简体中文

CWE-1441 类别详情

CWE-1441

OWASP Top Ten 2025 Category A06:2025 - Insecure Design
2025-12-11 +00:00
Incomplete
CWE Mitre.org
指定 CWE 通知
随时了解指定 CWE 的变更。
管理通知

名称: OWASP Top Ten 2025 Category A06:2025 - Insecure Design

Weaknesses in this category are related to the A06 category "Insecure Design" in the OWASP Top Ten 2025.

CWE 成员列表

CWE-1021: Improper Restriction of Rendered UI Layers or Frames 基础

CWE-1022: Use of Web Link to Untrusted Target with window.opener Access 基础

CWE-1125: Excessive Attack Surface 基础

CWE-183: Permissive List of Allowed Inputs 基础

CWE-256: Plaintext Storage of a Password 基础

CWE-266: Incorrect Privilege Assignment 基础

CWE-269: Improper Privilege Management 基础

CWE-286: Incorrect User Management 基础

CWE-311: Missing Encryption of Sensitive Data 基础

CWE-312: Cleartext Storage of Sensitive Information 基础

CWE-313: Cleartext Storage in a File or on Disk 基础

CWE-316: Cleartext Storage of Sensitive Information in Memory 基础

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization 基础

CWE-382: J2EE Bad Practices: Use of System.exit() 基础

CWE-419: Unprotected Primary Channel 基础

CWE-434: Unrestricted Upload of File with Dangerous Type 基础

CWE-436: Interpretation Conflict 基础

CWE-444: Inconsistent Interpretation of HTTP Requests 基础

CWE-451: User Interface (UI) Misrepresentation of Critical Information 基础

CWE-454: External Initialization of Trusted Variables or Data Stores 基础

CWE-472: External Control of Assumed-Immutable Web Parameter 基础

CWE-501: Trust Boundary Violation 基础

CWE-522: Insufficiently Protected Credentials 基础

CWE-525: Use of Web Browser Cache Containing Sensitive Information 基础

CWE-539: Use of Persistent Cookies Containing Sensitive Information 基础

CWE-598: Use of HTTP Request With Sensitive Query String 基础

CWE-602: Client-Side Enforcement of Server-Side Security 基础

CWE-628: Function Call with Incorrectly Specified Arguments 基础

CWE-642: External Control of Critical State Data 基础

CWE-646: Reliance on File Name or Extension of Externally-Supplied File 基础

CWE-653: Improper Isolation or Compartmentalization 基础

CWE-656: Reliance on Security Through Obscurity 基础

CWE-657: Violation of Secure Design Principles 基础

CWE-676: Use of Potentially Dangerous Function 基础

CWE-693: Protection Mechanism Failure 基础

CWE-73: External Control of File Name or Path 基础

CWE-799: Improper Control of Interaction Frequency 基础

CWE-807: Reliance on Untrusted Inputs in a Security Decision 基础

CWE-841: Improper Enforcement of Behavioral Workflow 基础

CWE 信息

漏洞映射说明

依据 : This entry is a Category. Using categories for mapping has been discouraged since 2019. Categories are informal organizational groupings of weaknesses that can help CWE users with data aggregation, navigation, and browsing. However, they are not weaknesses in themselves.
备注 : See member weaknesses of this category.

提交记录

名称 组织 日期 发布日期 Version
CWE Content Team MITRE 2025-12-01 +00:00 2025-12-11 +00:00 4.19

参考资料

REF-1500

OWASP Top 10:2025 RC1
https://owasp.org/Top10/2025/0x00_2025-Introduction/

REF-1506

A06:2025 - Insecure Design
OWASP.
https://owasp.org/Top10/2025/A06_2025-Insecure_Design/

cvefind.com 上展示的信息来源于多个精心选择的权威数据源。CVE 数据由 MITRE Corporation 和 National Vulnerability Database (NVD) 提供。已知被利用漏洞（KEV）目录来源于 Cybersecurity and Infrastructure Security Agency (CISA)，EPSS 评分来自 FIRST.org。此外，软件弱点（CWE）和常见攻击模式（CAPEC）数据由 MITRE Corporation 维护，硬件和软件配置（CPE）信息由 NVD 提供。