficient Transport Layer Protection 类别
CWE-916: Use of Password Hash With Insufficient Computational Effort 基础
CWE-1347: Weaknesses in this category are related to the A03 category "Injection" in the OWASP Top Ten 2021.
CWE-20: Improper Input Validation 基础
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 基础
CWE-75: Failure to Sanitize Special Elements into a Different Plane 基础
CWE-77: Improper Neutralization of Special Elements used in a Command 基础
CWE-78: Improper Neutralization of Special Elements used in an OS Command 基础
CWE-79: Improper Neutralization of Input During Web Page Generation 基础
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page 基础
CWE-83: Improper Neutralization of Script in Attributes in a Web Page 基础
CWE-87: Improper Neutralization of Alternate XSS Syntax 基础
CWE-88: Improper Neutralization of Argument Delimiters in a Command 基础
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基础
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基础
CWE-91: XML Injection 基础
CWE-93: Improper Neutralization of CRLF Sequences 基础
CWE-94: Improper Control of Generation of Code 基础
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基础
CWE-96: Improper Neutralization of Directives in Statically Saved Code 基础
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 基础
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 基础
CWE-99: Improper Control of Resource Identifiers 基础
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 基础
CWE-116: Improper Encoding or Escaping of Output 基础
CWE-138: Improper Neutralization of Special Elements 基础
CWE-184: Incomplete List of Disallowed Inputs 基础
CWE-470: Use of Externally-Controlled Input to Select Classes or Code 基础
CWE-471: Modification of Assumed-Immutable Data (MAID) 基础
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input 基础
CWE-610: Externally Controlled Reference to a Resource in Another Sphere 基础
CWE-643: Improper Neutralization of Data within XPath Expressions 基础
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax 基础
CWE-652: Improper Neutralization of Data within XQuery Expressions 基础
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement 基础
CWE-1348: Weaknesses in this category are related to the A04 "Insecure Design" category in the OWASP Top Ten 2021.
CWE-73: External Control of File Name or Path 基础
CWE-183: Permissive List of Allowed Inputs 基础
CWE-209: Generation of Error Message Containing Sensitive Information 基础
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies 基础
CWE-235: Improper Handling of Extra Parameters 基础
CWE-256: Plaintext Storage of a Password 基础
CWE-257: Storing Passwords in a Recoverable Format 基础
CWE-266: Incorrect Privilege Assignment 基础
CWE-269: Improper Privilege Management 基础
CWE-280: Improper Handling of Insufficient Permissions or Privileges 基础
CWE-311: Missing Encryption of Sensitive Data 基础
CWE-312: Cleartext Storage of Sensitive Information 基础
CWE-313: Cleartext Storage in a File or on Disk 基础
CWE-316: Cleartext Storage of Sensitive Information in Memory 基础
CWE-419: Unprotected Primary Channel 基础
CWE-430: Deployment of Wrong Handler 基础
CWE-434: Unrestricted Upload of File with Dangerous Type 基础
CWE-444: Inconsistent Interpretation of HTTP Requests 基础
CWE-451: User Interface (UI) Misrepresentation of Critical Information 基础
CWE-472: External Control of Assumed-Immutable Web Parameter 基础
CWE-501: Trust Boundary Violation 基础
CWE-522: Insufficiently Protected Credentials 基础
CWE-525: Use of Web Browser Cache Containing Sensitive Information 基础
CWE-539: Use of Persistent Cookies Containing Sensitive Information 基础
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session 基础
CWE-598: Use of HTTP Request With Sensitive Query String 基础
CWE-602: Client-Side Enforcement of Server-Side Security 基础
CWE-642: External Control of Critical State Data 基础
CWE-646: Reliance on File Name or Extension of Externally-Supplied File 基础
CWE-650: Trusting HTTP Permission Methods on the Server Side 基础
CWE-653: Improper Isolation or Compartmentalization 基础
CWE-656: Reliance on Security Through Obscurity 基础
CWE-657: Violation of Secure Design Principles 基础
CWE-799: Improper Control of Interaction Frequency 基础
CWE-807: Reliance on Untrusted Inputs in a Security Decision 基础
CWE-840: Business Logic Errors 类别
CWE-841: Improper Enforcement of Behavioral Workflow 基础
CWE-927: Use of Implicit Intent for Sensitive Communication 基础
CWE-1021: Improper Restriction of Rendered UI Layers or Frames 基础
CWE-1173: Improper Use of Validation Framework 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

备注

As of CWE 4.6, the relationships in this view were pulled directly from the CWE mappings cited in the 2021 OWASP Top Ten. These mappings include categories and high-level weaknesses. One mapping to a deprecated entry was removed. The CWE Program will work with OWASP to improve these mappings, possibly requiring modifications to CWE itself.

目标受众

利益相关方 描述
Software Developers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing a good starting point for web application developers who want to code more securely.
Product Customers This view outlines the most important issues as identified by the OWASP Top Ten (2021 version), providing product customers with a way of asking their software development teams to follow minimum expectations for secure code.
Educators Since the OWASP Top Ten covers the most frequently encountered issues, this view can be used by educators as training material for students.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2021-10-05 +00:00 2021-10-28 +00:00 4.6

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes

参考资料

REF-1206

OWASP Top 10:2021
https://owasp.org/Top10/

cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。