简体中文

CWE-1400 视图详情

CWE-1400

Comprehensive Categorization for Software Assurance Trends
2023-04-25 +00:00
Draft
Graph
2023-06-29 +00:00
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: Comprehensive Categorization for Software Assurance Trends

CWE 成员

CWE-1396: Weaknesses in this category are related to access control.
CWE-9: J2EE Misconfiguration: Weak Access Permissions for EJB Methods 基础
CWE-13: ASP.NET Misconfiguration: Password in Configuration File 基础
CWE-202: Exposure of Sensitive Information Through Data Queries 基础
CWE-256: Plaintext Storage of a Password 基础
CWE-257: Storing Passwords in a Recoverable Format 基础
CWE-258: Empty Password in Configuration File 基础
CWE-259: Use of Hard-coded Password 基础
CWE-260: Password in Configuration File 基础
CWE-261: Weak Encoding for Password 基础
CWE-262: Not Using Password Aging 基础
CWE-263: Password Aging with Long Expiration 基础
CWE-266: Incorrect Privilege Assignment 基础
CWE-267: Privilege Defined With Unsafe Actions 基础
CWE-268: Privilege Chaining 基础
CWE-269: Improper Privilege Management 基础
CWE-270: Privilege Context Switching Error 基础
CWE-271: Privilege Dropping / Lowering Errors 基础
CWE-272: Least Privilege Violation 基础
CWE-273: Improper Check for Dropped Privileges 基础
CWE-274: Improper Handling of Insufficient Privileges 基础
CWE-276: Incorrect Default Permissions 基础
CWE-277: Insecure Inherited Permissions 基础
CWE-278: Insecure Preserved Inherited Permissions 基础
CWE-279: Incorrect Execution-Assigned Permissions 基础
CWE-280: Improper Handling of Insufficient Permissions or Privileges 基础
CWE-281: Improper Preservation of Permissions 基础
CWE-282: Improper Ownership Management 基础
CWE-283: Unverified Ownership 基础
CWE-284: Improper Access Control 基础
CWE-285: Improper Authorization 基础
CWE-286: Incorrect User Management 基础
CWE-287: Improper Authentication 基础
CWE-288: Authentication Bypass Using an Alternate Path or Channel 基础
CWE-289: Authentication Bypass by Alternate Name 基础
CWE-290: Authentication Bypass by Spoofing 基础
CWE-291: Reliance on IP Address for Authentication 基础
CWE-293: Using Referer Field for Authentication 基础
CWE-294: Authentication Bypass by Capture-replay 基础
CWE-295: Improper Certificate Validation 基础
CWE-296: Improper Following of a Certificate's Chain of Trust 基础
CWE-297: Improper Validation of Certificate with Host Mismatch 基础
CWE-298: Improper Validation of Certificate Expiration 基础
CWE-299: Improper Check for Certificate Revocation 基础
CWE-300: Channel Accessible by Non-Endpoint 基础
CWE-301: Reflection Attack in an Authentication Protocol 基础
CWE-302: Authentication Bypass by Assumed-Immutable Data 基础
CWE-303: Incorrect Implementation of Authentication Algorithm 基础
CWE-304: Missing Critical Step in Authentication 基础
CWE-305: Authentication Bypass by Primary Weakness 基础
CWE-306: Missing Authentication for Critical Functionality 基础
CWE-307: Improper Restriction of Excessive Authentication Attempts 基础
CWE-308: Use of Single-factor Authentication 基础
CWE-309: Use of Password System for Primary Authentication 基础
CWE-321: Use of Hard-coded Cryptographic Key 基础
CWE-322: Key Exchange without Entity Authentication 基础
CWE-350: Reliance on Reverse DNS Resolution for a Security-Critical Action 基础
CWE-370: Missing Check for Certificate Revocation after Initial Check 基础
CWE-384: Session Fixation 基础
CWE-419: Unprotected Primary Channel 基础
CWE-420: Unprotected Alternate Channel 基础
CWE-421: Race Condition During Access to Alternate Channel 基础
CWE-422: Unprotected Windows Messaging Channel 基础
CWE-425: Direct Request 基础
CWE-441: Unintended Proxy or Intermediary 基础
CWE-520: .NET Misconfiguration: Use of Impersonation 基础
CWE-521: Weak Password Requirements 基础
CWE-522: Insufficiently Protected Credentials 基础
CWE-523: Unprotected Transport of Credentials 基础
CWE-549: Missing Password Field Masking 基础
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization 基础
CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File 基础
CWE-556: ASP.NET Misconfiguration: Use of Identity Impersonation 基础
CWE-566: Authorization Bypass Through User-Controlled SQL Primary Key 基础
CWE-593: Authentication Bypass: OpenSSL CTX Object Modified after SSL Objects are Created 基础
CWE-599: Missing Validation of OpenSSL Certificate 基础
CWE-601: URL Redirection to Untrusted Site 基础
CWE-603: Use of Client-Side Authentication 基础
CWE-611: Improper Restriction of XML External Entity Reference 基础
CWE-612: Improper Authorization of Index Containing Sensitive Information 基础
CWE-613: DEPRECATED: Insufficient Session Expiration 基础
CWE-620: Unverified Password Change 基础
CWE-623: Unsafe ActiveX Control Marked Safe For Scripting 基础
CWE-639: Authorization Bypass Through User-Controlled Key 基础
CWE-640: Weak Password Recovery Mechanism for Forgotten Password 基础
CWE-645: Overly Restrictive Account Lockout Mechanism 基础
CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions 基础
CWE-648: Incorrect Use of Privileged APIs 基础
CWE-708: Incorrect Ownership Assignment 基础
CWE-732: Incorrect Permission Assignment for Critical Resource 基础
CWE-798: Use of Hard-coded Credentials 基础
CWE-804: Guessable CAPTCHA 基础
CWE-836: Use of Password Hash Instead of Password for Authentication 基础
CWE-842: Placement of User into Incorrect Group 基础
CWE-862: Missing Authorization 基础
CWE-863: Incorrect Authorization 基础
CWE-918: Server-Side Request Forgery 基础
CWE-921: Storage of Sensitive Data in a Mechanism without Access Control 基础
CWE-923: Improper Restriction of Communication Channel to Intended Endpoints 基础
CWE-925: Improper Verification of Intent by Broadcast Receiver 基础
CWE-926: Improper Export of Android Application Components 基础
CWE-927: Use of Implicit Intent for Sensitive Communication 基础
CWE-939: Improper Authorization in Handler for Custom URL Scheme 基础
CWE-940: Improper Verification of Source of a Communication Channel 基础
CWE-941: Incorrectly Specified Destination in a Communication Channel 基础
CWE-942: Permissive Cross-domain Security Policy with Untrusted Domains 基础
CWE-1004: Sensitive Cookie Without 'HttpOnly' Flag 基础
CWE-1021: Improper Restriction of Rendered UI Layers or Frames 基础
CWE-1022: Use of Web Link to Untrusted Target with window.opener Access 基础
CWE-1191: On-Chip Debug and Test Interface With Improper Access Control 基础
CWE-1220: Insufficient Granularity of Access Control 基础
CWE-1222: Insufficient Granularity of Address Regions Protected by Register Locks 基础
CWE-1224: Improper Restriction of Write-Once Bit Fields 基础
CWE-1230: Exposure of Sensitive Information Through Metadata 基础
CWE-1231: Improper Prevention of Lock Bit Modification 基础
CWE-1233: Security-Sensitive Hardware Controls with Missing Lock Bit Protection 基础
CWE-1242: Inclusion of Undocumented Features or Chicken Bits 基础
CWE-1243: Sensitive Non-Volatile Information Not Protected During Debug 基础
CWE-1244: Internal Asset Exposed to Unsafe Debug Access Level or State 基础
CWE-1252: CPU Hardware Not Configured to Support Exclusivity of Write and Execute Operations 基础
CWE-1256: Improper Restriction of Software Interfaces to Hardware Features 基础
CWE-1257: Improper Access Control Applied to Mirrored or Aliased Memory Regions 基础
CWE-1259: Improper Restriction of Security Token Assignment 基础
CWE-1260: Improper Handling of Overlap Between Protected Memory Ranges 基础
CWE-1262: Improper Access Control for Register Interface 基础
CWE-1263: Improper Physical Access Control 基础
CWE-1267: Policy Uses Obsolete Encoding 基础
CWE-1268: Policy Privileges are not Assigned Consistently Between Control and Data Agents 基础
CWE-1270: Generation of Incorrect Security Tokens 基础
CWE-1274: Improper Access Control for Volatile Memory Containing Boot Code 基础
CWE-1275: Sensitive Cookie with Improper SameSite Attribute 基础
CWE-1276: Hardware Child Block Incorrectly Connected to Parent System 基础
CWE-1283: Mutable Attestation or Measurement Reporting Data 基础
CWE-1290: Incorrect Decoding of Security Identifiers 基础
CWE-1292: Incorrect Conversion of Security Identifiers 基础
CWE-1294: Insecure Security Identifier Mechanism 基础
CWE-1296: Incorrect Chaining or Granularity of Debug Components 基础
CWE-1297: Unprotected Confidential Information on Device is Accessible by OSAT Vendors 基础
CWE-1299: Missing Protection Mechanism for Alternate Hardware Interface 基础
CWE-1302: Missing Source Identifier in Entity Transactions on a System-On-Chip (SOC) 基础
CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation 基础
CWE-1311: Improper Translation of Security Attributes by Fabric Bridge 基础
CWE-1312: Missing Protection for Mirrored Regions in On-Chip Fabric Firewall 基础
CWE-1313: Hardware Allows Activation of Test or Debug Logic at Runtime 基础
CWE-1314: Missing Write Protection for Parametric Data Values 基础
CWE-1315: Improper Setting of Bus Controlling Capability in Fabric End-point 基础
CWE-1316: Fabric-Address Map Allows Programming of Unwarranted Overlaps of Protected and Unprotected Ranges 基础
CWE-1317: Improper Access Control in Fabric Bridge 基础
CWE-1320: Improper Protection for Outbound Error Messages and Alert Signals 基础
CWE-1323: Improper Management of Sensitive Trace Data 基础
CWE-1328: Security Version Number Mutable to Older Versions 基础
CWE-1334: Unauthorized Error Injection Can Degrade Hardware Redundancy 基础
CWE-1390: Weak Authentication 基础
CWE-1391: Use of Weak Credentials 基础
CWE-1392: Use of Default Credentials 基础
CWE-1393: Use of Default Password 基础
CWE-1394: Use of Default Cryptographic Key 基础
CWE-1401: Weaknesses in this category are related to concurrency.
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基础
CWE-363: Race Condition Enabling Link Following 基础
CWE-364: Signal Handler Race Condition 基础
CWE-366: Race Condition within a Thread 基础
CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition 基础
CWE-368: Context Switching Race Condition 基础
CWE-412: Unrestricted Externally Accessible Lock 基础
CWE-413: Improper Resource Locking 基础
CWE-414: Missing Lock Check 基础
CWE-432: Dangerous Signal Handler not Disabled During Sensitive Operations 基础
CWE-479: Signal Handler Use of a Non-reentrant Function 基础
CWE-543: Use of Singleton Pattern Without Synchronization in a Multithreaded Context 基础
CWE-558: Use of getlogin() in Multithreaded Application 基础
CWE-567: Unsynchronized Access to Shared Data in a Multithreaded Context 基础
CWE-572: Call to Thread run() instead of start() 基础
CWE-574: EJB Bad Practices: Use of Synchronization Primitives 基础
CWE-591: Sensitive Data Storage in Improperly Locked Memory 基础
CWE-609: Double-Checked Locking 基础
CWE-663: Use of a Non-reentrant Function in a Concurrent Context 基础
CWE-667: Improper Locking 基础
CWE-689: Permission Race Condition During Resource Copy 基础
CWE-764: Multiple Locks of a Critical Resource 基础
CWE-765: Multiple Unlocks of a Critical Resource 基础
CWE-820: Missing Synchronization 基础
CWE-821: Incorrect Synchronization 基础
CWE-828: Signal Handler with Functionality that is not Asynchronous-Safe 基础
CWE-831: Signal Handler Function Associated with Multiple Signals 基础
CWE-832: Unlock of a Resource that is not Locked 基础
CWE-833: Deadlock 基础
CWE-1058: Invokable Control Element in Multi-Thread Context with non-Final Static Storable or Member Element 基础
CWE-1088: Synchronous Access of Remote Resource without Timeout 基础
CWE-1096: Singleton Class Instance Creation without Proper Locking or Synchronization 基础
CWE-1223: Race Condition for Write-Once Attributes 基础
CWE-1232: Improper Lock Behavior After Power State Transition 基础
CWE-1234: Hardware Internal or Debug Modes Allow Override of Locks 基础
CWE-1264: Hardware Logic with Insecure De-Synchronization between Control and Data Channels 基础
CWE-1298: Hardware Logic Contains Race Conditions 基础
CWE-1403: Weaknesses in this category are related to exposed resource.
CWE-8: J2EE Misconfiguration: Entity Bean Declared Remote 基础
CWE-15: External Control of System or Configuration Setting 基础
CWE-73: External Control of File Name or Path 基础
CWE-114: Process Control 基础
CWE-219: Storage of File with Sensitive Data Under Web Root 基础
CWE-220: Storage of File With Sensitive Data Under FTP Root 基础
CWE-374: Passing Mutable Objects to an Untrusted Method 基础
CWE-375: Returning a Mutable Object to an Untrusted Caller 基础
CWE-377: DEPRECATED: Insecure Temporary File 基础
CWE-378: Creation of Temporary File With Insecure Permissions 基础
CWE-379: Creation of Temporary File in Directory with Insecure Permissions 基础
CWE-402: Transmission of Private Resources into a New Sphere 基础
CWE-403: Exposure of File Descriptor to Unintended Control Sphere 基础
CWE-426: Untrusted Search Path 基础
CWE-427: Uncontrolled Search Path Element 基础
CWE-428: Unquoted Search Path or Element 基础
CWE-433: Unparsed Raw Web Content Delivery 基础
CWE-472: External Control of Assumed-Immutable Web Parameter 基础
CWE-488: Exposure of Data Element to Wrong Session 基础
CWE-491: Public cloneable() Method Without Final 基础
CWE-492: Use of Inner Class Containing Sensitive Data 基础
CWE-493: Critical Public Variable Without Final Modifier 基础
CWE-498: Cloneable Class Containing Sensitive Information 基础
CWE-499: Serializable Class Containing Sensitive Data 基础
CWE-500: Public Static Field Not Marked Final 基础
CWE-524: Use of Cache Containing Sensitive Information 基础
CWE-525: Use of Web Browser Cache Containing Sensitive Information 基础
CWE-527: Exposure of Version-Control Repository to an Unauthorized Control Sphere 基础
CWE-528: Exposure of Core Dump File to an Unauthorized Control Sphere 基础
CWE-529: Exposure of Access Control List Files to an Unauthorized Control Sphere 基础
CWE-530: Exposure of Backup File to an Unauthorized Control Sphere 基础
CWE-539: Use of Persistent Cookies Containing Sensitive Information 基础
CWE-552: Files or Directories Accessible to External Parties 基础
CWE-553: Command Shell in Externally Accessible Directory 基础
CWE-565: Reliance on Cookies without Validation and Integrity Checking 基础
CWE-582: Array Declared Public, Final, and Static 基础
CWE-583: finalize() Method Declared Public 基础
CWE-608: Struts: Non-private Field in ActionForm Class 基础
CWE-619: Dangling Database Cursor 基础
CWE-642: External Control of Critical State Data 基础
CWE-668: Exposure of Resource to Wrong Sphere 基础
CWE-767: Access to Critical Private Variable via Public Method 基础
CWE-784: Reliance on Cookies without Validation and Integrity Checking in a Security Decision 基础
CWE-1282: Assumed-Immutable Data is Stored in Writable Memory 基础
CWE-1327: Binding to an Unrestricted IP Address 基础
CWE-1404: Weaknesses in this category are related to file handling.
CWE-22: Improper Limitation of a Pathname to a Restricted Directory 基础
CWE-23: Relative Path Traversal 基础
CWE-24: Path Traversal: '../filedir' 基础
CWE-25: Path Traversal: '/../filedir' 基础
CWE-26: Path Traversal: '/dir/../filename' 基础
CWE-27: Path Traversal: 'dir/../../filename' 基础
CWE-28: Path Traversal: '..\filedir' 基础
CWE-29: Path Traversal: '\..\filename' 基础
CWE-30: Path Traversal: '\dir\..\filename' 基础
CWE-31: Path Traversal: 'dir\..\..\filename' 基础
CWE-32: Path Traversal: '...' (Triple Dot) 基础
CWE-33: Path Traversal: '....' (Multiple Dot) 基础
CWE-34: Path Traversal: '....//' 基础
CWE-35: Path Traversal: '.../...//' 基础
CWE-36: Absolute Path Traversal 基础
CWE-37: Path Traversal: '/absolute/pathname/here' 基础
CWE-38: Path Traversal: '\absolute\pathname\here' 基础
CWE-39: Path Traversal: 'C:dirname' 基础
CWE-40: Path Traversal: '\\UNC\share\name\' (Windows UNC Share) 基础
CWE-41: Improper Resolution of Path Equivalence 基础
CWE-42: Path Equivalence: 'filename.' (Trailing Dot) 基础
CWE-43: Path Equivalence: 'filename....' (Multiple Trailing Dot) 基础
CWE-44: Path Equivalence: 'file.name' (Internal Dot) 基础
CWE-45: Path Equivalence: 'file...name' (Multiple Internal Dot) 基础
CWE-46: Path Equivalence: 'filename ' (Trailing Space) 基础
CWE-47: Path Equivalence: ' filename' (Leading Space) 基础
CWE-48: Path Equivalence: 'file name' (Internal Whitespace) 基础
CWE-49: Path Equivalence: 'filename/' (Trailing Slash) 基础
CWE-50: Path Equivalence: '//multiple/leading/slash' 基础
CWE-51: Path Equivalence: '/multiple//internal/slash' 基础
CWE-52: Path Equivalence: '/multiple/trailing/slash//' 基础
CWE-53: Path Equivalence: '\multiple\\internal\backslash' 基础
CWE-54: Path Equivalence: 'filedir\' (Trailing Backslash) 基础
CWE-55: Path Equivalence: '/./' (Single Dot Directory) 基础
CWE-56: Path Equivalence: 'filedir*' (Wildcard) 基础
CWE-57: Path Equivalence: 'fakedir/../realdir/filename' 基础
CWE-58: Path Equivalence: Windows 8.3 Filename 基础
CWE-59: Improper Link Resolution Before File Access 基础
CWE-61: UNIX Symbolic Link (Symlink) Following 基础
CWE-62: UNIX Hard Link 基础
CWE-64: Windows Shortcut Following (.LNK) 基础
CWE-65: Windows Hard Link 基础
CWE-66: Improper Handling of File Names that Identify Virtual Resources 基础
CWE-67: Improper Handling of Windows Device Names 基础
CWE-69: Improper Handling of Windows ::DATA Alternate Data Stream 基础
CWE-72: Improper Handling of Apple HFS+ Alternate Data Stream Path 基础
CWE-1407: Weaknesses in this category are related to improper neutralization.
CWE-116: Improper Encoding or Escaping of Output 基础
CWE-117: Improper Output Neutralization for Logs 基础
CWE-130: Improper Handling of Length Parameter Inconsistency 基础
CWE-138: Improper Neutralization of Special Elements 基础
CWE-140: Improper Neutralization of Delimiters 基础
CWE-141: Improper Neutralization of Parameter/Argument Delimiters 基础
CWE-142: Improper Neutralization of Value Delimiters 基础
CWE-143: Improper Neutralization of Record Delimiters 基础
CWE-144: Improper Neutralization of Line Delimiters 基础
CWE-145: Improper Neutralization of Section Delimiters 基础
CWE-146: Improper Neutralization of Expression/Command Delimiters 基础
CWE-147: Improper Neutralization of Input Terminators 基础
CWE-148: Improper Neutralization of Input Leaders 基础
CWE-149: Improper Neutralization of Quoting Syntax 基础
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences 基础
CWE-151: Improper Neutralization of Comment Delimiters 基础
CWE-152: Improper Neutralization of Macro Symbols 基础
CWE-153: Improper Neutralization of Substitution Characters 基础
CWE-154: Improper Neutralization of Variable Name Delimiters 基础
CWE-155: Improper Neutralization of Wildcards or Matching Symbols 基础
CWE-156: Improper Neutralization of Whitespace 基础
CWE-157: Failure to Sanitize Paired Delimiters 基础
CWE-158: Improper Neutralization of Null Byte or NUL Character 基础
CWE-159: Improper Handling of Invalid Use of Special Elements 基础
CWE-160: Improper Neutralization of Leading Special Elements 基础
CWE-161: Improper Neutralization of Multiple Leading Special Elements 基础
CWE-162: Improper Neutralization of Trailing Special Elements 基础
CWE-163: Improper Neutralization of Multiple Trailing Special Elements 基础
CWE-164: Improper Neutralization of Internal Special Elements 基础
CWE-165: Improper Neutralization of Multiple Internal Special Elements 基础
CWE-166: Improper Handling of Missing Special Element 基础
CWE-167: Improper Handling of Additional Special Element 基础
CWE-168: Improper Handling of Inconsistent Special Elements 基础
CWE-170: Improper Null Termination 基础
CWE-172: Improper Encoding or Decoding of Data 基础
CWE-173: Improper Handling of Alternate Encoding 基础
CWE-174: Double Decoding of the Same Data 基础
CWE-175: Improper Handling of Mixed Encoding 基础
CWE-176: Improper Handling of Unicode Encoding 基础
CWE-177: Improper Handling of URL Encoding (Hex Encoding) 基础
CWE-228: Improper Handling of Syntactically Invalid Structure 基础
CWE-229: Improper Handling of Values 基础
CWE-230: Improper Handling of Missing Values 基础
CWE-231: Improper Handling of Extra Values 基础
CWE-232: Improper Handling of Undefined Values 基础
CWE-233: Improper Handling of Parameters 基础
CWE-234: Failure to Handle Missing Parameter 基础
CWE-235: Improper Handling of Extra Parameters 基础
CWE-236: Improper Handling of Undefined Parameters 基础
CWE-237: Improper Handling of Structural Elements 基础
CWE-238: Improper Handling of Incomplete Structural Elements 基础
CWE-239: Failure to Handle Incomplete Element 基础
CWE-240: Improper Handling of Inconsistent Structural Elements 基础
CWE-241: Improper Handling of Unexpected Data Type 基础
CWE-463: Deletion of Data Structure Sentinel 基础
CWE-464: Addition of Data Structure Sentinel 基础
CWE-626: Null Byte Interaction Error (Poison Null Byte) 基础
CWE-644: Improper Neutralization of HTTP Headers for Scripting Syntax 基础
CWE-707: Improper Neutralization 基础
CWE-790: Improper Filtering of Special Elements 基础
CWE-791: Incomplete Filtering of Special Elements 基础
CWE-792: Incomplete Filtering of One or More Instances of Special Elements 基础
CWE-793: Only Filtering One Instance of a Special Element 基础
CWE-794: Incomplete Filtering of Multiple Instances of Special Elements 基础
CWE-795: Only Filtering Special Elements at a Specified Location 基础
CWE-796: Only Filtering Special Elements Relative to a Marker 基础
CWE-797: Only Filtering Special Elements at an Absolute Position 基础
CWE-838: Inappropriate Encoding for Output Context 基础
CWE-1409: Weaknesses in this category are related to injection.
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component 基础
CWE-75: Failure to Sanitize Special Elements into a Different Plane 基础
CWE-76: Improper Neutralization of Equivalent Special Elements 基础
CWE-77: Improper Neutralization of Special Elements used in a Command 基础
CWE-78: Improper Neutralization of Special Elements used in an OS Command 基础
CWE-79: Improper Neutralization of Input During Web Page Generation 基础
", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages."> CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page 基础
CWE-81: Improper Neutralization of Script in an Error Message Web Page 基础
CWE-82: Improper Neutralization of Script in Attributes of IMG Tags in a Web Page 基础
CWE-83: Improper Neutralization of Script in Attributes in a Web Page 基础
CWE-84: Improper Neutralization of Encoded URI Schemes in a Web Page 基础
CWE-85: Doubled Character XSS Manipulations 基础
CWE-86: Improper Neutralization of Invalid Characters in Identifiers in Web Pages 基础
CWE-87: Improper Neutralization of Alternate XSS Syntax 基础
CWE-88: Improper Neutralization of Argument Delimiters in a Command 基础
CWE-89: Improper Neutralization of Special Elements used in an SQL Command 基础
CWE-90: Improper Neutralization of Special Elements used in an LDAP Query 基础
CWE-91: XML Injection 基础
CWE-93: Improper Neutralization of CRLF Sequences 基础
CWE-94: Improper Control of Generation of Code 基础
CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code 基础
CWE-96: Improper Neutralization of Directives in Statically Saved Code 基础
CWE-97: Improper Neutralization of Server-Side Includes (SSI) Within a Web Page 基础
CWE-99: Improper Control of Resource Identifiers 基础
CWE-102: Struts: Duplicate Validation Forms 基础
CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers 基础
CWE-564: Use of Hibernate with HQL/SQL Query String Containing External Input 基础
CWE-621: Variable Extraction Error 基础
CWE-624: Executable Regular Expression Error 基础
CWE-627: Dynamic Variable Evaluation 基础
CWE-641: Improper Restriction of Names for Files and Other Resources 基础
CWE-643: Improper Neutralization of Data within XPath Expressions 基础
CWE-652: Improper Neutralization of Data within XQuery Expressions 基础
CWE-692: Incomplete Denylist to Cross-Site Scripting 基础
CWE-694: Use of Multiple Resources with Duplicate Identifier 基础
CWE-914: Improper Control of Dynamically-Identified Variables 基础
CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement 基础
CWE-943: Improper Neutralization of Special Elements in Data Query Logic 基础
CWE-1236: Improper Neutralization of Formula Elements in a CSV File 基础
CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine 基础
CWE-1426: Improper Validation of Generative AI Output 基础
CWE-1427: Improper Neutralization of Input Used for LLM Prompting 基础
CWE-1410: Weaknesses in this category are related to insufficient control flow management.
CWE-179: Incorrect Behavior Order: Early Validation 基础
CWE-180: Incorrect Behavior Order: Validate Before Canonicalize 基础
CWE-181: Incorrect Behavior Order: Validate Before Filter 基础
CWE-248: Uncaught Exception 基础
CWE-382: J2EE Bad Practices: Use of System.exit() 基础
CWE-395: Use of NullPointerException Catch to Detect NULL Pointer Dereference 基础
CWE-396: Declaration of Catch for Generic Exception 基础
CWE-397: Declaration of Throws for Generic Exception 基础
CWE-408: Incorrect Behavior Order: Early Amplification 基础
CWE-430: Deployment of Wrong Handler 基础
CWE-431: Missing Handler 基础
CWE-455: Non-exit on Failed Initialization 基础
CWE-480: Use of Incorrect Operator 基础
CWE-481: Assigning instead of Comparing 基础
CWE-482: Comparing instead of Assigning 基础
CWE-483: Incorrect Block Delimitation 基础
CWE-584: Return Inside Finally Block 基础
CWE-600: Uncaught Exception in Servlet 基础
CWE-617: Reachable Assertion 基础
CWE-670: Always-Incorrect Control Flow Implementation 基础
CWE-674: Uncontrolled Recursion 基础
CWE-691: Insufficient Control Flow Management 基础
CWE-696: Incorrect Behavior Order 基础
CWE-698: Execution After Redirect (EAR) 基础
CWE-705: Incorrect Control Flow Scoping 基础
CWE-768: Incorrect Short Circuit Evaluation 基础
CWE-783: Operator Precedence Logic Error 基础
CWE-799: Improper Control of Interaction Frequency 基础
CWE-834: Excessive Iteration 基础
CWE-835: Loop with Unreachable Exit Condition 基础
CWE-837: Improper Enforcement of a Single, Unique Action 基础
CWE-841: Improper Enforcement of Behavioral Workflow 基础
CWE-1190: DMA Device Enabled Too Early in Boot Phase 基础
CWE-1193: Power-On of Untrusted Execution Core Before Enabling Fabric Access Control 基础
CWE-1265: Unintended Reentrant Invocation of Non-reentrant Code Via Nested Calls 基础
CWE-1280: Access Control Check Implemented After Asset is Accessed 基础
CWE-1281: Sequence of Processor Instructions Leads to Unexpected Behavior 基础
CWE-1322: Use of Blocking Code in Single-threaded, Non-blocking Context 基础
CWE-1399: Weaknesses in this category are related to memory safety.
CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer 基础
CWE-120: Buffer Copy without Checking Size of Input 基础
CWE-121: Stack-based Buffer Overflow 基础
CWE-122: Heap-based Buffer Overflow 基础
CWE-123: Write-what-where Condition 基础
CWE-124: Buffer Underwrite 基础
CWE-125: Out-of-bounds Read 基础
CWE-126: Buffer Over-read 基础
CWE-127: Buffer Under-read 基础
CWE-129: Improper Validation of Array Index 基础
CWE-131: Incorrect Calculation of Buffer Size 基础
CWE-134: Use of Externally-Controlled Format String 基础
CWE-188: Reliance on Data/Memory Layout 基础
CWE-198: Use of Incorrect Byte Ordering 基础
CWE-244: Improper Clearing of Heap Memory Before Release 基础
CWE-401: Missing Release of Memory after Effective Lifetime 基础
CWE-415: Double Free 基础
CWE-416: Use After Free 基础
CWE-466: Return of Pointer Value Outside of Expected Range 基础
CWE-562: Return of Stack Variable Address 基础
CWE-587: Assignment of a Fixed Address to a Pointer 基础
CWE-590: Free of Memory not on the Heap 基础
CWE-680: Integer Overflow to Buffer Overflow 基础
CWE-690: Unchecked Return Value to NULL Pointer Dereference 基础
CWE-761: Free of Pointer not at Start of Buffer 基础
CWE-762: Mismatched Memory Management Routines 基础
CWE-763: Release of Invalid Pointer or Reference 基础
CWE-786: Access of Memory Location Before Start of Buffer 基础
CWE-787: Out-of-bounds Write 基础
CWE-788: Access of Memory Location After End of Buffer 基础
CWE-789: Memory Allocation with Excessive Size Value 基础
CWE-805: Buffer Access with Incorrect Length Value 基础
CWE-806: Buffer Access Using Size of Source Buffer 基础
CWE-822: Untrusted Pointer Dereference 基础
CWE-823: Use of Out-of-range Pointer Offset 基础
CWE-824: Access of Uninitialized Pointer 基础
CWE-825: Expired Pointer Dereference 基础
CWE-1412: Weaknesses in this category are related to poor coding practices.
CWE-11: ASP.NET Misconfiguration: Creating Debug Binary 基础
CWE-103: Struts: Incomplete validate() Method Definition 基础
CWE-104: Struts: Form Bean Does Not Extend Validation Class 基础
CWE-107: Struts: Unused Validation Form 基础
CWE-110: Struts: Validator Without Form Field 基础
CWE-111: Direct Use of Unsafe JNI 基础
CWE-242: Use of Inherently Dangerous Function 基础
CWE-245: J2EE Bad Practices: Direct Management of Connections 基础
CWE-246: J2EE Bad Practices: Direct Use of Sockets 基础
CWE-253: Incorrect Check of Function Return Value 基础
CWE-358: Improperly Implemented Security Check for Standard 基础
CWE-383: J2EE Bad Practices: Direct Use of Threads 基础
CWE-392: Missing Report of Error Condition 基础
CWE-393: Return of Wrong Status Code 基础
CWE-440: Expected Behavior Violation 基础
CWE-446: UI Discrepancy for Security Feature 基础
CWE-448: Obsolete Feature in UI 基础
CWE-449: The UI Performs the Wrong Action 基础
CWE-451: User Interface (UI) Misrepresentation of Critical Information 基础
CWE-462: Duplicate Key in Associative List (Alist) 基础
CWE-474: Use of Function with Inconsistent Implementations 基础
CWE-475: Undefined Behavior for Input to API 基础
CWE-476: NULL Pointer Dereference 基础
CWE-477: Use of Obsolete Function 基础
CWE-484: Omitted Break Statement in Switch 基础
CWE-489: Active Debug Code 基础
CWE-506: Embedded Malicious Code 基础
CWE-507: Trojan Horse 基础
CWE-508: Non-Replicating Malicious Code 基础
CWE-509: Replicating Malicious Code (Virus or Worm) 基础
CWE-510: Trapdoor 基础
CWE-511: Logic/Time Bomb 基础
CWE-512: Spyware 基础
CWE-546: Suspicious Comment 基础
CWE-547: Use of Hard-coded, Security-relevant Constants 基础
CWE-560: Use of umask() with chmod-style Argument 基础
CWE-561: Dead Code 基础
CWE-563: Assignment to Variable without Use 基础
CWE-570: Expression is Always False 基础
CWE-571: Expression is Always True 基础
CWE-573: Improper Following of Specification by Caller 基础
CWE-575: EJB Bad Practices: Use of AWT Swing 基础
CWE-576: EJB Bad Practices: Use of Java I/O 基础
CWE-577: EJB Bad Practices: Use of Sockets 基础
CWE-578: EJB Bad Practices: Use of Class Loader 基础
CWE-579: J2EE Bad Practices: Non-serializable Object Stored in Session 基础
CWE-581: Object Model Violation: Just One of Equals and Hashcode Defined 基础
CWE-585: Empty Synchronized Block 基础
CWE-586: Explicit Call to Finalize() 基础
CWE-589: Call to Non-ubiquitous API 基础
CWE-594: J2EE Framework: Saving Unserializable Objects to Disk 基础
CWE-605: Multiple Binds to the Same Port 基础
CWE-628: Function Call with Incorrectly Specified Arguments 基础
CWE-675: Multiple Operations on Resource in Single-Operation Context 基础
CWE-676: Use of Potentially Dangerous Function 基础
CWE-683: Function Call With Incorrect Order of Arguments 基础
CWE-684: Incorrect Provision of Specified Functionality 基础
CWE-685: Function Call With Incorrect Number of Arguments 基础
CWE-686: Function Call With Incorrect Argument Type 基础
CWE-687: Function Call With Incorrectly Specified Argument Value 基础
CWE-688: Function Call With Incorrect Variable or Reference as Argument 基础
CWE-695: Use of Low-Level Functionality 基础
CWE-710: Improper Adherence to Coding Standards 基础
CWE-758: Reliance on Undefined, Unspecified, or Implementation-Defined Behavior 基础
CWE-766: Critical Data Element Declared Public 基础
CWE-785: Use of Path Manipulation Function without Maximum-sized Buffer 基础
CWE-912: Hidden Functionality 基础
CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User 基础
CWE-1041: Use of Redundant Code 基础
CWE-1043: Data Element Aggregating an Excessively Large Number of Non-Primitive Elements 基础
CWE-1044: Architecture with Number of Horizontal Layers Outside of Expected Range 基础
CWE-1045: Parent Class with a Virtual Destructor and a Child Class without a Virtual Destructor 基础
CWE-1047: Modules with Circular Dependencies 基础
CWE-1048: Invokable Control Element with Large Number of Outward Calls 基础
CWE-1053: Missing Documentation for Design 基础
CWE-1054: Invocation of a Control Element at an Unnecessarily Deep Horizontal Layer 基础
CWE-1055: Multiple Inheritance from Concrete Classes 基础
CWE-1056: Invokable Control Element with Variadic Parameters 基础
CWE-1057: Data Access Operations Outside of Expected Data Manager Component 基础
CWE-1059: Insufficient Technical Documentation 基础
CWE-1060: Excessive Number of Inefficient Server-Side Data Accesses 基础
CWE-1061: Insufficient Encapsulation 基础
CWE-1062: Parent Class with References to Child Class 基础
CWE-1064: Invokable Control Element with Signature Containing an Excessive Number of Parameters 基础
CWE-1065: Runtime Resource Management Control Element in a Component Built to Run on Application Servers 基础
CWE-1066: Missing Serialization Control Element 基础
CWE-1068: Inconsistency Between Implementation and Documented Design 基础
CWE-1069: Empty Exception Block 基础
CWE-1070: Serializable Data Element Containing non-Serializable Item Elements 基础
CWE-1071: Empty Code Block 基础
CWE-1074: Class with Excessively Deep Inheritance 基础
CWE-1075: Unconditional Control Flow Transfer outside of Switch Block 基础
CWE-1076: Insufficient Adherence to Expected Conventions 基础
CWE-1078: Inappropriate Source Code Style or Formatting 基础
CWE-1079: Parent Class without Virtual Destructor Method 基础
CWE-1080: Source Code File with Excessive Number of Lines of Code 基础
CWE-1082: Class Instance Self Destruction Control Element 基础
CWE-1083: Data Access from Outside Expected Data Manager Component 基础
CWE-1085: Invokable Control Element with Excessive Volume of Commented-out Code 基础
CWE-1086: Class with Excessive Number of Child Classes 基础
CWE-1087: Class with Virtual Method without a Virtual Destructor 基础
CWE-1090: Method Containing Access of a Member Element from Another Class 基础
CWE-1092: Use of Same Invokable Control Element in Multiple Architectural Layers 基础
CWE-1093: Excessively Complex Data Representation 基础
CWE-1095: Loop Condition Value Update within the Loop 基础
CWE-1097: Persistent Storable Data Element without Associated Comparison Control Element 基础
CWE-1098: Data Element containing Pointer Item without Proper Copy Control Element 基础
CWE-1099: Inconsistent Naming Conventions for Identifiers 基础
CWE-1100: Insufficient Isolation of System-Dependent Functions 基础
CWE-1101: Reliance on Runtime Component in Generated Code 基础
CWE-1102: Reliance on Machine-Dependent Data Representation 基础
CWE-1103: Use of Platform-Dependent Third Party Components 基础
CWE-1105: Insufficient Encapsulation of Machine-Dependent Functionality 基础
CWE-1106: Insufficient Use of Symbolic Constants 基础
CWE-1107: Insufficient Isolation of Symbolic Constant Definitions 基础
CWE-1108: Excessive Reliance on Global Variables 基础
CWE-1109: Use of Same Variable for Multiple Purposes 基础
CWE-1110: Incomplete Design Documentation 基础
CWE-1111: Incomplete I/O Documentation 基础
CWE-1112: Incomplete Documentation of Program Execution 基础
CWE-1113: Inappropriate Comment Style 基础
CWE-1114: Inappropriate Whitespace Style 基础
CWE-1115: Source Code Element without Standard Prologue 基础
CWE-1116: Inaccurate Source Code Comments 基础
CWE-1117: Callable with Insufficient Behavioral Summary 基础
CWE-1118: Insufficient Documentation of Error Handling Techniques 基础
CWE-1119: Excessive Use of Unconditional Branching 基础
CWE-1120: Excessive Code Complexity 基础
CWE-1121: Excessive McCabe Cyclomatic Complexity 基础
CWE-1122: Excessive Halstead Complexity 基础
CWE-1123: Excessive Use of Self-Modifying Code 基础
CWE-1124: Excessively Deep Nesting 基础
CWE-1125: Excessive Attack Surface 基础
CWE-1126: Declaration of Variable with Unnecessarily Wide Scope 基础
CWE-1127: Compilation with Insufficient Warnings or Errors 基础
CWE-1164: Irrelevant Code 基础
CWE-1177: Use of Prohibited Code 基础
CWE-1209: Failure to Disable Reserved Bits 基础
CWE-1245: Improper Finite State Machines (FSMs) in Hardware Logic 基础
CWE-1341: Multiple Releases of Same Resource or Handle 基础
CWE-1357: Reliance on Insufficiently Trustworthy Component 基础
CWE-1434: Insecure Setting of Generative AI/ML Model Inference Parameters 基础
CWE-1413: Weaknesses in this category are related to protection mechanism failure.
CWE-182: Collapse of Data into Unsafe Value 基础
CWE-184: Incomplete List of Disallowed Inputs 基础
CWE-222: Truncation of Security-relevant Information 基础
CWE-223: Omission of Security-relevant Information 基础
CWE-224: Obscured Security-relevant Information by Alternate Name 基础
CWE-356: Missing User Interaction for Potentially Unsafe Action 基础
CWE-357: Insufficient UI Warning of Dangerous Operations 基础
CWE-450: Multiple Interpretations of UI Input 基础
CWE-602: Client-Side Enforcement of Server-Side Security 基础
CWE-693: Protection Mechanism Failure 基础
CWE-757: Selection of Less-Secure Algorithm During Negotiation 基础
CWE-778: Insufficient Logging 基础
CWE-807: Reliance on Untrusted Inputs in a Security Decision 基础
CWE-1039: Inadequate Detection or Handling of Adversarial Input Perturbations in Automated Recognition Mechanism 基础
CWE-1248: Semiconductor Defects in Hardware Logic with Security-Sensitive Implications 基础
CWE-1253: Incorrect Selection of Fuse Values 基础
CWE-1269: Product Released in Non-Release Configuration 基础
CWE-1278: Missing Protection Against Hardware Reverse Engineering Using Integrated Circuit (IC) Imaging Techniques 基础
CWE-1291: Public Key Re-Use for Signing both Debug and Production Code 基础
CWE-1318: Missing Support for Security Features in On-chip Fabrics or Buses 基础
CWE-1319: Improper Protection against Electromagnetic Fault Injection (EM-FI) 基础
CWE-1326: Missing Immutable Root of Trust in Hardware 基础
CWE-1338: Improper Protections Against Hardware Overheating 基础
CWE-1429: Missing Security-Relevant Feedback for Unexecuted Operations in Hardware Interface 基础
CWE-1416: Weaknesses in this category are related to resource lifecycle management.
CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program 基础
CWE-118: Incorrect Access of Indexable Resource 基础
CWE-178: Improper Handling of Case Sensitivity 基础
CWE-192: Integer Coercion Error 基础
CWE-194: Unexpected Sign Extension 基础
CWE-195: Signed to Unsigned Conversion Error 基础
CWE-196: Unsigned to Signed Conversion Error 基础
CWE-197: Numeric Truncation Error 基础
CWE-212: Improper Removal of Sensitive Information Before Storage or Transfer 基础
CWE-221: Information Loss or Omission 基础
CWE-226: Sensitive Information in Resource Not Removed Before Reuse 基础
CWE-243: Creation of chroot Jail Without Changing Working Directory 基础
CWE-372: Incomplete Internal State Distinction 基础
CWE-386: Symbolic Name not Mapping to Correct Object 基础
CWE-400: Uncontrolled Resource Consumption 基础
CWE-404: Improper Resource Shutdown or Release 基础
CWE-405: Asymmetric Resource Consumption (Amplification) 基础
CWE-406: Insufficient Control of Network Message Volume (Network Amplification) 基础
CWE-407: Inefficient Algorithmic Complexity 基础
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification) 基础
CWE-410: Insufficient Resource Pool 基础
CWE-434: Unrestricted Upload of File with Dangerous Type 基础
CWE-453: Insecure Default Variable Initialization 基础
CWE-454: External Initialization of Trusted Variables or Data Stores 基础
CWE-456: Missing Initialization of a Variable 基础
CWE-457: Use of Uninitialized Variable 基础
CWE-459: Incomplete Cleanup 基础
CWE-460: Improper Cleanup on Thrown Exception 基础
CWE-471: Modification of Assumed-Immutable Data (MAID) 基础
CWE-487: Reliance on Package-level Scope 基础
CWE-495: Private Data Structure Returned From A Public Method 基础
CWE-496: Public Data Assigned to Private Array-Typed Field 基础
CWE-501: Trust Boundary Violation 基础
CWE-568: finalize() Method Without super.finalize() 基础
CWE-580: clone() Method Without super.clone() 基础
CWE-588: Attempt to Access Child of a Non-structure Pointer 基础
CWE-607: Public Static Final Field References Mutable Object 基础
CWE-610: Externally Controlled Reference to a Resource in Another Sphere 基础
CWE-618: Exposed Unsafe ActiveX Method 基础
CWE-662: Improper Synchronization 基础
CWE-664: Improper Control of a Resource Through its Lifetime 基础
CWE-665: Improper Initialization 基础
CWE-666: Operation on Resource in Wrong Phase of Lifetime 基础
CWE-669: Incorrect Resource Transfer Between Spheres 基础
CWE-673: External Influence of Sphere Definition 基础
CWE-681: Incorrect Conversion between Numeric Types 基础
CWE-704: Incorrect Type Conversion or Cast 基础
CWE-706: Use of Incorrectly-Resolved Name or Reference 基础
CWE-749: Exposed Dangerous Method or Function 基础
CWE-770: Allocation of Resources Without Limits or Throttling 基础
CWE-771: Missing Reference to Active Allocated Resource 基础
CWE-772: Missing Release of Resource after Effective Lifetime 基础
CWE-773: Missing Reference to Active File Descriptor or Handle 基础
CWE-774: Allocation of File Descriptors or Handles Without Limits or Throttling 基础
CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime 基础
CWE-776: Improper Restriction of Recursive Entity References in DTDs 基础
CWE-779: Logging of Excessive Data 基础
CWE-782: Exposed IOCTL with Insufficient Access Control 基础
CWE-827: Improper Control of Document Type Definition 基础
CWE-829: Inclusion of Functionality from Untrusted Control Sphere 基础
CWE-830: Inclusion of Web Functionality from an Untrusted Source 基础
CWE-843: Access of Resource Using Incompatible Type 基础
CWE-908: Use of Uninitialized Resource 基础
CWE-909: Missing Initialization of Resource 基础
CWE-911: Improper Update of Reference Count 基础
CWE-913: Improper Control of Dynamically-Managed Code Resources 基础
CWE-920: Improper Restriction of Power Consumption 基础
CWE-922: Insecure Storage of Sensitive Information 基础
CWE-1042: Static Member Data Element outside of a Singleton Class Element 基础
CWE-1046: Creation of Immutable Text Using String Concatenation 基础
CWE-1049: Excessive Data Query Operations in a Large Data Table 基础
CWE-1050: Excessive Platform Resource Consumption within a Loop 基础
CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data 基础
CWE-1052: Excessive Use of Hard-Coded Literals in Initialization 基础
CWE-1063: Creation of Class Instance within a Static Code Block 基础
CWE-1067: Excessive Execution of Sequential Searches of Data Resource 基础
CWE-1072: Data Resource Access without Use of Connection Pooling 基础
CWE-1073: Non-SQL Invokable Control Element with Excessive Number of Data Resource Accesses 基础
CWE-1084: Invokable Control Element with Excessive File or Data Access Operations 基础
CWE-1089: Large Data Table with Excessive Number of Indices 基础
CWE-1091: Use of Object without Invoking Destructor Method 基础
CWE-1094: Excessive Index Range Scan for a Data Resource 基础
CWE-1176: Inefficient CPU Computation 基础
CWE-1188: Initialization of a Resource with an Insecure Default 基础
CWE-1221: Incorrect Register Defaults or Module Parameters 基础
CWE-1229: Creation of Emergent Resource 基础
CWE-1235: Incorrect Use of Autoboxing and Unboxing for Performance Critical Operations 基础
CWE-1239: Improper Zeroization of Hardware Register 基础
CWE-1246: Improper Write Handling in Limited-write Non-Volatile Memories 基础
CWE-1250: Improper Preservation of Consistency Between Independent Representations of Shared State 基础
CWE-1258: Exposure of Sensitive System Information Due to Uncleared Debug Information 基础
CWE-1266: Improper Scrubbing of Sensitive Data from Decommissioned Device 基础
CWE-1271: Uninitialized Value on Reset for Registers Holding Security Settings 基础
CWE-1272: Sensitive Information Uncleared Before Debug/Power State Transition 基础
CWE-1279: Cryptographic Operations are Run Before Supporting Units are Ready 基础
CWE-1301: Insufficient or Incomplete Data Removal within Hardware Component 基础
CWE-1325: Improperly Controlled Sequential Memory Allocation 基础
CWE-1330: Remanent Data Readable after Memory Erase 基础
CWE-1333: Inefficient Regular Expression Complexity 基础
CWE-1342: Information Exposure through Microarchitectural State after Transient Execution 基础
CWE-1386: Insecure Operation on Windows Junction / Mount Point 基础
CWE-1389: Incorrect Parsing of Numbers with Different Radices 基础
CWE-1419: Incorrect Initialization of Resource 基础
CWE-1420: Exposure of Sensitive Information during Transient Execution 基础
CWE-1421: Exposure of Sensitive Information in Shared Microarchitectural Structures during Transient Execution 基础
CWE-1422: Exposure of Sensitive Information caused by Incorrect Data Forwarding during Transient Execution 基础
CWE-1423: Exposure of Sensitive Information caused by Shared Microarchitectural Predictor State that Influences Transient Execution 基础
CWE-1417: Weaknesses in this category are related to sensitive information exposure.
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor 基础
CWE-201: Insertion of Sensitive Information Into Sent Data 基础
CWE-203: Observable Discrepancy 基础
CWE-204: Observable Response Discrepancy 基础
CWE-205: Observable Behavioral Discrepancy 基础
CWE-206: Observable Internal Behavioral Discrepancy 基础
CWE-207: Observable Behavioral Discrepancy With Equivalent Products 基础
CWE-208: Observable Timing Discrepancy 基础
CWE-209: Generation of Error Message Containing Sensitive Information 基础
CWE-210: Self-generated Error Message Containing Sensitive Information 基础
CWE-211: Externally-Generated Error Message Containing Sensitive Information 基础
CWE-213: Exposure of Sensitive Information Due to Incompatible Policies 基础
CWE-214: Invocation of Process Using Visible Sensitive Information 基础
CWE-215: Insertion of Sensitive Information Into Debugging Code 基础
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor 基础
CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere 基础
CWE-526: Cleartext Storage of Sensitive Information in an Environment Variable 基础
CWE-531: Inclusion of Sensitive Information in Test Code 基础
CWE-532: Insertion of Sensitive Information into Log File 基础
CWE-535: Exposure of Information Through Shell Error Message 基础
CWE-536: Servlet Runtime Error Message Containing Sensitive Information 基础
CWE-537: Java Runtime Error Message Containing Sensitive Information 基础
CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory 基础
CWE-540: Inclusion of Sensitive Information in Source Code 基础
CWE-541: Inclusion of Sensitive Information in an Include File 基础
CWE-548: Exposure of Information Through Directory Listing 基础
CWE-550: Server-generated Error Message Containing Sensitive Information 基础
CWE-598: Use of HTTP Request With Sensitive Query String 基础
CWE-615: Inclusion of Sensitive Information in Source Code Comments 基础
CWE-651: Exposure of WSDL File Containing Sensitive Information 基础
CWE-1254: Incorrect Comparison Logic Granularity 基础
CWE-1255: Comparison Logic is Vulnerable to Power Side-Channel Attacks 基础
CWE-1273: Device Unlock Credential Sharing 基础
CWE-1295: Debug Messages Revealing Unnecessary Information 基础
CWE-1300: Improper Protection of Physical Side Channels 基础
CWE-1431: Driving Intermediate Cryptographic State/Results to Hardware Module Outputs 基础

CWE 视图信息

漏洞映射说明

依据 : This entry is a View. Views are not weaknesses and therefore inappropriate to describe the root causes of vulnerabilities.
备注 : Use this View or other Views to search and navigate for the appropriate weakness.

备注

This view is different than the software development view (CWE-699) because this view is expected to include all weaknesses regardless of abstraction, while view 699 uses a largely-fixed Base level of abstraction related only to software weaknesses. It is different from the Research view (CWE-1000) because while comprehensive for all weaknesses, the view uses a deep hierarchical structure and excludes categories.

目标受众

利益相关方 描述
Academic Researchers Researchers can use this view to evaluate the breadth and depth of software assurance with respect to mitigating and managing weaknesses before they become vulnerabilities.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2023-04-25 +00:00 2023-04-23 +00:00 4.11

修改记录

名称 组织 日期 备注
CWE Content Team MITRE 2023-06-29 +00:00 updated Mapping_Notes
cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。